{ "Event": { "published": true, "date": "2026-04-25", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-04-25", "timestamp": 1777161782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "605f0f12-ea21-450e-9db8-65e11a514657", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d78b8f34-40a8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777122934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777122934, "uuid": "11db3cea-7fb8-4e63-981c-82f6a17b8427", "comment": "Malware payload", "value": "6f26d57dcb4ef6a6e96828ade9ab0166", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777122934, "uuid": "a10633d2-133e-49eb-81ce-da024a7e1509", "comment": "Malware payload", "value": "00613d730f5472368db6610fd787a1974bfa2a3988608aa46a9a8de78399b9f1", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777122934, "uuid": "57a21dba-c189-478a-a5f6-92465ee8c656", "comment": "Malware payload", "value": "e98b646f8857116716e868894805882e0e0deae0", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777122934, "uuid": "da71eea1-e43b-4e0a-b1d6-5c1e53058e08", "comment": "Malware payload", "value": "1a865b6bd75a7a81dd0c2f0ad1962233d6a4d8c1ed6325c1d3155825b4b3576d6311874754a5be5f432d3488bd38b33b", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777122934, "uuid": "41c5c4b5-a29d-4a37-a6fd-4799256f864d", "value": "T119A62316F30D982ECDD6B13D99290261232BBC7C5651D39B2D01B229AEB76CC5F29FD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777122934, "uuid": "7c8d0f6a-6d32-4ab3-8ce3-2a1a2694868f", "value": "196608:qpJkEKJcMKb638KFS0nWw5mU6h+csl9NpTMuBN21TwxgUia8ys1eX7GQD:qpnKik3tS0/5mRh+c89NpTT21s9i0XaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777122934, "uuid": "3e51e2b8-be34-4813-a2a6-88ceb978941e", "value": 9956913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777122934, "uuid": "31884d58-5c44-46d2-9557-47e6807eda78", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777122934, "uuid": "4ec91a11-3dd3-4dc1-8766-627fa0d61b8a", "value": "com.storage.delete.cleaner.pure_1.2.5.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ca76bb6-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128740, "uuid": "da2279a6-370f-497c-905f-db284d6d0ca9", "comment": "Malware payload (Mirai)", "value": "95fc7548bd8cb545cfcf51e9795c625b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128740, "uuid": "436f57a3-67b4-41b8-94fa-b2366a828052", "comment": "Malware payload (Mirai)", "value": "0076391e19172dbe6ced919f80859960e5e2c93082abdc1291800d5b36488158", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128740, "uuid": "901cf323-51c8-48cd-86b4-2d06c5afdf92", "comment": "Malware payload (Mirai)", "value": "873bfefd5450df3651a1ea45bae6e687b0a33fdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128740, "uuid": "1c6b3e79-31ad-45bf-bdba-d82438650da4", "comment": "Malware payload (Mirai)", "value": "fd9e1fd4d139cf47fade38d3bbecb679300ed49188e66c7a2e5513bde4170aaaa089dbbe4bbf58e4ae7a04e91b1a9540", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128740, "uuid": "e79890dc-6183-4c6f-ac21-6aa97208b420", "value": "T11FC39DD7F34B1491C4A20AF047C74FAE6AA3A1118F5FD9E72C1EB63B18794CB4906792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128740, "uuid": "0524b6b3-2a69-41e5-acc3-40f343be36a8", "value": "1536:Li33dUfTydsBGeOXFbkDpo914ogSNswlHxS47r3cxbJnMgSGR/LWAO:23OtBGJbEps1PDNswXS47rMMgPq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128740, "uuid": "4e1c0345-28d5-426c-9c44-352d7ff5856c", "value": 124667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128740, "uuid": "bb1488c5-b69b-4044-97f7-4cef10dc62de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128740, "uuid": "ccc8c9c2-bf1e-40d8-b70d-682efc93e448", "value": "m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d68dca92-4056-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777087713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777087713, "uuid": "b1427dd4-50e3-4de8-803c-e83b58a00c63", "comment": "Malware payload", "value": "23153ce512978df723a04e56bb7164f3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777087713, "uuid": "d6dba446-3159-416c-9f3a-1254628480f9", "comment": "Malware payload", "value": "00d9b7f4eccc5189383043054431caaf4d0414baac6672a36db5ea3a700611ab", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777087713, "uuid": "6e89a18e-dcc0-441c-b17b-c6f9484ea3c4", "comment": "Malware payload", "value": "1af37e1fe433f8c184bdd390161bb8cd20a47206", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777087713, "uuid": "1570d747-46aa-494d-9cb0-adb768b9e670", "comment": "Malware payload", "value": "f56cd7a0e8a4509d925afc6cb67f6409d2549aebd5079ad9e0af005ebb6d8400d0836f07c66f401e3b6187c798ae92f6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777087713, "uuid": "a2fdc4fa-042c-49d3-98ef-2de0a2bb8b0b", "value": "T120F082D6E1311AC28421BF09F76AC9E965A3D7CC11CB5B983EE9787E863C8107910A4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777087713, "uuid": "92e3bf98-6eb5-40b5-995a-fb50941a3c76", "value": "12:EsrS2sPspDXsrNIh5hFGjs7cKLKuFGjsWetY:EsrS2sPspbsrNIfhEs7XKBsWWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777087713, "uuid": "b9ebb63c-53db-4535-a779-e794d8eb2d1b", "value": 502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777087713, "uuid": "95b70365-9a4e-4502-919d-ec9e652a6691", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777087713, "uuid": "6bfbe1bc-c45c-42a1-b2a0-af636ea681e8", "value": "g.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db496fdd-40ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777137543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777137543, "uuid": "0003c6fc-61b1-454d-a0c1-cb4c919a1319", "comment": "Malware payload", "value": "445d43470df7f9f8b6a96320bc0655fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777137543, "uuid": "2fddb7f9-9cb2-4c99-bded-ca7d6ff09225", "comment": "Malware payload", "value": "01faf142122f8f62093b7feaf7000133f1f334652fbd92ce45f8f835a2f07c63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777137543, "uuid": "7bf8a33a-fef4-4da5-9cc8-349509dd941a", "comment": "Malware payload", "value": "9cc6b5b79e3e42b2e9f4754c50b16dbe3ae0ebde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777137543, "uuid": "9e606ec9-792b-4eaf-8458-fcd078c594c6", "comment": "Malware payload", "value": "2f1d89f7935b486c8089b01f47c7ce9cc6dcce1911685eb639df8cc84703f5393b1af7f7912d9e2afe22da21e7f01dbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777137543, "uuid": "bcefa249-5319-42a2-938c-9a27b7005b4b", "value": "T13C064B31324AC52FE96201B0192C9A9B552CBF760BB254CBB3DC3E6E1BB55C21736E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777137543, "uuid": "9b94151c-5d22-4fff-b6f0-609e2933e033", "value": "608505ff1e7e27ff4a42ea9c4e9f4192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777137543, "uuid": "83e3ad73-e3e5-4137-a7d8-6e64238e871e", "value": "49152:qWbbWb9tjju4k9y6lHao8JhBJyRjYQcUBiUARPU8Gbr2Y5l5af8PAELcpB2MpF8D:qr99u4kc8Hao8eRjYBU4UAir2Y5qf8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777137543, "uuid": "86ce39e4-fa5e-49bf-828d-3c48f098bb89", "value": 3777920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777137543, "uuid": "58d34299-281e-49b5-b924-299073c30d11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777137543, "uuid": "fb95d451-bc4d-468c-beef-01cdc2e1b591", "value": "Cryptofolio.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c2224d-4070-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777098800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777098800, "uuid": "107d98a7-47cc-4e64-8d96-363993a3a1b3", "comment": "Malware payload (Mirai)", "value": "1b5c4f00b60fee7bf341001853aafe3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777098800, "uuid": "b5decce9-376e-4ab5-ac1a-6e0c3a9b8c95", "comment": "Malware payload (Mirai)", "value": "0210226f81dd3a82cadf856dd996f0b5fcb210cb2630d8d1eb1a50abc7c7a95e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777098800, "uuid": "22fcfba4-179c-470f-bf1e-ab27e63b5697", "comment": "Malware payload (Mirai)", "value": "89b5925efc72d63bfd32a1e9552b4b197377a46b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777098800, "uuid": "92745718-0e52-4e64-bd45-58ea01f08d4c", "comment": "Malware payload (Mirai)", "value": "7fedcd11895ac2d5d57daa0ac9046b7708aaa819352fe12ae9801283e4f3be6ce88a5bdda6e478c2d7ad88612dc17e95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777098800, "uuid": "35614015-f9b2-4300-b5f1-79498ad13d35", "value": "T121831273EE1A69D8C6650C34E47AC2C739F7CAF660D53820BA440AA53C65D2D6C9E3CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777098800, "uuid": "5c3f33a9-a10b-4d47-ba1d-ca089f7fa4b7", "value": "1536:FiP8fq2XZHuSALCpVmkInClz4fBJFjUrAFYMezOY3u+ZA7N:c8XZHuzAkkTEJkAFYdzF3u+S7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777098800, "uuid": "bd5e9306-eae5-4ad2-879f-3aa08a5ebe84", "value": 84180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777098800, "uuid": "538c1cb5-d294-4a93-b717-fd28db10d95b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777098800, "uuid": "f5ee86eb-8ab3-47e1-b45e-9beea0f87b53", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86cb45d5-40b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777129670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129670, "uuid": "6b72e079-c8e6-4729-bd59-ed3799ba8756", "comment": "Malware payload (Mirai)", "value": "b5b96a1bec4829501b85e6fe1c5044f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129670, "uuid": "737d4f43-beb5-4434-a62c-a1f3552115f1", "comment": "Malware payload (Mirai)", "value": "02a24a0fcb783ca93fb3420765e4a1bf3f49d233e2cff074549cb2058a1d8ac5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129670, "uuid": "3caeb63c-97b0-492f-88b4-cc0b2a136035", "comment": "Malware payload (Mirai)", "value": "eae582a56f3403a2856d4a4f3b25f7f309f06ffc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129670, "uuid": "85f8e137-c900-4c4d-8cb5-367f89311af7", "comment": "Malware payload (Mirai)", "value": "558e0c9ce942b9dd29140832c2d86f4c25f7d731302c90695854ca6ae8bb4239a77e4c38bbe679e73a6f4fd2752e2f26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777129670, "uuid": "84be7c03-3d70-45d5-bce4-f73344364aa6", "value": "T178866C47B5E318FDC19AC470472FD6A3BD7078984221B97B7698AA302F67E205B1DF21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777129670, "uuid": "09d8566e-cec9-4ac2-bee9-e779e0ff947b", "value": "98304:7+aLMsS4uGQp2Za8w/uk0zX0qme09CQD9VOe21gPEGbYV6MUtCqlXAiO7+PSFpyJ:hoGQp7XbYofXdZsNcS2DZLAGmU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777129670, "uuid": "4b4cc9e9-7555-4772-9c5b-b42dbe18fdb8", "value": 8297712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777129670, "uuid": "9bb040a1-7f65-42dd-9404-41e859ecfd3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777129670, "uuid": "837d9a2d-6fbb-40bb-b458-851953b6473f", "value": "kamd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9597246-40ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777160330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777160330, "uuid": "c5604f66-c262-4667-9545-e189878e7a98", "comment": "Malware payload", "value": "458dfaad1af2c1ab41dbf672a01a2346", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777160330, "uuid": "38f1af22-70ef-4aa1-82a7-78558c7045f8", "comment": "Malware payload", "value": "03eeb84859e010ffb759cfbd4b334943ead85466df9b6ad6b20c458ff3e82ea3", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777160330, "uuid": "1422a30c-276f-445c-bd42-34871744e6d8", "comment": "Malware payload", "value": "bb32f40e12690fea0c78a6d10ee3eee6308581c4", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777160330, "uuid": "3a2e7688-9bb0-44a3-a755-32ecb44f77b9", "comment": "Malware payload", "value": "3e73f8c3e6ad76939fdeeaef19709c100618a3553a165d89ea5ea26d197b9539c1733bfd8179eb6a9925aa7e54aef2bc", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777160330, "uuid": "3e11d233-cac7-4086-81ee-f3e54a4e24ec", "value": "T190C32F9A4CDE44B2C76EB0B2579BACA7A2C1E21F474CC552B76F9501EF36888D07E1D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777160330, "uuid": "cf91e090-4ebb-4c73-992e-a63a1fa03d5a", "value": "768:YRbxFR7BVS13cqafOJ+LTo6gVOL2opDzgSrHjAla2asC9ROKmgji9KSonGE3Aeco:sFRmHb9KSoHZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777160330, "uuid": "b419a495-7ff1-4e4b-8e46-f652ce58713f", "value": 128531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777160330, "uuid": "0b0e100d-761b-411b-bb08-e76b419b32f8", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777160330, "uuid": "8cecbfec-2d08-47f3-a3d8-a1353d67374c", "value": "Images_Winter__89.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "383a246a-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128679, "uuid": "676069cc-faa7-49fe-8bcb-14eb01faa4e8", "comment": "Malware payload (Mirai)", "value": "ca00ebd25f1f5a849b8b30e0bc103816", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128679, "uuid": "a1d355a0-8f27-446d-8717-28e8baaddf99", "comment": "Malware payload (Mirai)", "value": "0461e2fd33b836da1bfbc4475e97f57559401b4a23cafa76e5cd62858403588e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128679, "uuid": "87b3596b-f700-4a2d-a93f-12540404fbb3", "comment": "Malware payload (Mirai)", "value": "4f69ab0a572563f7c45be02a445ec212aabe80c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128679, "uuid": "f26ec765-b58f-4760-acc2-015b6191ec50", "comment": "Malware payload (Mirai)", "value": "82165635de0beac39d26940eb3a01bc6c685099f1cbf716f80bb82d507b4d2d0f076acc5e275294a06a3848c83b34d71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128679, "uuid": "72db05b1-2191-4d03-a4cd-931eedf3f439", "value": "T193B30945FC505B17C6C652BBFB4E428D7B2A1768D3FE720399256F30378B96A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128679, "uuid": "954631ef-9ab6-48e4-9cd2-ab9cb60234dc", "value": "1536:SUK9yqnU8vGRz4VA4j6T9y28Ty6O5FtZpqQcZlCtwywXvqcVuafhPeA45ZvT:XixnUHz4Z+5ypkn3E8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128679, "uuid": "ce53498a-e4ee-41c5-86ab-8dc71f3b9276", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128679, "uuid": "e82b5cbb-819f-4da2-93f1-fdd91b3af0ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128679, "uuid": "f2d38a91-818e-4217-8faa-47735c50653c", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de4385f1-40ef-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1777153439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777153439, "uuid": "0eb75534-520c-4414-a0a0-90b91ecc7586", "comment": "Malware payload (OffLoader)", "value": "da6a5146fcedf93661d751295e4a1907", "object_relation": "md5", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777153439, "uuid": "3e605327-c3c9-4bd7-b6eb-7de6722f949c", "comment": "Malware payload (OffLoader)", "value": "0465fa4f081dd286191a6602fd6aebcda94d3362759192c36adb408729c4e3ce", "object_relation": "sha256", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777153439, "uuid": "ae2f2bfd-4437-410f-b0ab-b1cee1c573d1", "comment": "Malware payload (OffLoader)", "value": "fde474e74d45f7323376628df32a8ed0d6b29e3e", "object_relation": "sha1", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777153439, "uuid": "2821d9f4-625e-413b-ad33-64a9f2240111", "comment": "Malware payload (OffLoader)", "value": "7e6baae74a4bb63b6244a271c9df26ce5685990ae0151af4aeaa30d67284e36a184bf88fa04b44650e9de2d8e845655e", "object_relation": "sha3-384", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777153439, "uuid": "112450ff-70ae-4c0b-9339-1f8c5935f045", "value": "T1CED62323B24A633EF06E5A3B59F2D2545D3B7B21A45E8C06A2E44C4CCF6E0602D7F756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777153439, "uuid": "0dc27bcd-9607-410b-a90d-c20b6c888640", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777153439, "uuid": "e65fe727-8a4c-4187-9573-c53036053908", "value": "196608:c47ru0GMJMoRm/sGsHLc+3Ym0F8Q9x/rt02zxOpOjAOjjTjWiGW9CfLUn:c47yv6fMsrc+3YV8QLrtTjEOTj0W9CAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777153439, "uuid": "bc3a3763-3661-4977-9ac4-48b44281221d", "value": 13000343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777153439, "uuid": "12e9f689-c0bd-48c7-8738-d1b1bc079986", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777153439, "uuid": "090caa05-ccd9-4380-9309-31d420828f71", "value": "VqqfwSETUP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf792f2-4045-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777080127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080127, "uuid": "a1b4c9c8-f923-4cae-9fd3-c920760867d2", "comment": "Malware payload (AgentTesla)", "value": "9c38883b1c34128a5684c76d2aa4ece2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080127, "uuid": "be57a87a-a2ec-44a0-9150-c9d71cfc8e47", "comment": "Malware payload (AgentTesla)", "value": "06342e1268df105c26721f1410fc92b84b4ea86e239aa0fb148728c10d292cce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080127, "uuid": "a1c177bb-102e-4ea9-8dfb-aaf2b71e16b0", "comment": "Malware payload (AgentTesla)", "value": "db4b9d42140ea7c369eaf652958d44ec044d0c4d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080127, "uuid": "d2022021-5062-46a1-9394-244f8dc73844", "comment": "Malware payload (AgentTesla)", "value": "4532e0d38133ad9f4394db80ac568c5f9e40685cafebf10d10a2731cc41018de39c955b63ae19866b4e2d06e5cb6c817", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777080127, "uuid": "7f1bf928-19d4-4e90-8ee9-4a7897feaf34", "value": "T1602523446DDB3CFE8ECCD66AE5FBBE1453F00BB5C02AA5DB82C56805842EF55A817318", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777080127, "uuid": "054bb2bc-8706-4884-8a30-2aff71a80e9b", "value": "24576:m19gsxD460bqk7LXbzqMQWnHu1rE2CP38THNpdbjZ:m19guDvKR7LrzuGiaPQv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777080127, "uuid": "466de2fd-aae4-4e08-a2ea-eb8d457f6b49", "value": 1033757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777080127, "uuid": "7ba9b0fa-f4ee-423f-8843-2e5766cc8328", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777080127, "uuid": "b00a3bf1-f9be-4bde-b96e-5a5ebf419bde", "value": "ps_z2owkKEACHUF_1776949904904.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508ade64-406b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777096508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777096508, "uuid": "6fb8f024-b96c-45d5-b416-4fda9d77b539", "comment": "Malware payload (Mirai)", "value": "7b24890c7f2faf44f9c4ca831415eddf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777096508, "uuid": "b6bd56e8-405c-4305-9dc3-b8a2fc775952", "comment": "Malware payload (Mirai)", "value": "06a8a9834b2569bcb187e1432b9a4a7b9df455ae1058dba02fb445a25d70cbcf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777096508, "uuid": "55ee8c26-216a-49e5-9d31-31b3789f1c3d", "comment": "Malware payload (Mirai)", "value": "1acf5e230496ece397725be621e3c41531cd7882", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777096508, "uuid": "b07b6dbf-f65f-4efa-9684-9f00ddd7d77f", "comment": "Malware payload (Mirai)", "value": "5d837f52d422ee3113a3eb471d2be22fb2826bcd1253a2dcf43857a187bd4502c2cbfa9cb86501c2f52c6e5a10757a42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777096508, "uuid": "74174ae4-b511-472d-9068-59a12392a9bc", "value": "T1688312CDC5DA76A1C6AE09F42F441E389BDAB3A862CD0A1D6B4DD4C5BEF810774480BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777096508, "uuid": "d255d6db-04f6-4cdf-bc76-7bed8e3f835c", "value": "1536:gwkAUIuowkUqnHcDJhH/QS6VJTwbO7Jd53+8UkvfwQRfXmT:gwkIuwUqnHc/fQtVJTwi7U89mT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777096508, "uuid": "2490bbe3-e6c3-4c6b-bbfd-e7b70cc77ce3", "value": 81524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777096508, "uuid": "8616f816-1fca-4768-9010-82149d0182d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777096508, "uuid": "0cbfecaf-5ff3-47df-81d9-4c88d889ed49", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4accd5a9-40bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777131287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131287, "uuid": "105083fd-5bf4-40c3-a936-ac0952e5f785", "comment": "Malware payload", "value": "189cb8cb85099001589af11e3def81d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131287, "uuid": "287ef610-e186-464b-94e2-1dfa96612909", "comment": "Malware payload", "value": "06e2ae9c3cc7e1e357b669689e58c310e955282ee583c7c319ed6efbcb14b7d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131287, "uuid": "164776da-2916-485a-b7a1-11cb18fb3d02", "comment": "Malware payload", "value": "fb9356b04ce300f12af91c98e057ac01be027a89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131287, "uuid": "a901daa3-b465-444f-87f8-05c2f04ef74d", "comment": "Malware payload", "value": "958c185eb1fe55d855f89f5df381ac7e533904151894e3ac61934cfd560fe0527e3c667bdd08dc2e9b5ab5373b44e11c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131287, "uuid": "15961080-dc76-4029-b1b6-a90c915fee1c", "value": "T1B45423F10A3B6AB0C2AE31F7711E5CC859D2FCB004A0B7F112B696C59E367D056B478A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131287, "uuid": "1c7c070f-821d-4732-8bc8-07ece430727d", "value": "6144:02HeSIGCahUbRcUttLzfKhJnW1iKPkkqXVvpaOp2VCdavCYR:dxrhU6qubnWcfkqXB0OcCdO7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777131287, "uuid": "d1852a12-07b8-40d3-8040-9f4754bfed73", "value": 292572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777131287, "uuid": "5ae40f85-268d-4148-97af-e7d7fe85f96c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131287, "uuid": "25f21520-58f6-447f-8309-2b2c38220c2d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f8508a1-40e7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777149871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777149871, "uuid": "094650d0-e072-42d7-b83d-778bafd50a92", "comment": "Malware payload", "value": "ab90adb63bd5a108bd54500201fd1073", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777149871, "uuid": "bd3b1af8-8e67-4ff9-b938-9655d8ef3418", "comment": "Malware payload", "value": "07055b811ee5ac3e94982d3b0cac1a64d0a3c3d83dc4a6e36300323f14879c75", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777149871, "uuid": "c8de74d0-059a-43e8-8e24-0736b2e45a7c", "comment": "Malware payload", "value": "64ad385591cf7e3a63f1abf745c27bd55fbadb3d", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777149871, "uuid": "280b8df4-ad9d-47a7-8ea2-6da08b80ff11", "comment": "Malware payload", "value": "9f9010d22674d2fc9c085d8b461df31027cadfb086de97912ff96392cdf8c22c3ba4a4fa4722b20a9ca7822b50312460", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777149871, "uuid": "cac5850a-d7a1-4939-9d6b-5a8906f2ec44", "value": "T107C125416BF81218F2F37F49AABE5524593ABD65AC39CE4C00551A0E08F1F49C87AF7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777149871, "uuid": "d88562c4-431e-40d9-ba6b-96f4e48f26d0", "value": "96:VgMbrxAreTGceaRl+RNTXRqAtZa/bEhVqaQyAejaX2PCmG+8ZTQfq2gE2Whtyv:bqXaz+LbFtZaqVBjamPCW8ZTQqETY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777149871, "uuid": "23ff1af1-1542-4a3f-8d39-e2ce70702a86", "value": 5850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777149871, "uuid": "dae07378-47f9-4d7f-9545-332dd825e0cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777149871, "uuid": "0d8debb0-cdb8-4299-bac7-61de8228ed7e", "value": "scrCE0A.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dbc08bb-40ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777130326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130326, "uuid": "577e36f0-9510-405f-94d4-305c34ffc80f", "comment": "Malware payload (Gafgyt)", "value": "0e3b8488630278ec69ece049c9bbbe64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130326, "uuid": "35b4ac41-fdfb-4c62-b723-fe7d43efeb96", "comment": "Malware payload (Gafgyt)", "value": "075047781da6545a79ff3c7f059bdb1b325c22d590770a4eb3cbb592ee2b5472", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130326, "uuid": "3345dbef-ffc0-4881-ae02-fa5413f87b4a", "comment": "Malware payload (Gafgyt)", "value": "7d7677f6c8f8259ecc8ce02b4b5e6ae2939cd6b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130326, "uuid": "2f732543-c295-4a20-8034-1c21d82c88c5", "comment": "Malware payload (Gafgyt)", "value": "425c5948a448d8122921ad8f87f05594833c04db18c15318f7ce9dc7772785b9b0f32c6919ab7b87e0b03850eed1ae04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130326, "uuid": "5bbd2d83-78c2-4496-bb6b-c53f96f3f292", "value": "T141E32853A8655FA7C196AFF522E34A750753EC114B4B0B8AB23AEAF402079CDB809774", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130326, "uuid": "82a7105a-2903-4177-975b-4d71ec7cabda", "value": "3072:FTWiLaXbxK2asipWjjJ6cjlQyT1mlqaN7rx+v7MXWffhi:FTWiLaXl7e0jjDZQm1mlqaN7rx+v7MXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777130326, "uuid": "feb7edb3-acaf-4de0-9bce-0446d062600d", "value": 154213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777130326, "uuid": "2eed0334-37d1-41e0-814c-a771e85aed1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130326, "uuid": "87561dde-7bf5-4686-8f1f-b705108e0149", "value": "bot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "200c2bef-40c4-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777134652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134652, "uuid": "3a8e7976-e5bb-416a-9988-153604244f03", "comment": "Malware payload (AgentTesla)", "value": "d34d2844d3903e899eeac9efcb27cf1a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134652, "uuid": "da12c42e-11f7-4dc4-aa08-38e964b72da3", "comment": "Malware payload (AgentTesla)", "value": "0756bf6e4a8fb3241afc9918e611e6b0348d810b2e920fe0afe82cab56feb847", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134652, "uuid": "4abe9abe-d937-4aef-be8a-be280784e7d5", "comment": "Malware payload (AgentTesla)", "value": "02e5bfae55bb5921a9c320220c8346f8fca205a3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134652, "uuid": "a95366fb-7ad4-44d6-80e7-681ff673300f", "comment": "Malware payload (AgentTesla)", "value": "1c3b2acf858f845b48bb462fba0399bc08dd0b87a61c9ebe6254bbd95506ff2adda7a7b6becae3a000eb940af2856352", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777134652, "uuid": "46013f64-54fc-401a-bcb9-16891cb09cf3", "value": "T1FA2523341FA53EEA415C82C9B02F3F10CDB1DB634A0BD8D46EA198DF9A67750958723E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777134652, "uuid": "ec7c8505-c3fa-41a8-8eb9-c630f942540c", "value": "24576:Nl2I5S1D+eHsmVcwqPk/0H/OPjrp1ucvGGCrO6IM:KI5MvGTfOpML1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777134652, "uuid": "3c313a32-3f3d-427e-acb3-3c91222359b4", "value": 1055027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777134652, "uuid": "f7cce017-99ba-4028-8067-bdebf77af7f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777134652, "uuid": "7f6d8fd4-23e8-482e-8736-be016e05e0ea", "value": "ps_ic1LEwVOyOEc_1776435687967.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acce53c1-4097-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777115560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777115560, "uuid": "9b596a45-3f66-4ebe-8e51-e82e77d7ed8b", "comment": "Malware payload (Mirai)", "value": "2e9f750604295f60c5572805881bd3a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777115560, "uuid": "023c522a-2571-4365-ac46-14c52d27bf40", "comment": "Malware payload (Mirai)", "value": "07e74cece7a0a4ab592cfc95620db1bde0ed7a3c2bcb21fd560335d0911ef9c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777115560, "uuid": "962a7a82-9238-4746-b5bb-109b4249a972", "comment": "Malware payload (Mirai)", "value": "32a14926c26f52156ec7afdadca0e56d5d809b10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777115560, "uuid": "709f1149-1786-4384-b361-d4372b0cc315", "comment": "Malware payload (Mirai)", "value": "9b3d66951b8ed2b4d7263b0fc4bc5ca9e6133e0fbf7944b0f24734c2cead040dfd97fd476a5bff9691b9d14da9d716af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777115560, "uuid": "d9ed0c28-dd82-49e1-9b59-1d17166ff4d7", "value": "T13354C50A7B619FB7C46FCD3305F98B0128CCB45335652B7A3670EA5CB62A58B46D38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777115560, "uuid": "f5400294-d000-440b-ac30-3008c25ec6e4", "value": "3072:N7MDoQ/iBetq072EcbZKwkoIpMG5IqyRShP/UjPpnGqbV:UoQ/igtq0KTtd3IpGzSh3Ujv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777115560, "uuid": "9b9cf730-ddc8-4677-beaa-1d8d4284adc7", "value": 305576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777115560, "uuid": "e4f14402-25f0-4637-93c7-7359e0b263c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777115560, "uuid": "30015d70-2faf-4482-85b2-47dfceec1dc6", "value": "bin.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec01cfb6-40b7-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1777129410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129410, "uuid": "3b6845e0-4532-41a9-88b5-551297ae9ca2", "comment": "Malware payload (CoinMiner)", "value": "dbcc99b31acc5bfd525846e9a2c17e8b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129410, "uuid": "1583d8a5-5751-46fb-9f9f-56258366ec37", "comment": "Malware payload (CoinMiner)", "value": "07ee248f0c5592163a16599864027948c1fd518a04dc8a71853a974f2dde436e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129410, "uuid": "bce04847-9ed6-4274-a4e0-1955a10b9792", "comment": "Malware payload (CoinMiner)", "value": "38e6c8e8f3e4934829c921a8e6725f49d3548e8b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129410, "uuid": "27e41e02-b215-4342-a0af-06f8ae5f7337", "comment": "Malware payload (CoinMiner)", "value": "cdc5d993fbc4f0dbbd1943353ef61dec52681f0681e3c47e136cd4446baaf2b91a6b9f35aa3955c91eadf567a8118f50", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777129410, "uuid": "201cc794-c7f2-46bd-abfa-0c19b7b8b5a7", "value": "T12FF633D424569D0EBD0F017AD1EB4F6222AD0C7C2DE5E82D0EEC9110F25AAB96DCDF16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777129410, "uuid": "a1febe54-f0b2-4f81-b9e1-c4cb1e62082a", "value": "393216:LSP93mIc9a2FHBw060Nw/2mXPdzE60WsVI5dV15l:LSx6saw0jw3VsYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777129410, "uuid": "17a9011c-2706-40b8-8349-a32516c610c3", "value": 15581672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777129410, "uuid": "cad0b3cb-6cdc-48c3-9fc5-fa59a267ff31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777129410, "uuid": "718f6013-873e-4be7-b0b0-ca95bb6d391c", "value": "vca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "641f80bc-40e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777148510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777148510, "uuid": "111642ed-3c55-4d63-825a-9a44daf03519", "comment": "Malware payload", "value": "406fbf33bdb69a17b5b24ae38bf2acc3", "object_relation": "md5", "Tag": [ { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777148510, "uuid": "0f3377a0-5fba-4459-b356-e70d03f48632", "comment": "Malware payload", "value": "0809303ba64b9abe6fe3c21840f97e2ad7ac1e6b78f71c614be7563115f84263", "object_relation": "sha256", "Tag": [ { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777148510, "uuid": "bfa85827-f8af-43f8-942c-e9ab8023d2c5", "comment": "Malware payload", "value": "98e81e65ab3fb55d47836173d39dd3a24314fb39", "object_relation": "sha1", "Tag": [ { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777148510, "uuid": "33dca4c6-68e3-4d9a-9dda-e2f37022f6ae", "comment": "Malware payload", "value": "198450077fddfe5abc25da6bb41299999f5b71f5ef321042cc5f0cf47fb4b48a98cbd84802decfca88833ebceedfdc4f", "object_relation": "sha3-384", "Tag": [ { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777148510, "uuid": "d8547306-e94c-4dbb-845c-5d18616e967c", "value": "T107B2385303851BBDF6CD0EC5895B245B20F2E52B7D251298EBB36EEBBC3B9845430636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777148510, "uuid": "a35154eb-01ee-4611-a7ce-f0207560f46b", "value": "384:ol6ClbQV8LZRQBZaKwVpRp6kUDLUdn4ZUhH/iyuhb/p+5Sl2hvFpZU2BEdjCxaf0:oMClUuRQXaKwx9mQdcAfjGb/p+9hd1Bd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777148510, "uuid": "bd43d60a-16e4-4f27-ab75-bfaf20c941a7", "value": 24192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777148510, "uuid": "e17c57e3-9507-4845-87bc-222589301bcc", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777148510, "uuid": "e81c1e41-f988-47d1-86a9-7a2e362904fd", "value": "config.php.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a8c9dc3-40a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777121865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777121865, "uuid": "eec82a30-f195-4db8-96c3-0b3cb28b5821", "comment": "Malware payload (Mirai)", "value": "b86b7c6b3b864d0589d2c328a4e64161", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777121865, "uuid": "020ab8be-5557-4e7a-b23c-a1af8b6d39dd", "comment": "Malware payload (Mirai)", "value": "081447160d90eca72d84c18177dc1c5eddaa2884308b717e32297b0e3ea34d9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777121865, "uuid": "c12c3cca-fb5a-4070-ae15-f35146a194fa", "comment": "Malware payload (Mirai)", "value": "3aef23769c1db26de48c7e2fe184b14b287e1a1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777121865, "uuid": "c05b2d03-e88f-407a-956b-3c0f7f6fcd50", "comment": "Malware payload (Mirai)", "value": "dc0c32a18c6aa9c5de2b05d938c67c82a2a2561ae4a67afeb02f4dfc07f47755f5c0e25631c5f89162b3da51d6a18df7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777121865, "uuid": "a86679f9-dcb5-46da-8360-009e5284a2cb", "value": "T10203F194C0DC45E5CF6E6EA40E2383CA2BE2095D337DFAD1B5D5E9E08982C26E098DD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777121865, "uuid": "6adf66c7-6f70-40f4-9e97-56d9a553925c", "value": "768:vF7u8qvFAZbrMfDNPqwiCBfGxBXM/gssjWOSF8YfMOif60NBOQE/1w4Hx34uVcqM:v4dABrEDNPqAsGgl/SFvUl60NwY4H94Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777121865, "uuid": "86208955-064a-47af-bcf4-4407c6920780", "value": 41067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777121865, "uuid": "2c66f0b0-823a-4f57-abad-1246606804dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777121865, "uuid": "bb02ec16-e9ed-4ca2-bc5d-fc8ed065b9ef", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af92792-4045-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1777080177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080177, "uuid": "d6ff3eaa-4068-474e-93df-a8667d5ec858", "comment": "Malware payload (VIPKeylogger)", "value": "8054e2059ddae56161276b0ddc5c5e70", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080177, "uuid": "c1324c37-6549-4411-a15d-e491de6d210c", "comment": "Malware payload (VIPKeylogger)", "value": "089926d3be6b1ff8c5d23d9bb29aa129fd96c95770af87df5b6d843fa5a0631d", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080177, "uuid": "dcbbddea-1de0-4cdb-911b-62588770de4c", "comment": "Malware payload (VIPKeylogger)", "value": "c2d157ba000c4375f0b94da483296686afe8cc11", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080177, "uuid": "dd6711c7-2eb6-4d38-84fd-79ce8d211203", "comment": "Malware payload (VIPKeylogger)", "value": "0ddfae234fbb572a05780dbe193ab9e2c5cfff982bce915141162cd23a183fc1c12d5ba57ff2c3bf0389e8bc27906d00", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777080177, "uuid": "ad301e36-02ba-48f3-822a-c1d558131134", "value": "T15207EE3DCEE8423EC2B7C929D9CA4A17F85A091B231CFD4A68D773A755271827CE211D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777080177, "uuid": "637fde28-e155-41f1-ae3a-dffe2ea1116d", "value": "3072:9uFuTJuYiVWZu1l9qhpvIYFv4RziGRLU4ZqwvexvMPw2d+41YzXpMmsh7GrYZNPh:s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777080177, "uuid": "8295d09e-3f7b-47fb-88c6-aa3308199641", "value": 17364572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777080177, "uuid": "ad8266fb-a715-49f8-9835-66919d2358a5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777080177, "uuid": "e85d508b-9b56-4f1a-9535-7468a850eb04", "value": "wtxxq.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69da438a-403c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777076364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076364, "uuid": "a85ae65c-61c9-44ce-b383-8bd79c535038", "comment": "Malware payload (Mirai)", "value": "91017ac555a049103777c1241e0064d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076364, "uuid": "191d0360-b363-4e7c-b5db-6dda13b5bad9", "comment": "Malware payload (Mirai)", "value": "08ecc09a46d148fa47ad446f18c83de712f48a7ac5902fa3e3fcb81646f5109e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076364, "uuid": "fc0b14dd-519d-4e44-8641-f2f1c74e450b", "comment": "Malware payload (Mirai)", "value": "658c939cef9475a878e7ceb49a1cac798b5c1cdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076364, "uuid": "2595362f-1c3a-49f3-99f4-d9e90cab7280", "comment": "Malware payload (Mirai)", "value": "da967319addbe1b07f1c36c0ef70f66466b80a263c6ac96cca421c3b5009c5cb5819dfbdb848d04321c4c7879e60891c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076364, "uuid": "42c4e75b-ff03-43ca-b47d-ff1e5589e4fb", "value": "T1FF55CF46F8408F62C5D12576F76F8268732747B9C3EB62069A189B343BD796F0F3A640", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076364, "uuid": "542517e1-6cf8-49d7-91ef-8e3b0d621b8f", "value": "24576:6z/qLvfxB+6qHxWiOeiJnaGYTAldxefibuFNib8OoOpjsHio3xPsv:6kfxB+bxWitGYkeM6NiYsIHiuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777076364, "uuid": "8213cc15-19d7-4156-ba09-a70491050594", "value": 1298734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777076364, "uuid": "cabe476b-15c2-44fb-bd0c-7c39f622d9b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076364, "uuid": "f32a5c47-4846-4acd-bec6-c6e9e840f90c", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b354863-40e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777147233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147233, "uuid": "6dd0f35c-3b2c-4ad7-bf59-9a8610ca8390", "comment": "Malware payload (Gafgyt)", "value": "2fa40c07edf83581598bbde14a8501e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147233, "uuid": "2e10d9dc-ebe2-4e1a-9428-10d3e4a20659", "comment": "Malware payload (Gafgyt)", "value": "0920435fede3057e29f6257f7733f19bb09e41875ab45ce51780bce078129f4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147233, "uuid": "0c777c61-5eba-4ff0-8dc9-25ed235892ae", "comment": "Malware payload (Gafgyt)", "value": "27bc7e051ba35387248c495fa8f25f2e080a7193", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147233, "uuid": "a6bebe98-32a7-46ed-b1a6-d6502e2a6ddd", "comment": "Malware payload (Gafgyt)", "value": "323b1e5ca7692d8b5b66239d4d467f4b7c5bdcdef3b37abe30267462e77e360854c33ad049febaf725fcc08c095d0bb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147233, "uuid": "82ec7c04-b980-4ec1-bc05-d25a823543e9", "value": "T101D3CF32E0086DA0DD2117B434B6597C0340DEB40AD59243EFBEE5AE28B7DA57DEDB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147233, "uuid": "4bf67556-c9f9-4a18-a6fc-b8ac98ab6ef4", "value": "3072:jNOFV2mOAc6NBmjOd1CVOHVv3WDxGGRhaUNhkv0ZY6:xOFgpOEoVv3MXL5NhGOY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147233, "uuid": "207f9f38-967e-4438-ab59-77764f4bc28c", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147233, "uuid": "19318e65-fe71-4409-87aa-ecc265974e2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147233, "uuid": "ef2ab796-aaa3-4b22-b3c0-de79b744ea5d", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa0529b-403a-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1777075568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777075568, "uuid": "6553c068-2675-4265-9848-61169673e1a3", "comment": "Malware payload (ValleyRAT)", "value": "298f77d4d4ea08fc9f516c36dd40df5b", "object_relation": "md5", "Tag": [ { "name": "156-239-14-132", "colour": "#AFD88E", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777075568, "uuid": "65bf367a-6852-4546-98d8-562cc31e6e02", "comment": "Malware payload (ValleyRAT)", "value": "09534df20d651b06de469fbbd796414ab52fad95b5a6e8d9ddc63483c644ba86", "object_relation": "sha256", "Tag": [ { "name": "156-239-14-132", "colour": "#AFD88E", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777075568, "uuid": "bca2102b-1706-482c-b5ab-581f2df6900c", "comment": "Malware payload (ValleyRAT)", "value": "0572b62e6e3de1352ce2c3dfe98c1683fc666595", "object_relation": "sha1", "Tag": [ { "name": "156-239-14-132", "colour": "#AFD88E", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777075568, "uuid": "ed7647ed-65b7-4033-826d-930f263ba062", "comment": "Malware payload (ValleyRAT)", "value": "41701bfcf500219bd4930170e0c6c8203ee66f6fc8135f85a8cc50a17b16fc0684671c354be959b260d59c50cc12ac3a", "object_relation": "sha3-384", "Tag": [ { "name": "156-239-14-132", "colour": "#AFD88E", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777075568, "uuid": "5c647eeb-60f4-4b94-ae70-0f482f0f75fb", "value": "T1AC372321B68BC432E55D05B7AD3DEE1E503DBE670B3000E777F4B95A58B04C1A67EA82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777075568, "uuid": "28a54cbb-20af-4c05-bc10-047c870db9e0", "value": "393216:nyr2JTUO2G3Xt6QPyKvLrGDNWnk0VVgl51ZbLzU1WQQTzPddpqOfDbqz7uRk:UEL/XhnLrGInlSvLY1JQLdPlPi7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777075568, "uuid": "58d91636-17b1-42bd-b74d-2ed56c386439", "value": 23636480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777075568, "uuid": "7df72fff-cdf0-422c-9486-b3e4e945c799", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777075568, "uuid": "02225a45-c8bd-41f0-ba84-71cea46417f7", "value": "letsvpn-3.17.1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d757147-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128688, "uuid": "92c547c3-6cf4-4d6e-a7cb-6cf373db5f0b", "comment": "Malware payload (Mirai)", "value": "ed9d4db2d2c79bceb5b2e91c67925fd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128688, "uuid": "73379443-82e5-49ce-9201-89449204f933", "comment": "Malware payload (Mirai)", "value": "099286ec53d7cf15e12a171fca074ef1a312f0985c0c981736604764323dbe21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128688, "uuid": "16c9ecc3-af26-4b85-ab35-2f72f625efca", "comment": "Malware payload (Mirai)", "value": "2472d5bab9d9bf4d7d245fdf7280879e94db8093", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128688, "uuid": "eef404a0-e18a-4849-9ed4-6737838e773b", "comment": "Malware payload (Mirai)", "value": "e5e2b3c91498a2a60a82c56ab31a4638685e1511340599c59da731c4f919bcfdbfd9f8629883ffd671deb375ec093d30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128688, "uuid": "f47f8d27-081b-49af-8e64-35fe0e59bb9d", "value": "T115A35C0177898943E6A71DF5293F17E1C3BEE98023F4F68A260FDA4541F1B730589EA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128688, "uuid": "d5439844-1bc2-4b81-a1c2-7fcae9320cb3", "value": "1536:JFgIMYmLc6lWmjBxDVEOjrj2f7untKK8Iqcxl:JFgbYQ7WmBXVnkKPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128688, "uuid": "eb3a8f22-2bb7-4a5d-9e68-a4cbc5be47c5", "value": 99564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128688, "uuid": "8740e5ab-ad75-4ccd-8eb7-abc58d84bec5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128688, "uuid": "7613f6ff-5715-4dcd-b52c-da9bc5216e74", "value": "KKveTTgaAAsecNNaaaa.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdbba7d0-406c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777097120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777097120, "uuid": "12608c89-e6c0-4916-b259-5b2626a18479", "comment": "Malware payload (Mirai)", "value": "1083dbee7e38e3acdbdacfe8c335507c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777097120, "uuid": "f062934a-e24d-4690-8b96-49a1023a5e51", "comment": "Malware payload (Mirai)", "value": "0af10707a36bec55a495786b7166227f75cb497c90bfb5b35282841b448673ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777097120, "uuid": "0949cc54-efea-49dc-abc0-1cf440be96c5", "comment": "Malware payload (Mirai)", "value": "3608375d30fa4daf2016d1ef24fcdc910069e209", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777097120, "uuid": "ee708946-2251-4a0c-bade-a5cf637881fc", "comment": "Malware payload (Mirai)", "value": "94589970204d338219102cf210f6de4208d8bb983cfe5b43a597f4fea58909016d3a9ff0bfc964d052e920bb071f92e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777097120, "uuid": "070f8afb-d93f-4c3d-b136-66904fa46462", "value": "T155D4F74B6E328F5DF674C6318AB70925E76833D723E18685D1ACE5205E2068F941FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777097120, "uuid": "8530a83a-ccf0-4cf4-b6a5-d39e6f4ab019", "value": "6144:fOker8JDJdS1hughaAhfZTxNy/yV7BCWGNePSbNaczYEdQMU8h/7bC7hYYCzpKdv:f3ny1hQ7gsYEdhUu7eYfzphyQwqn2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777097120, "uuid": "2d233d34-2145-41d1-b2a4-997bdcee87d1", "value": 615468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777097120, "uuid": "9f1244f7-8402-4476-90b7-3dcd9d2455db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777097120, "uuid": "2924e0b5-6775-41e5-a908-67b9e8b6e8dd", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b17fddb-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128818, "uuid": "90d55af9-a4de-4caf-86f3-0a0171d803cc", "comment": "Malware payload (Mirai)", "value": "9382bfc8a3b8eb7bbd2dd9f016829d29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128818, "uuid": "a32be29b-8984-4606-8e0f-7e89430bb394", "comment": "Malware payload (Mirai)", "value": "0ba349e75d721e9a8955f2af5a9b5001d8a710db42c80cb9906b21b878e00a54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128818, "uuid": "c0d83616-41ed-4737-a881-2e0c4aaa0e30", "comment": "Malware payload (Mirai)", "value": "7e58c4a56357422e5076530da4a01fa83559d3f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128818, "uuid": "737fb662-ca0b-4a9b-b03a-f1dbddb7c1e8", "comment": "Malware payload (Mirai)", "value": "b0ca27fee9fe4f0a8404745df7902464d18249a7acf463fa1be23363cf8fa0cd405d0c1e181830a01cbfa02aa5b0e168", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128818, "uuid": "a7c4de50-e5d0-4810-8775-93dab748454c", "value": "T16EB34A12EA3D592BC1D8A17712B7C222F1F6634D20A48A1D7E750F8EFF24344365B6B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128818, "uuid": "cbf15899-9301-4e9c-82e0-3b3619199ef3", "value": "1536:wIq7VDQz/TQokRFjlc3d0l0aTAgh/EGtV8UcjT5LpOt09r2:wIq7VDQz7Qokzeel0aUgh/EAKljN12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128818, "uuid": "3de61a32-1277-4a4b-9948-3999b0473b6e", "value": 109020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128818, "uuid": "521138e9-328a-4ef8-8e63-e9967c7e85e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128818, "uuid": "7b06e720-3fe9-4221-90bb-62a593782178", "value": "KKveTTgaAAsecNNaaaa.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb16351e-403a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777075749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777075749, "uuid": "a9ef343d-757f-4c13-ae06-b6382a2638f0", "comment": "Malware payload", "value": "aeae88cc16722e8dc81749f6ebbf4ce7", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777075749, "uuid": "db4c94f7-fa0b-4ce0-8ecb-b0507e2cc96b", "comment": "Malware payload", "value": "0c3b85548595cf72e35be9c9efae78dc78fa06e24f10824542c3562a6b597b1e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777075749, "uuid": "d52f6fb4-18f6-43b3-9d73-6087780e2679", "comment": "Malware payload", "value": "1abb606a966717e23e344278f07763c181355478", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777075749, "uuid": "3092fb6b-acfa-4708-8621-0ba20653ca19", "comment": "Malware payload", "value": "5ca0ddd40f699631d25aa5cc957f26bc36ccdbec2b0f4b0dd8660c5183e02eb019e03b321b9af4b88df06daddb2ceec5", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777075749, "uuid": "53c03803-034e-40f8-9a54-d7c5be86ae93", "value": "T197D022439006CA9A081218830C96038D60971C99B9C07A7007996828298B86F71DA6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777075749, "uuid": "d2297db8-5deb-4161-bffc-9a23ddee4937", "value": "6:hITg3Nou11r+DE1WD5XxOVovKOZG1Bn23ffRHn:OTg9YDEoX+2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777075749, "uuid": "99608a16-b251-4150-ac7b-7ae105cb61e3", "value": 201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777075749, "uuid": "eb277740-e6b5-4e24-8671-66043ef0ee3d", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777075749, "uuid": "f9b0231e-d39b-4a3a-acca-70e1738b348a", "value": "uCD7w8UeNy.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef39459-40cb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777138005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777138005, "uuid": "65973e06-cf43-4d8f-908a-edad18042dd1", "comment": "Malware payload", "value": "438db985da1001d90d4353ad91fc02e5", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777138005, "uuid": "c7efc809-4d5f-4e1e-a9d7-36c97e1aab6d", "comment": "Malware payload", "value": "0cba745e04b008f539aad0465a7f3279f0461461b8f8e13bb2ee69cb8fe557ac", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777138005, "uuid": "86e987de-2522-46af-934d-3819bbd97f1d", "comment": "Malware payload", "value": "c14d4e5626423574bf0fdf7328f3f24bdb2eae3e", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777138005, "uuid": "04e101d5-ce20-428e-bdad-2a0fd48226d0", "comment": "Malware payload", "value": "98fe257694f121fea300cd42ce7f621e0bbab60f7d8c1fae678a5bcd5ebc3aeee5f48adec89e9f3ddd3bd7d3dfa8908d", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777138005, "uuid": "daaed5ee-77bf-4a0f-952f-1783e9943ef2", "value": "T11003F96D3E06B01515F36F766AB7AC01ED2B227787261464B2DCD3C01F74AA8CE76C89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777138005, "uuid": "f96d7c04-c6c9-4f67-8ae0-31b95f0fe3a0", "value": "768:+LMfWc8mfCPrajCYh4Of+llS+YL/9OLmjuB9:+LMecpfmrajCY5fCWFOz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777138005, "uuid": "5b25943d-1f97-4264-9078-c380f52bdeaa", "value": 39638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777138005, "uuid": "860aa243-4f7b-4c86-b224-5fee7d58c98c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777138005, "uuid": "30d4dc32-52b7-42cf-8602-f6b4bbc9d480", "value": "gordo.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c03a04-40c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777135466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777135466, "uuid": "1c27905d-d90b-4213-891f-ddc33c59c16c", "comment": "Malware payload", "value": "39a45211aa4441e05852ee463f6c77d6", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777135466, "uuid": "25374560-d324-4d28-858c-887af4d0576b", "comment": "Malware payload", "value": "0cc777783cc4ff1e9595408dadbb7ef52ffc22db4dc68373f6a4e8564a633783", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777135466, "uuid": "1aa94962-f788-4b23-bbc1-0cc3c4b920f1", "comment": "Malware payload", "value": "43d26282d440a3e62df50b33eb337309a26108a0", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777135466, "uuid": "b5195826-3d00-46b0-aed0-9c2904dced52", "comment": "Malware payload", "value": "cd67425325120a5ace8ce22f16844c90937e8f295b7beef319bc66f3aeebc0684449ab8a513598cdef8cff2d23e010e8", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777135466, "uuid": "68b4a5b2-7158-452e-bfc1-363bed26a4f0", "value": "T143146B722EA70124642BCDE53DF57466AE4EF731A55CB00C01851B2FC962EE5CEB06EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777135466, "uuid": "4bff8c31-019d-4a5b-b4c5-77becc7eed28", "value": "6144:9t21wGeCogNVksyUB2zWFIi8D/Tg9QQifS1w+VjAF:j2deUJy3WFYDbg6gBWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777135466, "uuid": "4349bc80-5be6-4bf3-a497-4d7d6e8fe25e", "value": 203922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777135466, "uuid": "a2296f8e-c091-4800-a6a9-976b4d8618d8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777135466, "uuid": "67c87413-6e86-4860-9049-9cd479162980", "value": "kbgknw.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "026e88be-40ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777130307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130307, "uuid": "55cfb3c1-1db9-44b0-8a73-618d197570a7", "comment": "Malware payload (Mirai)", "value": "a152dec328e0435fc1cefe2370bac505", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130307, "uuid": "1e508b70-eded-4fed-9962-eddfc4834c01", "comment": "Malware payload (Mirai)", "value": "0d858f768b5844f1ef1acd07b6e665fa0ea51f6ae5dfc427b5570c5605de9be8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130307, "uuid": "06ff98a9-e271-40b0-b57e-19f489b53a24", "comment": "Malware payload (Mirai)", "value": "7522c46bd47f2010d71764b663f08d45a1611680", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130307, "uuid": "9ee17885-19d3-4393-b67c-63adfc089045", "comment": "Malware payload (Mirai)", "value": "de044018740fc5e3fbf77991724f9ba044a3ced0fdf24ee93c3f5ce0fa20909267d2dd1ee3249106596748606a153a04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130307, "uuid": "75e21bd0-9cc4-45db-ada7-cf802bb38c5e", "value": "T138040993F905DEF6F40AA73204D30B257271BB520A531A36B21BB97A9E3A2D43427F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130307, "uuid": "2c4ca937-6769-4e10-a97b-bf29bbfd5fcf", "value": "3072:EB/4chsc2qiYSuQqEpbpPsfcW/6SzmLvKQIyHRJ5eaeGmHknNarxtK76XWf8hi:OsoiYSuQPLsfALv2yHX5IGmHknNarxt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777130307, "uuid": "b1bad2c4-b8cb-4565-bb1d-dda4cd087562", "value": 185576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777130307, "uuid": "2d3f5905-377b-45f1-a10d-71af7e130549", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130307, "uuid": "406945cf-399a-45d3-8b67-dc64939eeda5", "value": "bot.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c26f6b99-40ab-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777124187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777124187, "uuid": "7ac4cdf3-936c-4c61-bfd2-f9d9b1497c64", "comment": "Malware payload (AgentTesla)", "value": "fd6fdce03e53ca8956df86ac3911ef30", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777124187, "uuid": "58d1a2f5-8181-46ca-a627-13990edcd17f", "comment": "Malware payload (AgentTesla)", "value": "0f04a771593d4135944058c1a99fc52c7164ac257d28e919808cb7c4e491ae69", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777124187, "uuid": "77ac90de-a5a0-4be0-9944-08a080e6f4e2", "comment": "Malware payload (AgentTesla)", "value": "965260af003599c6712b6d1912c4a56abb010d0d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777124187, "uuid": "29cc27cf-d908-4329-8ff2-242b8af6a8ae", "comment": "Malware payload (AgentTesla)", "value": "9c70602bf061fbf7db102e460d81a3fd9d345d9b3c306cd86b24a52933aaddf289724813ab260f3565e160a21742aa29", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777124187, "uuid": "a3d0f09b-a8b9-4d6c-babe-047329452bb7", "value": "T1E12523747DC17F3C495C9625E2BF774917328B924889CE91B8CC82CF0B1BA5DE653829", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777124187, "uuid": "a16b8093-ed00-49a0-8f4d-ccd0da28ad8b", "value": "24576:IbMIkSfGQOQjr5/iSeNYvDVByLOVYmFKmDm/62L1kYHN:IOgjfB2awOmMYHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777124187, "uuid": "61ee97c7-6076-4416-8b7d-9eb8af186e5c", "value": 1050116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777124187, "uuid": "f121bd1b-bcd1-4b85-a00d-2bc6bd4a031c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777124187, "uuid": "f7f9d3b3-55be-4c98-8b93-39e27711b74e", "value": "ps_lQP8IUFOOfAU_1776932825640.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca11593-40ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777152712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152712, "uuid": "37bd32da-a1ca-495e-9a7a-40846ec4bf26", "comment": "Malware payload", "value": "701a39f69e055adc5cd2961c270361cd", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152712, "uuid": "ed8716d6-78a6-4a31-8b89-8bed0ebcd7c3", "comment": "Malware payload", "value": "0f850c7ac1dfec77744c122f9a2ab796f2eca5d128abc5c9935614971266512a", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152712, "uuid": "657871ee-0662-4d41-a629-f89f83d15647", "comment": "Malware payload", "value": "0e32b45c201d55c418c5f7edd64033f635f71651", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152712, "uuid": "4915488d-efe7-4bde-afd5-e3dad34683c6", "comment": "Malware payload", "value": "7719155c26d604ab462aa3e1af016a8b061c5bd20c25978d892fe3903b5676634fd4890ecda85c606605317f08ffa22d", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152712, "uuid": "97f434e5-16b1-4664-ad4c-c3f517937ac5", "value": "T1CE070F3DCEE8423EC2B7C929D9CA4A17F85A091B231CFD4A64D773975527183BCA211E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152712, "uuid": "d557d651-2cde-4a7f-a64b-9c38cf2ba253", "value": "3072:nfC8pbP3luExvrprCm9jVaQ01EaKk3zHrDcjWxYt5ZtvcPc5GtOivGN6/DFybCVJ:I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777152712, "uuid": "103349c7-4ab8-451a-8621-2914a641e491", "value": 18292892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777152712, "uuid": "0c3d9c7b-121c-4ec0-af2f-aaa93efc2e35", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152712, "uuid": "7e19959f-3fbd-4433-837f-e6fdbed13388", "value": "sfjzv.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff2446f-40a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777120746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120746, "uuid": "a41ddb30-def0-4a45-9a0d-39dc8045eeb0", "comment": "Malware payload (Mirai)", "value": "5dd543e01e3b053488004c33eaa4bee3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120746, "uuid": "6c770704-dd3a-48ee-86ba-404f9b4bf97b", "comment": "Malware payload (Mirai)", "value": "126874047f95db45e05e45451ed0b6063ad2f2309090b6fb854c8d1cba5bc15b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120746, "uuid": "8077e8ab-0e17-4888-8166-2c64afc7d412", "comment": "Malware payload (Mirai)", "value": "95300e8caa10c1a3e966f6875bd4dd8e8101e369", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120746, "uuid": "ba690323-3482-4f2e-8678-a3fed115d44a", "comment": "Malware payload (Mirai)", "value": "6f3fa8ae8f65193af41106fa8aead9162a5099fe5e3986324b6f86892cf454402f5c9a4645b46b835df32c15d0aafd70", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120746, "uuid": "e0d0c7e9-1ffe-4363-82b8-ff327af7d2dd", "value": "T18823F1AF8C20C253D15AA87D8FAB4D7194A16DA37D1EB06C6CC07189E74817F8E5FA31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120746, "uuid": "3bc52839-f4c7-48a3-949f-3b3694688883", "value": "768:ZgLLZ9IHzi+tFaPFZgIYcUX2f8DZHUq5JoWssRQltkyjCDyVFcMrleAXrR7550:ZOIHu9FZgqUK8y44fkUCmcwIAXr5550", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777120746, "uuid": "7c4cd68f-07de-4be2-a722-6809a8bcdf3e", "value": 49744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777120746, "uuid": "c314ed29-669b-4422-9ee4-9a533b62fee4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120746, "uuid": "6821150f-cd65-4189-bc85-e1f8478d53d8", "value": "luxzz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7dc3adf-404c-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1777083340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777083340, "uuid": "42dfb50f-7cd2-42ed-a3be-752e16770753", "comment": "Malware payload (SnakeKeylogger)", "value": "4f3fd8a6bf1680e337ac9ad5e1b9ce34", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777083340, "uuid": "704f4a61-3a02-4641-8891-69b7ce7e4a3d", "comment": "Malware payload (SnakeKeylogger)", "value": "132fbaa338bf578298d0b8abb9439896b97edae9840c5ba93d9b8475a4a6cd76", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777083340, "uuid": "c01eeceb-c3bf-4785-8085-bee27c7af9ac", "comment": "Malware payload (SnakeKeylogger)", "value": "4c2d6bd81e55fccfe717aa955ce4847d1e5c8cf1", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777083340, "uuid": "6a607cb8-0c4e-4a38-9f0b-6319bdc91bf8", "comment": "Malware payload (SnakeKeylogger)", "value": "d289d6c713de20e38c7add6cf92b7604d5553f76a3da7c8068cfadcc43dea3e836c98239ffe593dafd4a6c1af970c973", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777083340, "uuid": "111c4735-be80-4ef8-a60c-da2a3c95bc27", "value": "T103C423F39F4F7EE146081294D7369A07CE796204851B5BB367E0B0B64A4F30B528B9DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777083340, "uuid": "60205882-efef-472f-95fe-fc168d7896f6", "value": "12288:AQlKZjgo0p+tRwWpv58oSlOr6pnK+BxU4JbqE9/ZyxiRZ0FJFKMw2kvRf:ykxcaW14lJZd/Jbv/ZyxiRK7mx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777083340, "uuid": "5e5ff376-338d-477d-a177-b25245628564", "value": 583222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777083340, "uuid": "5d3c44f8-29fa-47e2-8e76-26b1ef066ba8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777083340, "uuid": "6d4f350c-a6da-45a7-882a-0987b9045bec", "value": "ps_5GUHlnbLV7jA_1776699154658.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a4ef1a-4094-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777114260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777114260, "uuid": "a554a9b7-cde4-458e-95d4-30dbbc45dad8", "comment": "Malware payload", "value": "3d811a4b9c248991b66ffabc758ae011", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777114260, "uuid": "830f0991-7d26-44f9-9cdf-84223f987879", "comment": "Malware payload", "value": "1364617db9e5371999e9ab029ccb9486907f61a1dfc48fa46ad1b28efd247232", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777114260, "uuid": "8410fc74-7cc7-4830-8b3f-28359338fade", "comment": "Malware payload", "value": "b911477ba3ce7ba0283c5376615978bf7c7c3602", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777114260, "uuid": "9a76c548-69cc-4e73-a735-28b9ed108ec9", "comment": "Malware payload", "value": "1f996ff01bb53d96ce99e104b8e94eec91e1bf0ec32fa4f25a14d3624db8a4f29f5972cf5195a802ee18013897d0947d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777114260, "uuid": "74fe92b1-bbfe-4791-b4da-0501c95fcece", "value": "T1B20833C4BB15BA0FE4B952714A57462937951C22CA034B4FE488370DA9B3BF44EB6BC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777114260, "uuid": "477b43df-518a-475e-86b5-1c4343deaf4a", "value": "1572864:8/np4MjHS9mxsOPCkAVqqV1Tektrw9hkHMSES5Nc5ho4INln4fu2sS6cBwqqV1mD:8/np/jHS9VOAJV1TA9h0jXPc5C2sS9H9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777114260, "uuid": "fbfc57aa-3138-4a42-8f9a-ad67029eaf3e", "value": 78165364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777114260, "uuid": "d7435614-472c-4268-bbcf-efdd0c317a4f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777114260, "uuid": "ab606d10-9c2a-4a55-a304-8cfdea1ce9a9", "value": "ClashMeta_For_Android.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12013885-408c-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1777110576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110576, "uuid": "86617651-eefe-4435-8ef2-e7e9d6623cf9", "comment": "Malware payload (CoinMiner)", "value": "3fb296994ea39540d88f56cad9de71da", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110576, "uuid": "b06422bf-01ad-4e22-98f7-67f54f9ea651", "comment": "Malware payload (CoinMiner)", "value": "13be47047c6f0e95031cb90b345f5aed836cf2674a9e0dd71abaa244beddcad2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110576, "uuid": "cd330a60-0c57-49b9-9495-f80927f70b06", "comment": "Malware payload (CoinMiner)", "value": "40aebe3e6e2258ad78f450ed1be5b9419d294034", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110576, "uuid": "c94c4b83-ba5a-4bdc-9181-8d0b112043b1", "comment": "Malware payload (CoinMiner)", "value": "b24ffea43e68ad8ec5e59466af63a2d84359a223009ee97fab01ea4129526a6c140b252d583fbc9fd4d6df4c0a08bb49", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110576, "uuid": "e63d7802-f246-4b1f-8cc3-67553bd12fac", "value": "T177477B43E86585E8C4AA9535C562A623BB707C894B3023EB2F60F7382F77BD05B79750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110576, "uuid": "af0e3c7d-7f34-4ece-af1d-c0fd75917bfa", "value": "196608:IRePA6Wq2H2MSNJiHdS+MNVP66aSIcSdsatMGDpm6xtqbvWVOfp9:IMPA6X2H2IrU9IcSd/uGDTxtqbvhfp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777110576, "uuid": "1141f130-1cf7-425d-8058-f269e63a539b", "value": 26296504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777110576, "uuid": "a10ef8de-d65b-466f-abe3-1d47ffce5c65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110576, "uuid": "67323442-aa87-41ad-9337-64e3c17f1338", "value": "vc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1739bdd-40e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777147324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147324, "uuid": "4df7ebcc-c84c-462a-9ea1-0e6144baf764", "comment": "Malware payload", "value": "eb1cb5f42042d91276de5af70b1f5c01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147324, "uuid": "31605d52-99c8-42a1-b3a5-42703baa32e3", "comment": "Malware payload", "value": "144bbfc3158a279cd19195924a363527880a0986fdf07728d1e86a5f4746b0d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147324, "uuid": "1f8ba431-22ca-4cc3-9031-47e9b7406b3e", "comment": "Malware payload", "value": "318ee6e042abb6ade552ac04d168821a41400a6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147324, "uuid": "13031049-1684-4b6d-bc67-2230afa62b67", "comment": "Malware payload", "value": "682651de73a4dba72977cf88f764a24fab32a4e6bc1b028786ac8128e5a6fc1dd9c215204e18cbf09742ce829b162123", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147324, "uuid": "c435e0e5-97e2-4135-8d59-f9f89cb83e6f", "value": "T11ED35C0A79D270FCC687D170926E9F61E63A745C02183DBBA3C2AE711937DE05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147324, "uuid": "96cf7aa0-b8ee-49ec-8f04-aa1e8944d01e", "value": "3072:lAF2acRfkY6z3xv+ErH4vk9954rlvLFZW8YYQ9:yIRfe3xvvSrlvZZ7U9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147324, "uuid": "a08b9c79-dbf9-4748-b150-b6289154a3fb", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147324, "uuid": "742f7787-088b-45c2-9611-55b9aa54b720", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147324, "uuid": "341410cb-4ad9-4ca1-8017-a04285ca3ac1", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b4b8b7-4070-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777098870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777098870, "uuid": "db928c1e-0349-47dc-8a54-1be7117b0b20", "comment": "Malware payload (Mirai)", "value": "0b879afa986990958d71d8aff1cfe10f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777098870, "uuid": "9a453564-bebf-4ad9-a015-649b5962785c", "comment": "Malware payload (Mirai)", "value": "16968774921a3d5a7c4b50468957f51dcb76d524d36bac823ba072ab5eb3c537", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777098870, "uuid": "33608278-1a57-4f2c-8644-89c1951a8fa0", "comment": "Malware payload (Mirai)", "value": "ce6cb0effd45e9c667e187fb06548dba699f6bc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777098870, "uuid": "580c49c5-53e1-419c-b9ed-5085b14f2114", "comment": "Malware payload (Mirai)", "value": "686a76f4fc5704e5816eff27b20dc2c498a0a5e90eb790aa9a9ae24366f7df8b0accd5400468e7bd73e9895792820ea7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777098870, "uuid": "09158502-b5dc-4421-af34-8826299e3c86", "value": "T118847813D9154492E1255CF2223733C5A94B87BB88E636D3ED5B4991FF3182B42BEEC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777098870, "uuid": "04df9355-cd09-4215-b9bd-ac630defa2cc", "value": "1536:fAUKRj/0EAYWbx8Hc+2Lfgd6kCKnBrzBKWADvAfgGwyjde5szqyEI1jHejTstmGf:oUiDHAtxE2kuKBrzW0ff+joCbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777098870, "uuid": "08aff74f-95e4-4f04-8b9d-37db2b0faaf6", "value": 375028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777098870, "uuid": "7fa8bd38-455e-4256-af74-987c3e8c825a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777098870, "uuid": "8c1883f7-20ee-45cc-8a4a-f7e0fffe0249", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3103598c-404b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777082711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777082711, "uuid": "e334722a-e191-4e9f-a959-81d2cad660a1", "comment": "Malware payload", "value": "37adefc93c98b34e15326884cad70e1d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777082711, "uuid": "44acd863-7843-43c5-b5d4-94a23a6ff4c8", "comment": "Malware payload", "value": "182d1b8ef494c695aabf846a112e6957a875e0d6e6f11a73418cc360cc2cae2c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777082711, "uuid": "be34cf1d-3dfd-4944-85da-b5efef86b163", "comment": "Malware payload", "value": "860e72cd78fe3786c7fda40141f1a64aadaacb3d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777082711, "uuid": "6b2234fe-c709-466b-a62d-dacb64fb10dd", "comment": "Malware payload", "value": "ad9459844aa7804c982c9f27dd38ec600fec81e8b0d1c0dd686809e0abce5704312b579e1fc27dd56f9987ef242d5d15", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777082711, "uuid": "cafaece7-37f7-48de-a434-5f7301e8dde4", "value": "T1F1D612D6F7C4A96BC4F35732C53656A5918B4C268B43DED3AE58363C18BB5C00E4ABC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777082711, "uuid": "ee8a1da0-dcbf-432a-a055-30de7fa7f315", "value": "393216:otTYyLZfhcXIiSsARkVw0jxtUtrPwEaTyDKRUE9Y/sP/:oyw5+FcRF6SrLaTcK5d/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777082711, "uuid": "6183d8ed-0b93-42e7-b45c-d5f4976f255d", "value": 12678842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777082711, "uuid": "ba8a4065-785f-403b-b1b5-1ddc89694865", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777082711, "uuid": "1f34a941-a434-4c1f-85fd-97685fe2fe60", "value": "Magis-Tv-Pro.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20565f4b-40ee-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777152691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152691, "uuid": "1ee17d44-0a07-410f-9d97-b13f7a3eb8e5", "comment": "Malware payload (AsyncRAT)", "value": "c2170f5af2df0da7d5a626b49b03b80b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152691, "uuid": "f793f341-400d-46f6-8040-7605f212aad8", "comment": "Malware payload (AsyncRAT)", "value": "1966db90a2957b9015efaef6b635c0d96496e5e201b25f65b13f2e7aae7b57b1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152691, "uuid": "5b4a5d43-7e33-452b-b093-a377d35babfc", "comment": "Malware payload (AsyncRAT)", "value": "8297e40855f9730d930183bc20127678c6a3a68e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152691, "uuid": "fd64b85b-94ee-4d0e-8bda-cb3269ad0b92", "comment": "Malware payload (AsyncRAT)", "value": "3c7528f6f7e958bb4015255ad322676ae23bd3d8f098545d99b10a90ed52c74b83f6aeb1f73900365c2b8217fe95880d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152691, "uuid": "dd563b23-d9a5-4ea7-8209-cccbc46588ab", "value": "T19B442344ADE9A8200F4CA66B57FA3B98952417DD8195F13DA3F0044783FB4F0EB4ABB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152691, "uuid": "4cc9a2f1-0bbb-406c-a160-fcb847e2195c", "value": "6144:9b827RPugE4wsdF01m+L3GR+qZHo5Dq6Z/NzxQtvOaj7uI2sLf:9bR7HYzGXHKrZ1zi1Ok6uf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777152691, "uuid": "aa4e1b12-58af-41ea-a589-dbf655c1145c", "value": 263542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777152691, "uuid": "d657ac7e-eb3c-4c65-90f1-f6f543936053", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152691, "uuid": "f6810bb2-1773-434f-b166-0d52053ea62f", "value": "ps_VRnto16fO6CJ_1776241742653.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c50266a-40b3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777127505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127505, "uuid": "9a28fe18-c297-476a-97cb-aeb34996a824", "comment": "Malware payload", "value": "85b5498bdcd9287683dcbb19da4449c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127505, "uuid": "015a50d6-0c3a-40ba-87f9-e4553e13eb05", "comment": "Malware payload", "value": "1aba65d27cd29269d04571fbe5eb9f88cc8478097c38cba2161da2cb9d5e3165", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127505, "uuid": "a1ac547f-9459-4f1b-bb4b-8c6005cb76e2", "comment": "Malware payload", "value": "4df52b2aabdd3ad9a1ebf6f7816978ce23527a48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127505, "uuid": "9ccfebf4-adbd-4da7-9933-97f763042e2b", "comment": "Malware payload", "value": "157a6f57464a8a3098fa0b74b023e638c30467b5a74feb63c49789f38631a32c6c8b83ec069639a398a8024892216e9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777127505, "uuid": "b9ee6408-d9c3-402d-a4a3-0a4b4af3cd74", "value": "T1BD858C055DE1D479C0A807F46FBA2B2A337AF70243089E8E4359E5B52F817A9B59F4C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777127505, "uuid": "ab412f82-a216-4f18-bf4f-ad1e3e0206e6", "value": "59cf6205f0d55e08de66f73ba4498e82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777127505, "uuid": "57e21190-6d5c-4730-a28b-3283b5a8dc73", "value": "24576:MVW2a0Ck7JoDi0JD0WBMU2rg7YCO51sPXXjFw347K1x6SPR8RNV:wP05z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777127505, "uuid": "2fd954f2-c318-46ac-8125-445961461de0", "value": 1830632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777127505, "uuid": "af77fca5-4ba8-4fa1-a9c6-7b7d4eeaf375", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777127505, "uuid": "e4b6225b-c421-4afc-aeba-3edf3a7614c5", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85cb9c5d-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128809, "uuid": "476a9a1e-ab13-4888-a685-235f0a49bdbf", "comment": "Malware payload (Mirai)", "value": "54b276d5079abcf0ac9be6ef971abcd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128809, "uuid": "6c42e8b5-c669-49cf-bfce-3871d51b96ec", "comment": "Malware payload (Mirai)", "value": "1b11eca1b73599feb999dac54ba70d9574e4148fea8314043bee3377c76edffc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128809, "uuid": "e7843d8a-c5d2-4c75-b583-e16edf7ffc20", "comment": "Malware payload (Mirai)", "value": "e5ab89cedfb4c3d78940c8fdccfc14b817f1331b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128809, "uuid": "3ea981b3-e495-46e0-ac25-3e984859cd3f", "comment": "Malware payload (Mirai)", "value": "7af56abb6882d05868a848d3e19c80c9ef17976fd52103a43ebf066ddfe44469fd5996c6be8d1dba87f5ff9759bd27b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128809, "uuid": "b013c409-cd84-418b-ba69-091df21ff2a0", "value": "T1B8130248492BC135DB140832E97A48CA73ED2B77B9C5FC2BF9140259BB82D5399F4B92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128809, "uuid": "4170ca26-21d8-4e13-bdc0-1ea2837f6a69", "value": "768:vOAK0CsbcvOBH/WZ0yb3wmTDfT1IX+W2Rj+A3l7O+MK9q3UELQ9i:vOADf0OBH/WZ0y7NfG+x+AgLqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128809, "uuid": "a8d66b7d-2dd7-42ee-82a4-de47216043ee", "value": 44379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128809, "uuid": "d75d9c4e-feee-41fc-aceb-eb3809252880", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128809, "uuid": "24c0e15a-2c32-46e0-8d78-b44c4ec4195a", "value": "g", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c62ab5b2-40ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777152110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152110, "uuid": "315386e1-a86a-422e-acd6-d771c0f84101", "comment": "Malware payload", "value": "3c107fb4c98787e3daefd0264ee8eaa4", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152110, "uuid": "2eb0936c-b671-49f6-bd7c-56aa73ec0866", "comment": "Malware payload", "value": "1b3577d4ef4e553995842f1feae47df6fce2a1e77893dbea2ce5a5135f248507", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152110, "uuid": "aae8d547-a979-444d-94b7-cad0b3aa65fb", "comment": "Malware payload", "value": "d8dd1a09f7daf11dae61cb993a700c4557d1b584", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152110, "uuid": "0096be6a-8b07-4135-9262-3040f053a44b", "comment": "Malware payload", "value": "4c71d4af9b77a7a7f1325886352a512256a48b89c3c8eb55cc7490ea4adcd1b78ee3bd6f4df4f6be0bf8152af52fb299", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152110, "uuid": "a11ce963-3413-4f70-9d6d-32f1a70afee4", "value": "T169163357F6F0A259C60727B582664308DC288D6B97495C24F1ECB328637CB63A1F87DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152110, "uuid": "8cac17a6-ddaa-4e39-b84a-d25704284e40", "value": "98304:Hq3MHrF7PHAM/GQEeFeiqUcRHiAozWzh6LUth+pAeUALpK/Yuwsf:Hq34F7Pp/9EThUyiAoqzg1j0Mi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777152110, "uuid": "1047ca2d-3b47-4615-9787-c08023de66a3", "value": 4177920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777152110, "uuid": "e37d9cef-963c-4e9c-91c4-ddc656b7b809", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152110, "uuid": "a22e24e6-6372-4396-a942-10fee62b6ac3", "value": "luoma\u00d5\u00f4\u00ec\u00d5\u00a6\u00f6.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6696109f-40b1-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1777126609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777126609, "uuid": "e97a1789-d419-43db-9356-a6467a0cb5f9", "comment": "Malware payload (LummaStealer)", "value": "c5f69e9a2792c75f2b47c74674306a44", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777126609, "uuid": "5b505147-1618-44a2-a92d-8f83eaba94ec", "comment": "Malware payload (LummaStealer)", "value": "1c86881458deecb878469060ce8a5e454033e27a071d9d110157ea552d8257e3", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777126609, "uuid": "4a2c88a6-4272-49ab-9dea-6b91ce8a8f88", "comment": "Malware payload (LummaStealer)", "value": "01c5fbe21ac70611169ccedae20d57ae495a70f9", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777126609, "uuid": "99b7e2b7-9bff-4050-b55e-687195706f5c", "comment": "Malware payload (LummaStealer)", "value": "f00c467e2e3bf79a0748407cbcfd034219cf088a6ec9ca4e9cf8336069b9afe0ccd02943225c6dff821be86ba1b390d3", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777126609, "uuid": "788807ad-eb09-4570-9433-946a19622d3a", "value": "T157A56C90A9C388B2D5423235986772FB67315C0D0F3ED697DEA17DB8BB3F6925823205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777126609, "uuid": "37a96778-53d8-4cb1-9242-75d62291be69", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777126609, "uuid": "99b5d95d-8db1-414e-867b-7c5e26de2d7a", "value": "49152:IO7gBEP9ab3HRR6VzJLQOZbooVvNJbsuWaT7:F8BEP9ab3fiNQCbllNCuWaT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777126609, "uuid": "7561fa22-b2b1-485c-98b3-1027faadf73d", "value": 2230784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777126609, "uuid": "3b626290-0e9e-48da-bb2c-287792c4eb75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777126609, "uuid": "0beee538-c534-4f8d-8eff-b2f3512c64dd", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a25e3ef0-409c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777117690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777117690, "uuid": "6acfbf31-a0fa-4b0f-aa07-2182768e1ab6", "comment": "Malware payload (Mirai)", "value": "be2978d24c94711c8df647ffdf5b02a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777117690, "uuid": "e691e319-ecf7-4261-b3bc-7888e3e1f2ba", "comment": "Malware payload (Mirai)", "value": "1c99e03a5e2cbd6a374e6b8f480cc1a3cce48e6c15044b78223dfe667ad1030e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777117690, "uuid": "78b4d7e0-46a6-459a-a2b9-cc1815d14535", "comment": "Malware payload (Mirai)", "value": "550259bc87fd4f4fde2a99e0e5847ecaeb8bd131", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777117690, "uuid": "0fc283c9-362c-4d80-98ae-64224f371ab4", "comment": "Malware payload (Mirai)", "value": "18e70537f38727e70772913727568d7e4c552e2157cb7dadd5e73dcea7f14dd8ea2ec8b0ec05e6dc2dd117f46a34b91d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777117690, "uuid": "7c5a6151-110f-48fd-8e71-e7085c746f77", "value": "T195C44906F8808F62C5D125B6F75F8268731747B9D3EB62069A189B343BD782F4F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777117690, "uuid": "a3b9cb88-faa8-472a-8fb5-2b39086b8253", "value": "12288:jz1JLpK0HtruGG7i+xU9xgzLVe8XLMg+t8prPEWrZreKW5rarl:31NpKa1Ge+K9qzLAAkKUrar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777117690, "uuid": "73d7dd6c-9474-421d-a792-f369312a6e96", "value": 591140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777117690, "uuid": "27951971-9d32-4dfc-bd62-e49c2321250a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777117690, "uuid": "ec9adf67-842a-4387-98ae-62a44a11f993", "value": "l_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9143c1d6-4068-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777095328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777095328, "uuid": "206a82ff-f9ea-4154-a6a9-dbe646722421", "comment": "Malware payload (Mirai)", "value": "918838fecc7ddb3bc6574f9edf707dd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777095328, "uuid": "56ac6005-6120-40af-8c11-327414d882d6", "comment": "Malware payload (Mirai)", "value": "1d06084830135a08fcbae405a4481edff01cc95b971d5ed927f2cbffdc8f8eac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777095328, "uuid": "561b46b9-ca9d-4f31-934b-07edd2c76d71", "comment": "Malware payload (Mirai)", "value": "e10e2ef6c7fc5af09b1dbc4a4c2cba92902536e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777095328, "uuid": "7519158b-f682-4bfd-ba5f-13d77fcc524c", "comment": "Malware payload (Mirai)", "value": "010b3a1f9d8a011000261899fe1a0fbf5086a42dffaa20b8c9c931468ee3094b2f36638b3f370f0f8c269a26b31c9752", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777095328, "uuid": "90eff6cd-0c56-4fc4-8a36-5ae7ba7a1110", "value": "T16C53F18751FD8F19C399B27808DD3F6E30355416B0CC9CD38D8C7A632659B6A3F285A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777095328, "uuid": "cc1241dc-ddc4-4d4f-b00d-dcc794e1ffb9", "value": "1536:vS3PX/h7QUhqSOZlKdG+guZuXyZFE4y/Z9V/wJmnouy8HyP:aHh7DzOKGMZmwBybmMoutE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777095328, "uuid": "6957659c-b249-48fe-bdd4-69a49b8d8381", "value": 62624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777095328, "uuid": "7c8a3433-2a5f-454d-9e72-4da0ac42eae8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777095328, "uuid": "26abf999-10f8-465e-b242-96c3ac7f1227", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af12c88-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128630, "uuid": "74b4af9f-7f8f-450b-8b4c-12653e7942da", "comment": "Malware payload (Mirai)", "value": "9c7a7b9257b730e25f92db72f6ee2cde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128630, "uuid": "221dae6c-d81c-4d27-8cb9-d4cc95fd4ad1", "comment": "Malware payload (Mirai)", "value": "1ff4219c3df24d05d1e4e80ee0005b5366554fda404445b3cf3746c0e8163c69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128630, "uuid": "70db0ea5-f222-429b-a3fb-69bc242e3469", "comment": "Malware payload (Mirai)", "value": "58665c096cabd321a5dc0a08d83cef3a26c8a948", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128630, "uuid": "e0770d40-ca4a-4f8f-9f87-8d25503e6101", "comment": "Malware payload (Mirai)", "value": "2d48b31a189ff5a34e2ce64e212f1a19675ba260e834f11e2bfcd415f091665f158803965d5da3eba843aa0633dc6385", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128630, "uuid": "e24ac48e-f8ab-4237-8650-b1baac07a70b", "value": "T16113E0341A04AD99ED52A5FC47A267543C300B732103DE4B3B9974FBDEAE39C356264E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128630, "uuid": "660f7eb1-6346-4f70-a159-d058f3a44e81", "value": "768:QJWyTefK+KTyZngpHuKxZMG8j7o7q7o/3aEFuXpFJgGlzDpbuR1J8Rw:HyTeXK+9gpOKgjNUxuXp/VJu2Rw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128630, "uuid": "3329f9d5-b21f-43be-8764-398b51c5040a", "value": 44075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128630, "uuid": "ce0cbde1-ac60-4745-be3c-a14868487927", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128630, "uuid": "7eeaa5a0-400f-47fc-a8d3-db42c53a4fe6", "value": "c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a71b7024-4085-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777107820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777107820, "uuid": "d425f866-34cc-4f60-bf98-bc099ee62fa8", "comment": "Malware payload", "value": "a43d94355dddc1167173f18b6b3880fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Ravartar", "colour": "#0E27CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777107820, "uuid": "8a6f4e53-c97a-4df6-b478-1c1f9e1e7ab0", "comment": "Malware payload", "value": "2047ee417ac82feabcb75eda8234d7b8ab953224e7dad625b229e0570099c6b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Ravartar", "colour": "#0E27CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777107820, "uuid": "f09394cf-d5e6-4bf8-a93c-0d2b390b8068", "comment": "Malware payload", "value": "424e81a8ebb4013cb655e3c08985d0a6d03659f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Ravartar", "colour": "#0E27CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777107820, "uuid": "f7a48880-be06-4273-8cee-01ee9fda87ec", "comment": "Malware payload", "value": "0128297fcae792f7da97f992a8bf026114626325ad0461a77371a91b8865117bb92f74b65bd289f009dc2e92a9e875c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Ravartar", "colour": "#0E27CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777107820, "uuid": "89df978b-21bf-473e-ae10-c4cd10f10079", "value": "T1C9E623EA80D522E4E9D71B40764F57CE31C0705A55BD6C2C3ACA2D42AE31EAF468DDB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777107820, "uuid": "78205684-f7a0-417c-9ac2-75346e30d6e1", "value": "9499b0b8b3de04b1bd6e9a1d667a9da1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777107820, "uuid": "d2942e09-cd90-4dff-88ab-3fde78fbf5a2", "value": "393216:qUY8uf60RpixCCmpLKnYEgZtyv6uNTd7Ho:5ufdixCCWL1ZtyVNd7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777107820, "uuid": "89bfc228-1400-4665-9492-5904f7adfec2", "value": 14328792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777107820, "uuid": "06c900e8-0746-4e2d-a7ef-4fe7a33c7676", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777107820, "uuid": "52d955a0-84d9-4621-81b4-fed314135d2b", "value": "EliteCheats.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0910d3e-4073-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777100158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777100158, "uuid": "f7b5053b-69cf-427f-92d6-cc0802c3675a", "comment": "Malware payload (Mirai)", "value": "5004584c75c8842d14870c1835d74dfd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777100158, "uuid": "a050ebf9-5a37-490c-8347-2e9bd4404674", "comment": "Malware payload (Mirai)", "value": "206645125a36e49da4e00750679ce3246814d775d6400b96f7befad1b1776487", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777100158, "uuid": "d368b54d-ec35-4ff3-93e5-6457c562de6d", "comment": "Malware payload (Mirai)", "value": "5c238fba12038663fcb130543784ceb8e47bdcb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777100158, "uuid": "707d077e-681a-4449-b52b-1434c92c3c17", "comment": "Malware payload (Mirai)", "value": "7c4f89cc20c794a57b09db14aa51745519e88990bea3a913d892a008e328ddb07a794729459607056627e9f653d52c55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777100158, "uuid": "7acff48d-4e7b-4364-bf80-a06e441edd1c", "value": "T1BA845513D9158991E5644CF3226B3285B94B83BBC5EB32D3ED164EA1BF2141F42BEEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777100158, "uuid": "7630c226-dcc5-428c-a583-62867852aab7", "value": "3072:nZ5VZWIyMqExdLT4XH7lJZzKBua2v/8+joC//c6:nZ5VZWSvZT4XblJZcOv/Bjog/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777100158, "uuid": "bd0fcebe-b5f7-4f28-81d4-b3f14b4e8272", "value": 379008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777100158, "uuid": "4ca53ec6-62db-4c82-a536-fc4e14ef08aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777100158, "uuid": "7f60af25-1ebe-4623-8bae-78f23066fb22", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb76650-40db-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777144900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777144900, "uuid": "ee9a34d1-ed5d-4247-adfd-49853131415b", "comment": "Malware payload", "value": "0e6aa1a833e6aca51100004195e6c30b", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777144900, "uuid": "48751b5f-6a59-4294-882d-a74236306ad9", "comment": "Malware payload", "value": "2199baf11d50dd10555f8aec122178e03b62570fc0d4614a8e928978dc547154", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777144900, "uuid": "f2d4d728-9848-4ad6-afc0-903911ec5553", "comment": "Malware payload", "value": "f44c91c31b714da0044b51c402ea8b02912a7dc5", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777144900, "uuid": "813c2b67-0514-4305-8818-7376f81eb7c7", "comment": "Malware payload", "value": "d36f82ce92aa16b25f4b8426ef01adce4a53ced482a04dd63ef931e95646089748dcd50d0742c47b6f51d2008ee14dc1", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777144900, "uuid": "ef3304f6-5695-4de2-9dd6-d1b1cbea51c4", "value": "T1CBC58C467CD004FDC49DB63289F27A427B34B8480B3667C31A926A783E777D21C76B5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777144900, "uuid": "52716f5f-1c2d-4944-a92f-30d3e69efc2a", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777144900, "uuid": "dfc6ab17-117e-4817-a476-e74376a7a785", "value": "49152:TBxloaqcY8bAK1RUfPipEJEpU5KGCsmcaQuH5GP9bdrU6qpJlKNLlXa32:TBEdmnIapEJEpU5KGCsmcaQuZGFVUHpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777144900, "uuid": "36646ab4-7b0f-47f8-9703-15ef8a398881", "value": 2669696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777144900, "uuid": "192b718a-1987-416c-bc72-42cd4f07294e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777144900, "uuid": "7ed477af-a441-4db7-acda-1fa7fee1a22e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064a5160-40ba-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1777130313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130313, "uuid": "03feeb07-540d-430c-9a40-cfdfcbc1bfb0", "comment": "Malware payload (DDoSAgent)", "value": "59edbd52beb3e66e36c1bbd0d6fe95c3", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130313, "uuid": "3f2658a0-50ae-4161-a560-700fcd997b48", "comment": "Malware payload (DDoSAgent)", "value": "240fb11a006b3c4839398b1b075afff21e2085845580916555b94c1e6a5949fb", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130313, "uuid": "ba13bde4-7e60-444f-a4bf-0fc5db2d5925", "comment": "Malware payload (DDoSAgent)", "value": "4e5555b3dcd82e33f8aa16e6e38508320ef9c611", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130313, "uuid": "2c897406-7a54-4815-8232-348656bf957a", "comment": "Malware payload (DDoSAgent)", "value": "31a8a15d72c1c9a9052210317df37a8fb957dac452bde6909740fd4238355d6ea68a1b06ce8b7793170e58db19920041", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130313, "uuid": "4abe2eba-242f-4019-aa75-bab862ddaf5c", "value": "T181735C05A392C0B6C4834BB011E7C73656B1EE7103128E2AD71CFFB59F26686B56A73D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130313, "uuid": "236cdd6a-42ee-4565-ad1c-e6373f1ef1a8", "value": "1536:V3dzcpF5eR9QUD3180mPobJvfFWriiF1d1Fdaf:V3dz4fqFisbJ01Xdp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777130313, "uuid": "b59a83df-14b2-4b72-a981-bb61fbf6c001", "value": 74312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777130313, "uuid": "b99e9256-5ff9-4316-9d6f-d0699e513780", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130313, "uuid": "22275c38-d7e9-4d5f-82bf-3df50a68d5fd", "value": "bot.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "887dbdb3-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128814, "uuid": "8507da75-d64e-472c-bf18-f365d94cb032", "comment": "Malware payload (Mirai)", "value": "23c2359721cdbcb40e4d63a6b9cd004a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128814, "uuid": "90f84a95-5798-4534-b11b-d1016593e0c0", "comment": "Malware payload (Mirai)", "value": "24696ac8a9b936bbf8ad744eee7038e013cbd9e256b430a36a1965e457ab250d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128814, "uuid": "ad2a34f4-59cd-4a5f-bb0c-7581314f7c4f", "comment": "Malware payload (Mirai)", "value": "e49dd9ca5e852c997cb3cb02b2a08c459502e051", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128814, "uuid": "9dc063dc-d8ab-4cba-9cf9-536af4df118b", "comment": "Malware payload (Mirai)", "value": "af39431a0b76af3091c65717b1998e7ff3118fccce2b9c9ad9f192453442cadefe8094a2e304a6de9f961c0d6e38cb12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128814, "uuid": "7e07c60c-ceee-464d-bfa3-ce3618782f65", "value": "T178630210084364A3DC71E975BC46810A5DB6DA48FAFF70119899171CFED8782E9E3FB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128814, "uuid": "cc61c8f8-45bd-4f15-9d5c-e664b8a5e4a4", "value": "1536:Lfvn8fm7yHElFzN9+X5LVaRmFvQwkLDbCxMFnwLaWBmyPTdVb743:Lfv8f8llpN9+pLVWmFvxkLDyinwLaW8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128814, "uuid": "c24613db-baad-476d-85ff-457a580c771c", "value": 68175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128814, "uuid": "ffb59486-3559-4c0d-837d-cb36263b32c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128814, "uuid": "eb21d612-245f-4967-a421-ff23f23eceba", "value": "h", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97abbc9f-4082-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777106505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777106505, "uuid": "20a84177-f0be-4439-81f3-fa6544055710", "comment": "Malware payload", "value": "c7ed8a88717c9b1f9c182b5eade3e4ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777106505, "uuid": "c5fb2f85-6553-4ddd-883d-33024bc80327", "comment": "Malware payload", "value": "249b64aeaafcbb9f489e4b59482db9fc8829cd193b2a1d9ffda53382e54805a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777106505, "uuid": "ff85e48a-aeb4-439d-a859-e0a29ace7ba2", "comment": "Malware payload", "value": "9cb94dfa0df5848e1cef7a3d17243263ca7e3b6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777106505, "uuid": "b289f9e6-d67b-4cfb-9fb2-6c5dfda7a1c5", "comment": "Malware payload", "value": "98cc9623117b9203fde297416ffc5bac2337090379d4aa6a910d9981739fed67310de536a8266e767f6d6985ea0d127d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777106505, "uuid": "284e3cc5-e9fe-46d4-9eb4-0716b488e943", "value": "T1BFC623FA05E251B491D20700618AD39970C1E68E81FD1D2D3DD76C82676CDAE268EFFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777106505, "uuid": "ff94a61d-dad2-4024-98e6-89736d3d6151", "value": "436806931e8b28b9778fd54742f0a914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777106505, "uuid": "bebe4e3d-a95c-4a1c-ae29-d84c9d1be117", "value": "196608:gwvhsx/XBlqkYCOlYZlJbyT9CTL5v3W7Rcyp72CBWlndoWSLHu9YS:BpsxJlkCOlYZzG9CTNvm7Rcyp72V0XLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777106505, "uuid": "7cb8a7e5-b052-4e4c-a4fd-2fbbd7c6b5aa", "value": 12390856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777106505, "uuid": "31c2af4b-e298-4362-bd42-6aaea516822c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777106505, "uuid": "9f7902ee-8f35-4a69-a4db-034940da6b3a", "value": "Fortnite.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ec92b88-4049-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777081795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777081795, "uuid": "c2e32c18-b9db-4a29-aa94-caff08c9e0b1", "comment": "Malware payload (AgentTesla)", "value": "8d149ddb8ee4e0932d43de2fbbe04c79", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777081795, "uuid": "a91dafec-fb42-4ac1-ba7e-6e3870698e34", "comment": "Malware payload (AgentTesla)", "value": "254f7eb10f496b05776ac30aa80b874456eccda813ee231575d557d26ddfaf07", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777081795, "uuid": "f6488f7b-befa-4cb8-aa88-ad58fe50ac58", "comment": "Malware payload (AgentTesla)", "value": "e378cfa00fc64e96a4984231b0856ab2110f0fdd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777081795, "uuid": "4c58d0f5-1afd-4118-b403-2533658f0e4a", "comment": "Malware payload (AgentTesla)", "value": "7b088bba16c091c645905c3671d6c53dc26d173514bf1bfdb108a239ce02bb867bac9ee1f28b58851ee3e7d4ad25095e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777081795, "uuid": "0e07e954-ae12-4cc6-8eb0-ca4164405a45", "value": "T19E353312E6C5A8D944568B43F837EE5A7B9247D24D4E60A3B3CD60C92B3CF82D12F718", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777081795, "uuid": "6a753a1c-8df5-4536-9fc3-e9d373a0b129", "value": "24576:1O3vvkQHF+/FDE30z/w9B+i8TFA+9wSCEE+gNvG20mVYMoQh:m3f30cJ+9wdzbhpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777081795, "uuid": "718648b9-f91d-40a4-9156-cb936e902efa", "value": 1111671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777081795, "uuid": "17622696-9139-4926-8e3f-bd4ee0c2279b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777081795, "uuid": "8321b05e-e918-41f5-b824-bb25f39d58af", "value": "ps_pLqLABnXBwpg_1776759819620.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c236f22-40c0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777133088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133088, "uuid": "cdac4ba5-84e7-459e-908e-0780fd0ee0e9", "comment": "Malware payload", "value": "2e1334d6d3cc36fdb56c2b14151d1017", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133088, "uuid": "cf8d5685-1844-41c2-a2d2-5293acd4aa7d", "comment": "Malware payload", "value": "256f984e4266bf6c665b53ee057b023d0bdcf0f546a4e050ab77c32ab48f27f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133088, "uuid": "f7f86016-463a-4b57-9bc2-d5bf76cd6ce7", "comment": "Malware payload", "value": "21b3e1c1397a373ecce046fb2d33a0aaad0c1d68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133088, "uuid": "674cdc8b-33c5-4adf-be96-d7f3a4a90421", "comment": "Malware payload", "value": "c80ee675f2b47d15f96811b0484dffe5784e1f214a65d55ccc24d51c33a254f9cde8db6fbcf74b1b8e0028df642a5d34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777133088, "uuid": "e466da92-ee28-440b-80c2-229d0fde8ba0", "value": "T180767C91FB48A136DA560A3248670B30B3A11D82C1F4C96F970AF72F59B26F7594FED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777133088, "uuid": "b1f51d36-ee36-4ebc-93c8-5c3f848a2731", "value": "49152:Gglh8JIMGCuiyNxOMUPcfSS0KKmhzxqRm6niUa8Pwy9/MtJGfrHHUt5Eq:oInrNxeUfSENCdLa8Pl/GJGfrnUjEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777133088, "uuid": "0c2a640c-a09f-4020-80c0-e2e5b011270c", "value": 7340216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777133088, "uuid": "a13dee44-99fb-474a-8990-db3ab68d4ba0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777133088, "uuid": "dcf719b6-c7b9-4602-b24f-f546689d64f8", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4deb0613-40c2-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1777133870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133870, "uuid": "a7fbdeb4-fe73-42ed-8b63-39b27514d354", "comment": "Malware payload (SalatStealer)", "value": "0be1fb945644a566fad11a84cbb929cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133870, "uuid": "6c509735-961b-4795-a1a7-ddf828c531cd", "comment": "Malware payload (SalatStealer)", "value": "25802493e7ef64523d6ab13ad6e5555b2b08fd4576ae2edd905ad939d256aa3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133870, "uuid": "2bebc1b5-e4e8-42bb-b1ba-1d8eeb733f75", "comment": "Malware payload (SalatStealer)", "value": "d5b64ff856b94a495e474543dc307c5cb3053f1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133870, "uuid": "58c4d16c-fe67-4ea2-a797-8ac19c6f7445", "comment": "Malware payload (SalatStealer)", "value": "abec8df88cf5d093163fbb3e29024ddabd2df87d984e825e3ca17e513f4a18838c18c28876659db9c1eab1d6c94c009c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777133870, "uuid": "7ac113f5-d79a-4367-9958-e0db068a7e06", "value": "T19CC65C11FACB54F6F9036831416BB37F23315D048B28DB9BEB583B6AF877691186A305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777133870, "uuid": "c46f66a7-7009-430a-9339-13566baf4f6a", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777133870, "uuid": "8acf9cae-357a-4e16-92c5-3a4d19b6f5f1", "value": "49152:1pXZKft05HtyvruRo9JBDRHCTdU391KX1NbNV4L6d+NTPeGFPbQuhHEPAw8sWedp:jZ0tkRorxxCO3ukFJFzAoJf47eEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777133870, "uuid": "9374ea2e-2048-4f61-963d-841127f8accd", "value": 12570624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777133870, "uuid": "ee47d8c3-3a21-4a6a-9e6e-3912aee96836", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777133870, "uuid": "ab469b5c-51a7-40b5-a12f-c1665f21abcc", "value": "TelegramFix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c998831-4072-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777099454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777099454, "uuid": "510e5dfc-c9ac-4310-8061-23633ea62024", "comment": "Malware payload (Mirai)", "value": "5eb19f83887057cf20280a96bc345c08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777099454, "uuid": "69efc729-01a5-4048-96bf-47940d6aa23b", "comment": "Malware payload (Mirai)", "value": "260b26352a27cfb8bfe256593e2c789577d51f2c41ce1eef7c5d8d92229a8491", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777099454, "uuid": "4698a02e-4cfe-4705-9240-08bdb61d2ca0", "comment": "Malware payload (Mirai)", "value": "544accb58b0330172b5cc598bc2419e335e8f0e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777099454, "uuid": "8a606d84-2091-4894-ab3a-ef1156c15859", "comment": "Malware payload (Mirai)", "value": "1f7d45e3bda3690f1663ee7bd0f0ae4186346fff590883a843729759425e7cee803b50c876c150865169f955bc3abfa1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777099454, "uuid": "27e8425e-cfed-44c3-ac40-29ae77ae83c6", "value": "T1367312B427895CE1F56049B2FD5A3FF85DC21E4396062C866A5CF52B5CCC223BC479D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777099454, "uuid": "9421294c-295c-4955-a9ca-6627d23cd4a1", "value": "1536:tHByWmJ+snrHjYP+d164fW3kkgi5RbkW8lmgCfiIDu6dJy759w/mtEVJu/:tUjrFdMmW3BN5ZV8lYaISmJE5eutEVQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777099454, "uuid": "145d617e-8c8d-4874-b6bf-ce5b1046cc1c", "value": 79512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777099454, "uuid": "a9aee4bf-3662-48b8-b558-e5dc5bf4cdf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777099454, "uuid": "87ba5a25-c195-43ee-a79f-5d9f6b0369f5", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f40e2462-40b9-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1777130283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130283, "uuid": "79cdfcbc-a2ec-4779-a092-a4058ea114b8", "comment": "Malware payload (DDoSAgent)", "value": "84dd5d786d05793c1f04bfc81f1fea87", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130283, "uuid": "3d1eeabf-99dc-4235-b335-a06cc0363483", "comment": "Malware payload (DDoSAgent)", "value": "277247f3700a18de8fa4688c4bbeb370d94bd1e2af1b8e4330831a9cbca65b1b", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130283, "uuid": "cdb1d816-9879-41cc-a2be-de3e665fb403", "comment": "Malware payload (DDoSAgent)", "value": "08eb529e6d827e0e8222ebeea012446538225a68", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130283, "uuid": "290be889-5951-441c-9634-de605bc6eb2a", "comment": "Malware payload (DDoSAgent)", "value": "5a59eaee3c0493d7ba382950dfb070f7dc9d1165a832a5252129f683ee0f99668d5fdcb22ee8f6fb482be14fceb746f0", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130283, "uuid": "7848d983-b3b4-4678-b4a7-bec4bd98f1e9", "value": "T19924E7076BA19EF7C89BCD3302EA860120CEF05722956B6B7378D65CBB4A94F49D3C54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130283, "uuid": "189acde7-047c-404b-b0fa-eba4fc652ecb", "value": "3072:+kkyo8Jbqa7jlSLUOdIwYDuWCP3moz9nzBsNcPUTkFizT:hkKP75zO+wYi13moz9nzBsNcPUTkFizT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777130283, "uuid": "818530bc-5280-4861-957b-6188758d0c4a", "value": 227701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777130283, "uuid": "828f6be9-f021-4118-9476-86f1458beaae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130283, "uuid": "574bd5c9-3fc4-4b37-ad65-ed65184207fc", "value": "bot.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af32a52b-4070-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777098814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777098814, "uuid": "efb254c1-7422-46de-8cad-0d6a4e7112d4", "comment": "Malware payload (Mirai)", "value": "8d72901e702bc66eeef062416639bfc4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777098814, "uuid": "3efaa8cd-cf7f-4533-96b4-20676612dce8", "comment": "Malware payload (Mirai)", "value": "280a56675cc8efe5142fdbecf090098d7bc387df65fa88c920678112c2956aa2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777098814, "uuid": "ec861667-e9fa-40e5-a038-dfc5aeb87cd2", "comment": "Malware payload (Mirai)", "value": "800201941f6991aca63c45c6eb1e7b0974af1bca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777098814, "uuid": "4ccbddcb-da1e-42f4-b7da-a6f390752b70", "comment": "Malware payload (Mirai)", "value": "e63c3f07c9f9cab4e472af4f90a2821ae231c99274070344fae0209085482f9db088d874b3156c05be864c1455f3dde6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777098814, "uuid": "bd18e6bd-f749-461b-a943-dcc1be171561", "value": "T1DC845413D9118991E5644CF2222B3285B94787BFC5EB32D3ED164AA1FF2582F42BEDC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777098814, "uuid": "188ca31c-036c-4e33-b7a6-e2f6a29c5e05", "value": "3072:gAI5b3eEgmf/X5/wvMzDEwa/ubXBqjG9h6GkZ+joC4RT:zI5tgYX1kMnpagAjG/6Gkojov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777098814, "uuid": "864be554-4335-47ca-9f83-ba59595d3d93", "value": 388604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777098814, "uuid": "e6e9faf7-cebb-4137-b648-1ce951bd7543", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777098814, "uuid": "d2e66a3a-00e9-4db0-99b9-dd80cc5cbcc6", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4345a7f-403d-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777076999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076999, "uuid": "853e4123-8f94-4a84-8133-27d918318b6e", "comment": "Malware payload (AgentTesla)", "value": "59ca863f20614f8a2307d098fd00e0c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076999, "uuid": "0fd048f7-86d4-42b5-a56e-054dc3d8c77a", "comment": "Malware payload (AgentTesla)", "value": "28efc52d4c02928579881cc94182c127d57a4a2dce88713bddb31c82c53cb8bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076999, "uuid": "88d922aa-9ead-47aa-a77f-df9a475c7bc0", "comment": "Malware payload (AgentTesla)", "value": "50c19609b0b41d31a85c97daf554ef7e034c6a6a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076999, "uuid": "23e291f0-886f-4e17-958a-16db23b4d671", "comment": "Malware payload (AgentTesla)", "value": "6cbbade724578a4dae36f9e7f2a3265810f90e8b8eafbf26ebc9a30a76cd461bc891e8083d705ea12b5cbf8c3b56bb13", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076999, "uuid": "08859d37-c3ca-4385-8f21-5b073a9953b7", "value": "T1E93523915FAA6DAE4DF59620F8373E3A6B341F93DEC118D2633A22E1239670495F3134", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076999, "uuid": "59060652-cd36-42b5-90ce-98f38c95c2b3", "value": "24576:VTOcPX845i58GF/S+3iCYBA3W/BVEeQzojqGpNq88R41nw:90x8GuRxxPpNVJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777076999, "uuid": "4d85f5a7-c1e6-4314-b88b-430783e04455", "value": 1101766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777076999, "uuid": "a05d2d44-fd9b-4759-8e67-04bead4ef67b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076999, "uuid": "4b21ae5e-9dea-4bfc-a50a-ca08812bdaf5", "value": "ps_fGX4TJasv0Wg_1777051370717.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca184f63-4083-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777107020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777107020, "uuid": "83627714-b846-485e-af1c-38dccafafc9e", "comment": "Malware payload (NanoCore)", "value": "40d0951130e09d9353ca3de2b5045bb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777107020, "uuid": "57107f65-e358-48ab-867c-8a4639aa3e9d", "comment": "Malware payload (NanoCore)", "value": "2b33deca7af6ba3c46e6825b5680057d6057316eab3e88e7d4879edf867eabfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777107020, "uuid": "0be7a0b7-3f9a-42c3-a869-4f4b87d6cef9", "comment": "Malware payload (NanoCore)", "value": "a2e1821c906b1cdc7da8782debe4812b7279103f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777107020, "uuid": "eff758dd-84bb-4b54-937f-9fc8eccdbe95", "comment": "Malware payload (NanoCore)", "value": "81c6064bf94fcba4f0b67e28096ab9885a1dd5fa1aedb1107fa7f1bb00066499b9a23455f4176f771c01c6a8c785fe83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777107020, "uuid": "9db45e70-58ad-4754-b5d9-f802814f05f2", "value": "T1D114C02677E98A3FE2DE8679611201524379C3E39DD3F3DA28D414B38B663E50A0B1D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777107020, "uuid": "738f6310-5611-47e8-9f59-58b8c81a0cc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777107020, "uuid": "062f1b4f-87d9-4bbd-b927-6da47c8e9d42", "value": "3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIdbO1RxN+dAu8imqhVPd63DfOS:sLV6Bta6dtJmakIM5qwC86hV1UfUgrT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777107020, "uuid": "1b1dbbb9-d2fa-4844-a421-650943c0fd75", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777107020, "uuid": "81aca204-fd42-41df-a0da-dcce6fe91995", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777107020, "uuid": "fb8c4691-1b47-48ed-9be4-bde2b9fe4b10", "value": "ratnanox.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d82a02de-40e0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1777146986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777146986, "uuid": "40e2af5c-826c-48ca-a678-a0554ced7173", "comment": "Malware payload (Formbook)", "value": "c5dbe089d433ff3a7bf4e526cba558ae", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777146986, "uuid": "0d8be1c7-f5a0-4f48-a37e-454affc0ac0e", "comment": "Malware payload (Formbook)", "value": "2b6fbc05f4e047f1c4441b7123380cc5284f3611bcf1ed8069dafb3555647eec", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777146986, "uuid": "559235f1-4598-4157-8230-c6694663aaa2", "comment": "Malware payload (Formbook)", "value": "448429d00242777e9945f2536c9f3dcfc367c1bb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777146986, "uuid": "d93d1207-9f73-4c1c-85bc-8dd0449b2adb", "comment": "Malware payload (Formbook)", "value": "f315c5872221c8a5be4e10dee63bd18a46afa22333787c50ee37fc6ef23b4b82684cef688deb2e1b013f4319104b354b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777146986, "uuid": "af159e77-3a9a-4d7b-ae94-9252f30508da", "value": "T1B36533B0DD102EB845C88E2271FAFF584D919B62C603F513AB35A5C74DBBF089AE2705", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777146986, "uuid": "fdd05564-c1b9-4ebd-8bbe-09583c1e1634", "value": "24576:jXnPOuNVyYSZhCQ3LoCwYbXdLh1Xy9t5DQXN9HFqzMi8XC:jXPrYbo8dxPC9rwYz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777146986, "uuid": "62f5b846-3eed-4d69-8e68-3088a1efcd13", "value": 1535927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777146986, "uuid": "820e7cac-86d4-437f-9287-e552da8a1f80", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777146986, "uuid": "eaf73dda-6859-41c9-8649-602f23758313", "value": "OHMNTAEM.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f3a490c-40c0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777133066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133066, "uuid": "f57202ac-a7b2-40a8-bcd3-e49090902318", "comment": "Malware payload", "value": "372d7a72f66e5706117b39ca58fec8a4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133066, "uuid": "0dace25a-f263-4854-b439-87e1bca61dc2", "comment": "Malware payload", "value": "2bbee59af2af27d51d9cbb8a149b1d7274d63a791f09566dc1e32c80d35f64e2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133066, "uuid": "641e7196-6670-4959-95d2-022780fcd45c", "comment": "Malware payload", "value": "e7d81480a87fd45e53e7e291ea9099e1c2d0c767", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133066, "uuid": "92b52214-8663-4326-99ba-c5227dc0bfb8", "comment": "Malware payload", "value": "2f364266676488b0e744641feb13c61c7a709fe30f040440dfde2256c0a36c2ed7f1ed420e4b599d236a6a2b2fc87c1d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777133066, "uuid": "5889b2b0-1c72-4df2-8264-ec06295adc0e", "value": "T141137D6566953C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777133066, "uuid": "54d8d708-2e5c-4661-bc7a-6fe63fc946c9", "value": "768:b0XRWNGxVP9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bIlxGco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777133066, "uuid": "e7ef6914-084a-4477-a55b-06e53cede5df", "value": 45506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777133066, "uuid": "05992c03-45ce-4813-b2c1-112a7b4e98f6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777133066, "uuid": "1b3a9397-58a0-4efa-9eda-055d01970124", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63da5040-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128752, "uuid": "0eaaff00-4c6a-4607-9078-f780f8ebd428", "comment": "Malware payload (Mirai)", "value": "03710b52e77b3837afa29bb831240c3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128752, "uuid": "556c2ac8-537e-4a60-869e-c0dc08182e93", "comment": "Malware payload (Mirai)", "value": "2c00d689c5a3ed17918272db1264d556686f7a10711d2969b23b41ce099b9057", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128752, "uuid": "6b213f09-709f-4e17-9169-60eee9ffe916", "comment": "Malware payload (Mirai)", "value": "8e1ac132c49edcadbb1b40caca9d2fb70c1bb3f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128752, "uuid": "19a10817-d9de-4bb5-9250-79623d2cc1a1", "comment": "Malware payload (Mirai)", "value": "0ff5ee7849f2346830689ca37703cfd90afc43ac10f5611ece6d86f70dfabba63e5dba0d8dc2cee7d71c09ea46d71cef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128752, "uuid": "caf2a83d-4d3d-4034-9f15-dd25370031cd", "value": "T103333C4DF783E0F0DD4B0531115BF77E96349E025124DE7EEB98BE62AE32A02711B618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128752, "uuid": "ba058d38-3065-4615-aacf-a67093318deb", "value": "768:nwwheNR1eCZWUJ2S7pRflrFWwqTlFNB5azjYvzNeVMU2331ANA0B7RhuqDV98wNN:wwOt37pOzwLMU431ANA0BLBC0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128752, "uuid": "7249f552-68fd-42cd-bf29-97d5f219a753", "value": 50476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128752, "uuid": "f5345524-1408-4bfe-be5a-383ea10f945a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128752, "uuid": "9a87bf53-d39f-4032-bc05-d28ee6f9d16b", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "018eb1f5-40c0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777132882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132882, "uuid": "351f4ef5-296c-4654-8abf-e49c711d7a9d", "comment": "Malware payload", "value": "9e576c76e5da85d26b9368257db57193", "object_relation": "md5", "Tag": [ { "name": "Cerbu", "colour": "#E330E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Giant", "colour": "#D76866", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132882, "uuid": "c9f26e02-8882-4b30-b8e7-78337efcb5af", "comment": "Malware payload", "value": "2ca7ffa157c03c785115b3284562e84de6b3bccdb55eabcee1bd248267339715", "object_relation": "sha256", "Tag": [ { "name": "Cerbu", "colour": "#E330E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Giant", "colour": "#D76866", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132882, "uuid": "ef224ace-9b43-4bfe-b75c-b1d66114a65c", "comment": "Malware payload", "value": "5719e106bbf379531c6e88ffa436dc779d342297", "object_relation": "sha1", "Tag": [ { "name": "Cerbu", "colour": "#E330E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Giant", "colour": "#D76866", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132882, "uuid": "9d159813-6fe8-49ad-9b87-306ce8412db6", "comment": "Malware payload", "value": "072337db85a35b081c2f42b823dbc282b9586a244d3a493bd383355ad75f89c2d49092840ce6b0a1fd90951d803ec875", "object_relation": "sha3-384", "Tag": [ { "name": "Cerbu", "colour": "#E330E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Giant", "colour": "#D76866", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132882, "uuid": "3a4ee1ab-ca3e-4cd3-8cea-be0bbb5d5100", "value": "T19E07330104A718BBD0D1B837EE3FC6B4AB7473A8A45E36D9423D527B7F412D62E391A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132882, "uuid": "a6ebdaa4-3d39-4e83-a44b-7fa29edcb33d", "value": "d54f4ce7166adf987d04345af91ff939", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132882, "uuid": "c02951d8-5598-4b82-8919-5613a0343d0d", "value": "393216:omILAn7Yax0k6mBdluYimwru4XzSG0LQjWx0BnsNwOY:PILcLmM4XzNKx06OOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777132882, "uuid": "203f48c7-a718-4704-aff7-d898297e5e2f", "value": 17487456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777132882, "uuid": "850ba9d3-adb4-41a4-9075-f4c38529fc83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132882, "uuid": "edc686ec-14a0-4980-a116-e4b3a10fd274", "value": "flowhelper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0fad675-40f2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777154705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777154705, "uuid": "58f3ba63-5ca0-4924-bf4b-755307771238", "comment": "Malware payload", "value": "78c0989f85e2cbfd05d6950cf447c870", "object_relation": "md5", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777154705, "uuid": "ff8a39df-d6fd-44b2-8a4d-d882edd4b135", "comment": "Malware payload", "value": "2cc90edd9bc085f54851bed101f95ce2bace7c9a963380cfd11ea0bc60e71e0c", "object_relation": "sha256", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777154705, "uuid": "770c2f2d-1797-4d71-baef-80bbc93d7cc0", "comment": "Malware payload", "value": "5adc9e79d56e8f72e319a789c936f8f053b66bb0", "object_relation": "sha1", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777154705, "uuid": "875ca427-1a1d-4040-8366-c9a00bdf88ef", "comment": "Malware payload", "value": "b854ea05c7dc59c210a63358bb5955a9cfb7ad247594a4c8529c20ad0d76cdc6f21a6d38289bcaefdbc638a57b0fae43", "object_relation": "sha3-384", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777154705, "uuid": "0d0dcfa5-b851-4ace-88a8-efd28bfffedf", "value": "T1DC92E857B341C57AF04E82781CDB42B9A573B4B5DB2F9047F7812B2AAF2C2411E8E716", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777154705, "uuid": "fabaa5c0-5103-4606-ac25-37d6ec8d57d8", "value": "384:vpwpteD/YF4CniPOraPTSpClnj7hg/DIbMCfZS3FFuH3Guwzo0wyktl/FyTsyWK5:vpYteD/YyZmRpCB740bDRS3WH34lctJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777154705, "uuid": "33930f8d-68b7-4d50-a242-90b629bd9262", "value": 19608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777154705, "uuid": "c0759bd3-ac0c-4ff3-b949-a982a8ea13ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777154705, "uuid": "19684397-ab2f-474d-aa27-3500c359b489", "value": "auth-session", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7973c2cd-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128789, "uuid": "78269a63-3225-45a5-96cc-e930ac18d23e", "comment": "Malware payload (Mirai)", "value": "088d64f097348d5e6ede4f1134bca8a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128789, "uuid": "79279563-1604-44f6-80f2-a8f9f581c19c", "comment": "Malware payload (Mirai)", "value": "2db7353e5013f9223f605f9983c696a5270c3bb84d3a304bce61c9ca46d1dede", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128789, "uuid": "4a459237-e78d-4c1b-ad9d-2e6c91689593", "comment": "Malware payload (Mirai)", "value": "537d70369223fd05b21eea5c096ac0e04ddcee51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128789, "uuid": "c76f0d41-bd16-4516-a9d2-c577a76e64b6", "comment": "Malware payload (Mirai)", "value": "cca560ed2a01ade0d9d5ddf026955c6f164dbfe2b4124dcd30ffd36cc5d7321103b10df257a48c0903036eec72bab2a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128789, "uuid": "97e02777-3a09-4ca7-8353-6c14ac973294", "value": "T10C839E63D9352DA4D4E849B0B4B18F7D0B63E454829B6EFB49A6C6778083F9CF2053B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128789, "uuid": "ce1cbd63-ad27-4e5c-bf3d-0d9ac74e9934", "value": "1536:JoqTDOxkaoTEqUDhllaNhofKMr8NuJ6fCGB7w6Vyuw:JoqTKxhoT4DUfoCMJJ6f7tzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128789, "uuid": "0f210f52-839a-4419-bd6f-515b4664216b", "value": 83803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128789, "uuid": "07a762c1-b650-4836-8236-42eb515dbb4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128789, "uuid": "d477f036-59fe-4ad0-a7ab-21a9acca8a23", "value": "l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8134c27e-40e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777147270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147270, "uuid": "5fa369d2-2f3e-46df-bb32-f37c1a9fa209", "comment": "Malware payload (Mirai)", "value": "0495d223629ede89bd845394b03d5584", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147270, "uuid": "58279fc7-0e21-4573-a22c-5f917c830788", "comment": "Malware payload (Mirai)", "value": "2e94b1fc61e5ce5a3b5c478531fd4d91ba1c00ce46317e7115f1f2fa4f5853b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147270, "uuid": "5519e5c3-1ed7-4d06-8c56-025eac4031e6", "comment": "Malware payload (Mirai)", "value": "37cdf0bf79e1844d5829136a3ea888f443572fe9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147270, "uuid": "dd56c0ad-212a-42ca-9c0a-71ffa0a17425", "comment": "Malware payload (Mirai)", "value": "b56e067757826b52d185facbd8108c254a6a5d1e6688fe89950bc48ab24c24af36adb088b796bafd5b8cec7e5f00576f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147270, "uuid": "2068f10f-a8eb-4be8-be97-127d98100064", "value": "T1CDB3E085B210AA55C02672FCB1870990D3B27E7B4B9A150B44B3F5B46DBCCD47E0BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147270, "uuid": "57f07a81-a1be-4a51-87b7-89b7798c3734", "value": "3072:jx63zpjhO5z01nCU375P5wk5SOez7wuj:as5zqhr5Nzy7wg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147270, "uuid": "cae6ccf8-e5bd-421a-9214-9fc031f5928f", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147270, "uuid": "517a8a3e-7c41-4c77-9063-4a4ab8ad49ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147270, "uuid": "d7bdba9c-87dc-4134-a225-5d29ac1e7a90", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17130933-40ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777159977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777159977, "uuid": "f385f3e1-de9f-4fd5-9532-0e44de75ab1e", "comment": "Malware payload", "value": "3538f6f9fcaf8f8264fb5cf5fc312236", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777159977, "uuid": "34f95c2c-91d9-41a2-a0e4-abe9c5255804", "comment": "Malware payload", "value": "322f73c3a68b09cab469ace2c2b71cba547ca330f3e5db297cf7b923811d44e6", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777159977, "uuid": "3b8a65ba-4ec4-4f27-b89b-472764acf43a", "comment": "Malware payload", "value": "5b80e4d7a207795cfcd23500249bfe448747d361", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777159977, "uuid": "9750753a-6d6b-4b90-9c29-47966a270110", "comment": "Malware payload", "value": "4dd7879b02a02787752df336b5082eaef22e9a816a9163b324b0d051fbbba858817c88e4bbd70dbb660c30809216ab61", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777159977, "uuid": "5cf1bd30-08b0-427c-b24c-23a605932f8a", "value": "T17ED1573DD9A1FCD0436F31C09A6A3F0A109C5B63F7B66B6CF8C609A92924589DF3954C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777159977, "uuid": "b1dbfbd8-6ae3-48a1-8519-bd27d1386105", "value": "192:r0+gkOOj6JZ9CPhwmr5hhn4WHyu4KK5wP/6HObvK:rCZ9CJVr5hl4WHv495C/6ubvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777159977, "uuid": "cd126118-ed4c-4c5a-a569-0c8de2aa09cc", "value": 6260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777159977, "uuid": "4e2d8a85-fc26-4c35-8826-f691403f8c2c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777159977, "uuid": "9bbbb37f-d3de-4c9a-ba79-9ba6dcaf439e", "value": "zNfEmyXl6UwkZF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ec4a7d-4068-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777095354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777095354, "uuid": "10caf63d-7627-42a1-b01f-f120caeb83c7", "comment": "Malware payload (Mirai)", "value": "dce88083ffcb7a35f210dd918f533659", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777095354, "uuid": "442d43a9-eba4-40b6-b127-92bcec33390c", "comment": "Malware payload (Mirai)", "value": "324d4f511247f168594163fa79b18283c86f0121a13ce090fade4aeb7d56d541", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777095354, "uuid": "8d0a0a70-f49f-4ec2-ad2c-bdfa6cdaca1c", "comment": "Malware payload (Mirai)", "value": "d06ea6c9a2392965f4d092b9561601b5357902b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777095354, "uuid": "f2ef5863-dea9-4c4f-acc4-09320565beec", "comment": "Malware payload (Mirai)", "value": "e7b4c017e09a531931bcd1670df44a5bb5e66795db81c16d18abcd3db60797541c27fcdc7d32cd365ce4aa7c1a484706", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777095354, "uuid": "9f40541c-23c5-456a-bbed-783aff63b81d", "value": "T1C1645653D91684A1E5248CF322777346AC4783BF88E762D3EE5A49A1FF2141B41BEEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777095354, "uuid": "81539397-0312-44ab-9f9b-3c72f80ebef2", "value": "1536:EkSdGmeGOZurN4ElMrr3zWQ3zO8zIa5DrA/M9pS51JH/jTstmGbLAZNHd:7uuwCE2rDxz7zpDc8gBfjoyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777095354, "uuid": "4fcd5a52-3bd7-4d71-bf26-65d0cdc4a496", "value": 326380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777095354, "uuid": "c45ff653-595a-4b79-910f-afd97e8c4abb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777095354, "uuid": "13e7d4e1-2bf4-4299-98e2-a1a1d2efdc6c", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e7673cb-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777128609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128609, "uuid": "e01afd24-dfb9-4541-a4e1-dbf7c484d9e7", "comment": "Malware payload", "value": "289634aec55a115887cd98994f143a06", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128609, "uuid": "17177aa2-7ddc-47f4-a3f4-3da18e333a01", "comment": "Malware payload", "value": "327120f304e4e99ffb46a7a422dbc254fe923d6cf791e85a644d17b084b0a9e8", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128609, "uuid": "b79cb91f-7a58-4881-b9ee-75cfffbf2725", "comment": "Malware payload", "value": "2338ebc5c9498a8c7f3c4262ee240f37f3162134", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128609, "uuid": "4682cf29-6a2a-4571-8fb0-afbc5b33d0f7", "comment": "Malware payload", "value": "55dc4fe792cde3956160f1a85882c2baa501249f56952ab1e768603fda10bd010acc6f84224f2f2eb0c5ad3a2cf4b3a2", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128609, "uuid": "c0b2765b-f84c-46a8-9940-d95a0caa0493", "value": "T16DE05C881DD4DA4C747A20DC13D3EE99404585622906FD80A244948E318A25ABFD005E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128609, "uuid": "4c6fccf7-939a-4cef-8a28-2390513da207", "value": "12:TFRDMVII+6Drw6PNFE4vtIcM+608OMCYb:PMVIoPjPN6VcMbVOMC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128609, "uuid": "27ca2680-2018-42b3-90a6-a4ded044060e", "value": 427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128609, "uuid": "c50914d8-c615-464e-8121-2bc7f200b0db", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128609, "uuid": "64d4af51-cff7-4091-ba78-80e8ab2ef9bc", "value": "hte.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f90693-40ed-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777152268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152268, "uuid": "6b34a08c-7ae5-4736-9fbf-eb636eda53f8", "comment": "Malware payload", "value": "5b272bb8a90ad1b6eea8bef178b97f9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemotePC", "colour": "#6BD2F0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152268, "uuid": "f861299e-057a-4c97-9faf-4350cb32e3ab", "comment": "Malware payload", "value": "33051985daad8f89778c548a86d22bbe129eb756c67253d9570568b534c2c371", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemotePC", "colour": "#6BD2F0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152268, "uuid": "d9043565-69ec-449e-a8ee-77dbe1bec461", "comment": "Malware payload", "value": "acdb27a399d2ca181160eab93f2787fc72b2629b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemotePC", "colour": "#6BD2F0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152268, "uuid": "3e84dbd0-5053-4946-a647-ff93ed6eb6ec", "comment": "Malware payload", "value": "da6fa42cb6992bd2087b6c3b547e3c0da8ba2694d226a30e2b336107942e3f1313ecbcaebd42e15d6fbafedecef3ae84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemotePC", "colour": "#6BD2F0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152268, "uuid": "237e8347-9b5e-495e-8c8f-9832689e9621", "value": "T1D3D733A13840F660DD118EBA13E9223B614D7DF49CA23122CF633954753F92DAD67BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152268, "uuid": "a12f37eb-0d9b-4a10-818d-52ba64e13fc3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152268, "uuid": "8a4bef1e-1609-4e3c-bc67-d2046068d61f", "value": "1572864:D8sPFv66Wf0UNJH1jR/7vgTfk+ZYEdS4OLG9Dd:D8TPfVJH/mkQos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777152268, "uuid": "a7f568d8-a356-4b2d-8dca-d9c9e5fc8732", "value": 62350776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777152268, "uuid": "ff9b9f2d-a6e3-4446-9909-444ab71622d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152268, "uuid": "ff94f55b-08a7-4f4d-8b87-912a0abdad65", "value": "document_8HzS4dopACwQmq6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23382da1-4045-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777080111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080111, "uuid": "1eeffbb9-0104-49fb-a532-95000a4d6222", "comment": "Malware payload", "value": "738db90bf88df845caf529e2e4e1c1b1", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080111, "uuid": "7cf94e20-df73-4866-9c54-33749875f080", "comment": "Malware payload", "value": "338160ee6ecfd15ca4519dd39855e4f3984db7e1763544ac2a6cf589ba5ee38f", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080111, "uuid": "f6b98c47-1387-4771-a92d-0467947ba60d", "comment": "Malware payload", "value": "73a4a2bdfdab50cc1541ba751e64d45015bba4f0", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080111, "uuid": "875fe2cc-f0d4-4a3d-824c-83556ab9d9b2", "comment": "Malware payload", "value": "34d070dbba5ba1a01e84a4ca449279f2ad4e05781f2c01bd600f74fc3f2056ed9bb9077d6e0b5030f00179b7df543fc5", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777080111, "uuid": "b7e32499-8c2d-434c-a82a-81cd1e7c0786", "value": "T1BBC1471057F99608B6B36E15EABFB461893B7A6D9E3ADA4C0048D04E17F1A408C67F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777080111, "uuid": "f48bbef3-868f-4504-b12c-e288ade9d4ca", "value": "96:YyEBs5sZ5YBfOOFjTFwpODvhsZ5SAHAdiFqEllyckiKSKr29RrQr8H9ipGHAp2MO:Yye2fjqpcSqE/yPSKaDrQrd/2MeY75Hi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777080111, "uuid": "c1a5bdd9-a184-4437-9753-965c288012a4", "value": 6008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777080111, "uuid": "799aec1b-62bc-4893-95b2-03c659ecd6d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777080111, "uuid": "241a9e8d-de7c-49f5-8e23-be72d6d908f6", "value": "gvbxs.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8382cabc-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777128805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128805, "uuid": "8abfe64c-bd59-463b-a56b-e384eaedef34", "comment": "Malware payload", "value": "8be017c04f02ab282c64d44ba28d6ac5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128805, "uuid": "f9772ae4-b70e-4ab6-a8cb-15490924fd00", "comment": "Malware payload", "value": "34287eef2aa02bbe37972077b489355e664ab69eb72dfc684584af0e192fcc52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128805, "uuid": "dfda22e4-772c-4843-8703-18eae630de5d", "comment": "Malware payload", "value": "fccb01c7d619a1a651389c03368bb13c43d4bc66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128805, "uuid": "c093e22a-0774-4b9f-adc2-06e607c269b3", "comment": "Malware payload", "value": "055c1a4b249550b36c080103fda5b4c8cf1ee06f13081905527d2a4283b20115387769966ce657b2ffaaffd88217f055", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128805, "uuid": "809a2911-a6d5-446d-9033-49fffa94c42d", "value": "T138864B137A29EB0FC62821305CB2CA942B691C9642D7911BB745F309F9F21BD5DAECF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128805, "uuid": "73b55358-f167-4cce-ba54-a4a6d38fef27", "value": "49152:Kih3vrHa3TGZmwlzbIU0M/toT5TNGnDTt6DWO+bM1YETgHbVlrQJc0Nr8ia5pp07:2KtSi/VbiQ0fblOtT6adGnUjEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128805, "uuid": "edbd97a6-391d-4213-b542-6164f24d711f", "value": 8126679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128805, "uuid": "0db401c7-eaec-480f-a94d-4bdc7e1b9519", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128805, "uuid": "28322075-0aa1-4893-b24c-574f00463828", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77193b01-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777128785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128785, "uuid": "90e470f7-fd88-4802-91b9-5f147b9c116c", "comment": "Malware payload", "value": "5b193cda1fd34e6bdfffa4913999ce97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128785, "uuid": "9901de2a-b382-4398-94e2-6e3b43068246", "comment": "Malware payload", "value": "343f24b9c3fbd725f8ebb9bfbc1fb507e9c8cad3be3a8e2b4379ceb34c90cb97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128785, "uuid": "842a16b1-3060-4cb6-883e-acad0aade88c", "comment": "Malware payload", "value": "dd0c5b7a0b9da078d543443d29550f068ac3ea03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128785, "uuid": "1bdda984-5960-41b4-a8b0-20b81fa0374e", "comment": "Malware payload", "value": "595f31b2f5260c9039f6e1b6578e16393bd4216a5099b3f3948e2eca7c124243544a003048ed262dd2ea1fd3d95d4b55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128785, "uuid": "47e933b6-2181-4f07-a4e0-8854b73e2fa8", "value": "T1096423D4A7110FCDDDF429B8606B480636ECBE53B39B4E5CA3DBA18B21B11E541253BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128785, "uuid": "66161928-d325-4c96-b25a-c1462ea1ca06", "value": "6144:k/FjYmdXkR6dnjg2Ln38BNBSXITQAI/dC3YRqcZh5/zcVFr0p877SAkHbFRFrAZE:k/5YGX7njggMBNlT4dC3YRVzQVFr0p+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128785, "uuid": "a4e41b52-dd96-4ff1-8462-590c7b2b9a92", "value": 306864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128785, "uuid": "a024921a-0277-48ac-a66a-42aa0988d78d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128785, "uuid": "cb64dd20-1ccc-4e5a-b584-2693482446f7", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce55b95-4081-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777106192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777106192, "uuid": "40be0ec8-01fe-447b-bdd5-284a3cbed90b", "comment": "Malware payload", "value": "b9b54b12cf8501b9e4ecc0f92a6d7dd2", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777106192, "uuid": "700b2a27-105c-4cf4-8b5f-8414f598659e", "comment": "Malware payload", "value": "35a0e479f5f019a5eab563b0a96ff57354d29209bb0552fabd92b9bf0362b4e2", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777106192, "uuid": "99576830-ff0b-471f-a103-c0d1300b75a8", "comment": "Malware payload", "value": "4d22eeabdc2015eeb4fa57671b2877c7a3eea258", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777106192, "uuid": "32fcc3b8-8ac5-4812-85a2-00e785419c81", "comment": "Malware payload", "value": "c24f38ec0515e8f6cf76f6cc01b5f566d8c67ef4b9858d5c1f7ca3794a5678e5bcb8fa3b8c06060eb82879d163422fcb", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777106192, "uuid": "1d4e6665-6dd2-4993-b2b8-e0b1d0f46c9e", "value": "T15E773343AD558E31D500F67CA4E2A16CFFA1A88A69F491228DF0DCBEF731F997835610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777106192, "uuid": "47c62e8d-ddab-4a85-8c46-d8ffb7c11fa5", "value": "48aa5c8931746a9655524f67b25a47ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777106192, "uuid": "1773f2e9-21df-451c-b328-8f0b1e7bf6d2", "value": "786432:f/dQHT9CJelKz022vFcIfZnOopke/8YnN8NDjKOqeI2SkN7Mdd26SJs1:ycJmC2mIAwtnQDeeI2S8S7SW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777106192, "uuid": "14413a5d-1cfe-4ccb-a6ec-cf99c84778ea", "value": 33133957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777106192, "uuid": "5b607beb-de3c-431a-a35c-1c67f425ff87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777106192, "uuid": "773e5797-916c-45bd-9f3d-bb3ecea85916", "value": "Occupy Mars The Game update 1.0.1 - 1.0.7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d0c030-404d-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777083769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777083769, "uuid": "5b997e61-888e-42e4-870d-4736779acb9b", "comment": "Malware payload (AgentTesla)", "value": "40683ba86af00582f810d5a7646418c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777083769, "uuid": "59ff3bfe-8d94-45ba-bcb7-7b1a548f797a", "comment": "Malware payload (AgentTesla)", "value": "35a2929d68a24dc02b99f6e04c102108b0474dc8755fabe90084db8b9270b89e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777083769, "uuid": "11575a70-3a2c-4120-a69c-4f132a74bab7", "comment": "Malware payload (AgentTesla)", "value": "c72927b9b5c585ef9c7e7d43109facd2511a4dbb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777083769, "uuid": "580caeea-ee76-4098-8d5c-87a4470ef712", "comment": "Malware payload (AgentTesla)", "value": "cf4f6fe3a0c44330bc1520529897ae7b8c963a97c0c957f6f47f7f396f4390f0070d824ac9049708e898f39fe42cd613", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777083769, "uuid": "894ca5f9-0c74-4d52-884b-4c24dbbdc868", "value": "T1A525230159D9B837D36ED32460EF2F991A60A7D3580AD1AEC2BA45EFC53B3435ACBD00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777083769, "uuid": "1c0a8c96-9f7d-4454-89d9-2ed2901b9b94", "value": "24576:z2BmLk5ItXNiwcOEX+TVyfvdji7rJO+s+NEI1:zznc9X+TAvAP5E8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777083769, "uuid": "34ab5498-a5c2-44e7-9384-13a89e823392", "value": 967087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777083769, "uuid": "985ed268-725a-4c4d-846f-15ccf56b0058", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777083769, "uuid": "cc4f5d49-18b3-4274-a669-fb58553d8347", "value": "ps_PHLaAz4W97Qm_1776697624741.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909604af-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128827, "uuid": "9cd313e1-57fc-4413-a146-e219224acefc", "comment": "Malware payload (Mirai)", "value": "0942f0e5e7f48f5eba3089d763a21851", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128827, "uuid": "5ff8e62e-04cb-4208-9bbc-cd33fc6cae5c", "comment": "Malware payload (Mirai)", "value": "366bd86babc71ed14dfbcf90ee1c1d5a3a66f24679d59b3540a92239c370d39c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128827, "uuid": "c8ec049c-140c-4c27-9d42-a1a1b829242f", "comment": "Malware payload (Mirai)", "value": "6566959b049043a60aefac042bcfb843d2b9b28b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128827, "uuid": "12e0193d-87b3-4450-8222-67962955a777", "comment": "Malware payload (Mirai)", "value": "b353e07caa0bade215ce127bb3202f09d0876441616b21e8961ce87c1f69c34498de792b99b225f418be4e7cd9290e8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128827, "uuid": "0db85904-79fc-48a8-a25f-2a9f34fe35c5", "value": "T1DD043B46EA409A13C0C72776EA9F414A3323A798D3E733069D186FF43F8765E4E67606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128827, "uuid": "5ffd3635-1c74-4f97-b21a-3e4e9c0d1d19", "value": "3072:U8b6HMqaAWAm21i2PmukdkaYHXclViql/sDuw0a8GjXpM/9zXYj1PBes:UBsxAPDxKkaYHXclVtl/oF8GjZM/9ts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128827, "uuid": "d981523c-7c30-46c9-99a3-a86b4fe24d07", "value": 189804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128827, "uuid": "48527ea5-bfa8-49e6-acd8-cf2cd947a5f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128827, "uuid": "77e0cc20-c04a-482f-bfd4-9e4b49c182ec", "value": "KKveTTgaAAsecNNaaaa.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b4f9b99-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128658, "uuid": "0936faef-7aa4-4656-a902-d65ae7fa9227", "comment": "Malware payload (Mirai)", "value": "da96452dbcb60b7cdc1c964fc2bf563c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128658, "uuid": "6e16d4db-3699-4d5d-a9b1-e54c1f72b1af", "comment": "Malware payload (Mirai)", "value": "3701d3442a1bce35d49161d4f7ca851d13582c07855f05a0c869b2698ce49302", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128658, "uuid": "96f05496-cbca-4dda-941d-b687bbdbcaa6", "comment": "Malware payload (Mirai)", "value": "06aeec02579de50445545d9587277edb49ef0cbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128658, "uuid": "bb5d0eac-45e6-4421-a46d-ceeebcb15f1d", "comment": "Malware payload (Mirai)", "value": "bc55d731874907d65befd9257ec4278badae314474fcf6c93eca61cb712e1afb4d5767ed8d19317e34d27fdad9101225", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128658, "uuid": "30bb3cca-209c-41f4-a1fe-35fbe1a3c5b0", "value": "T190B30945F8445B17C6C666B7FF8E438D7B2A1758E3EE720399256F30378B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128658, "uuid": "daba27bc-b449-4513-bf9c-762ac56671b4", "value": "1536:W7jnPq8azP4V8YOTIBRvyNOzIuSIwYeFWd/lk68wywlQ3Ym3Tb/V1oEakCxQ:MzPqF41OUBljSIxecUtCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128658, "uuid": "4dbd8894-6858-4c48-83ae-a2f8b8eed301", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128658, "uuid": "e1e12c44-648d-4c16-a79a-ee99ec715d4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128658, "uuid": "29be9b5c-c638-4638-91aa-709fb317800b", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0396c62-40b3-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1777127699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127699, "uuid": "1c1c3699-d649-42ee-9f9f-2c82e0a613a0", "comment": "Malware payload (Efimer)", "value": "0b48434e0558890594efd8a0591cc1c3", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127699, "uuid": "cde18a1d-0385-4d73-ad44-81443e1bd48a", "comment": "Malware payload (Efimer)", "value": "37210e8b60b133db225d1358149eaa53874869247b6a191cab71d09f6fcd4d33", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127699, "uuid": "9f83444a-4567-4dbc-a608-d5b81fe02f75", "comment": "Malware payload (Efimer)", "value": "60d4c0ad5960843cc137c48faf28bbb4b94c6298", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127699, "uuid": "22353ae4-b0c5-4269-b855-d535f4362175", "comment": "Malware payload (Efimer)", "value": "fc096d944fbc5f6a3276e0ddd5f0040a6a1aeae2a308a0dba28d51ee313038bf7337a572f91ddd395edced9861385acb", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777127699, "uuid": "0b36f210-e054-4588-b973-66882baa5854", "value": "T195C6331E99E2B1ECD2A39070BEE075B5F8E5B4F246B69C636395C771FC4B0A08A35407", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777127699, "uuid": "e9c12c06-6bcd-4b7e-8df5-8cea9cb8d465", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777127699, "uuid": "8404c4f7-21e7-487d-a5a1-2e22cd075361", "value": "393216:/grXslRXheqX78XMCHWUjX+cuI3/PGTAI:/grmhNQXMb8XzH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777127699, "uuid": "7a3af8d3-d974-4c2f-b22f-f621ea4a1d64", "value": 12609911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777127699, "uuid": "87085b62-ba53-49ac-9cfd-e70e8ea6f7b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777127699, "uuid": "dd7a46a9-cce1-4072-a815-4c8ea7dbe298", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0c7715-40e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777147154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147154, "uuid": "a1111132-a23f-415a-90dc-6e0aa1dc47f4", "comment": "Malware payload", "value": "a78ae73b08854b91dd84278272b2d274", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147154, "uuid": "f3f80e4c-0974-4a9c-a75e-32e5f02d059c", "comment": "Malware payload", "value": "39c8861f7d6b985bd8c03e05e78551cb82f38ffd87c9efe68ad5c12921095173", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147154, "uuid": "b3d9e2e2-b5cd-4169-b1b8-97446f90b828", "comment": "Malware payload", "value": "79da8332f6d0f0299d5a896e37cd85494798f5f9", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147154, "uuid": "477d3d8d-a79f-404e-8302-e94a0c4bc476", "comment": "Malware payload", "value": "c187de3c71f7865d248afcd41ff9081d985f56565ee2d35a218a4f6d4fe9e432dd879c9b7dd9fd9dc4512fdc5940aaef", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147154, "uuid": "384339cd-1769-47e9-a302-05f5861ce8b1", "value": "T14E652330ACA528BD131C872DB4DF5DA947FA4E63DC9892FF57B05AC7284E311C54B8A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147154, "uuid": "0db4be44-e8b9-4968-8998-2afde3477c8f", "value": "24576:KR45BqUGn7/h+G5aEIABgYBMOBxYd64YuHTfJXaASf1vV7kAaIi76fssXI6h22zz:KRXnLlIgOHz0obMY6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147154, "uuid": "055f7c12-80e6-44a0-9b4a-52a197e1d4af", "value": 1490817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147154, "uuid": "4524c3a8-cdc4-471b-aac2-b27d11a29abd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147154, "uuid": "b14b3c42-c00f-493c-b478-ca4c46024796", "value": "XYJJ5ECH.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47302465-40bd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777131711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131711, "uuid": "4a8c9c5a-d765-4e8f-864e-e19bc9845a3e", "comment": "Malware payload", "value": "5f8dccefc2d6985c276b45d8f0162c85", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "runner", "colour": "#37EA1E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131711, "uuid": "650188a7-e6b5-448e-8de9-cec22beb7118", "comment": "Malware payload", "value": "3a0495109c263b73e43d6faf88eb6817d375e79414212085eb2eb063d969598f", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "runner", "colour": "#37EA1E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131711, "uuid": "55e118cd-9e9b-4b0d-8e69-e369fe2facaf", "comment": "Malware payload", "value": "077c00aa406f2e0315ab7a250de3dbb0a95674c3", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "runner", "colour": "#37EA1E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131711, "uuid": "f4be2bf3-b922-4021-9e72-d32e9de33d0b", "comment": "Malware payload", "value": "cdd2118cc070755466013b53867077bf4c2a95d776481b325e45332c5acd23819644ad258d581e0f1e0a28359ea886a2", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "runner", "colour": "#37EA1E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131711, "uuid": "7392fc6e-9c3c-41fe-8a18-aa7644ac82df", "value": "T11F5733BED8B6269BF83FD630C634C945AC6B7D248D025A191724B346A5F37C020BDADD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131711, "uuid": "feb3a8aa-e737-4b7e-82a1-b40fe17ce9fb", "value": "786432:HeCBQwPuPoihVt1icJYvDrAKdo700GykZ5EMf1OVRzS2R:+Cq+uPoiCcJlCo4ykbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777131711, "uuid": "ca2d617d-9adb-4c34-821b-0c7a97fc6433", "value": 29577216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777131711, "uuid": "d083228c-e03f-42e8-a544-34e1b02c2285", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131711, "uuid": "7eb371b0-7cb4-453b-b8d3-6f9a0e6c56ac", "value": "FN New.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e361fb2b-40e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777147435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147435, "uuid": "78bc1c0c-e049-494a-bbdc-26d8f6538a33", "comment": "Malware payload", "value": "9faa35ce169c5393e21461c21807c19a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147435, "uuid": "407a4290-cc4d-4b92-8815-83e266177ad1", "comment": "Malware payload", "value": "3c19c3c22ce6b83e80bba492f339e0a2053e868702b09e60d2f3dd58bc98735c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147435, "uuid": "8c09fb48-28a0-43b5-b7f7-2ddc61b42fef", "comment": "Malware payload", "value": "cba8b5c38d66fe31af333a939f3a3cecd4b92835", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147435, "uuid": "4ab0ecbb-6864-48d2-a209-695ee739dc92", "comment": "Malware payload", "value": "94a21c25e90b8e67f0a6db36055278d7ec5655ee3ccb2629b4b7a9ea215363ae50ddab00268e50ed3b42c286defb4a7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147435, "uuid": "25f94822-f183-42ad-a403-b3a4540ef36e", "value": "T12EC35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147435, "uuid": "cde5fe1c-1f6e-424d-9144-57ac37634534", "value": "3072:3atpsoRNjmj1VGCr75MoS9SrPwVrx5tiyew:VoRNjmj1VGFVrRiy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147435, "uuid": "aca50daa-5f25-4c84-b3ba-5696b1c669f2", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147435, "uuid": "ec8088fb-4155-4da9-b916-5fc5d7f0ecff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147435, "uuid": "aa60725e-e8fe-44d7-9bd6-ab82dd2016f9", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ecb2db-403f-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1777077584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777077584, "uuid": "416e2d2b-d8e6-496c-b5a6-b9a19dac0434", "comment": "Malware payload (ValleyRAT)", "value": "2b4fb87793ac977655a9fb0e096ddab4", "object_relation": "md5", "Tag": [ { "name": "43-154-90-28", "colour": "#866172", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777077584, "uuid": "15fc97da-84cb-4a4b-b0f0-d84fe4aa0e20", "comment": "Malware payload (ValleyRAT)", "value": "3d1919406149de7dd0d200415e6215bc88c7c44034712ecd3d2055578f9bb785", "object_relation": "sha256", "Tag": [ { "name": "43-154-90-28", "colour": "#866172", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777077584, "uuid": "3ef49b19-8120-4f0c-98e5-90979bf58f52", "comment": "Malware payload (ValleyRAT)", "value": "281da1783c3434231dbeaf87713a1394a6830111", "object_relation": "sha1", "Tag": [ { "name": "43-154-90-28", "colour": "#866172", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777077584, "uuid": "af4226a1-d3d7-48be-aebf-0d22a2eb2da2", "comment": "Malware payload (ValleyRAT)", "value": "a71cf964733756a499206ed66bc23642da315ca41ef8f2d40802cb33756bf9868ce3fc3f7932a65a926438f33142373b", "object_relation": "sha3-384", "Tag": [ { "name": "43-154-90-28", "colour": "#866172", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777077584, "uuid": "b13d1d40-344c-4dca-973f-1b130a1b87a2", "value": "T1B076223FF28B653EE06E46363A76A120583B7B61A5138C56D6F4C48CCF195B01E3E786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777077584, "uuid": "3d85e165-b618-4391-8a3d-10c8ea8ba533", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777077584, "uuid": "35040527-22ce-4ff2-9547-289bd91a0162", "value": "196608:Db/10xloYw9lkVpqHdg+DxqKZfKhvmIt4b:DJslz/I++DUK8jtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777077584, "uuid": "2e6004b2-5622-40fb-8f53-83dc12c9ae6f", "value": 7391113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777077584, "uuid": "5290a77c-bead-4d05-8677-882b59dc61f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777077584, "uuid": "d9c0890d-9aa6-42ce-a997-bafc2455db6c", "value": "OOOO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a11dca7-4088-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1777108872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777108872, "uuid": "abb229e4-32a3-47b2-8946-4462f6e4bae5", "comment": "Malware payload (NetSupport)", "value": "da72e25539ac1953fc2e60a3c7843457", "object_relation": "md5", "Tag": [ { "name": "185-107-74-215", "colour": "#13E1AE", "exportable": true, "hide_tag": false }, { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "bksju-com", "colour": "#DDD9E4", "exportable": true, "hide_tag": false }, { "name": "bksnb-com", "colour": "#0FE618", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777108872, "uuid": "c2f8882b-569f-4698-b812-5a38a346995d", "comment": "Malware payload (NetSupport)", "value": "402117805475da1877a5afb0a70465472c2df8d379182e67c5a48a8c2faf1335", "object_relation": "sha256", "Tag": [ { "name": "185-107-74-215", "colour": "#13E1AE", "exportable": true, "hide_tag": false }, { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "bksju-com", "colour": "#DDD9E4", "exportable": true, "hide_tag": false }, { "name": "bksnb-com", "colour": "#0FE618", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777108872, "uuid": "bee82c79-527b-42ab-a6bc-07f64d7d94f8", "comment": "Malware payload (NetSupport)", "value": "44fc57cc4ed9e71735c5704272c1722128f956f1", "object_relation": "sha1", "Tag": [ { "name": "185-107-74-215", "colour": "#13E1AE", "exportable": true, "hide_tag": false }, { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "bksju-com", "colour": "#DDD9E4", "exportable": true, "hide_tag": false }, { "name": "bksnb-com", "colour": "#0FE618", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777108872, "uuid": "53a341dd-8eee-4f00-8c3d-05b5066a624e", "comment": "Malware payload (NetSupport)", "value": "7e1fe3707cfd58012d6a30476970232fbcbf761e0cef67ba7c66fce701f8673cbb66ff35b4a650a61a8f7d7d800feea5", "object_relation": "sha3-384", "Tag": [ { "name": "185-107-74-215", "colour": "#13E1AE", "exportable": true, "hide_tag": false }, { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "bksju-com", "colour": "#DDD9E4", "exportable": true, "hide_tag": false }, { "name": "bksnb-com", "colour": "#0FE618", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777108872, "uuid": "d88c075c-ac06-4239-840d-de867211b88d", "value": "T19190024475BEA235127489517A940806CC4F509070945B6E92076596C7021292269600", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777108872, "uuid": "3fee2c80-8ba9-4a81-b976-5f4156a74d0d", "value": "3:rhqvrCgNsh4iRKOKCen:Nqegg4ivZen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777108872, "uuid": "2b92d410-d71b-4d0f-887c-66f6ae040a3e", "value": 54, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777108872, "uuid": "7004992c-2f93-4433-a314-45df9dbde50a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777108872, "uuid": "99c37bde-c6d4-420a-8db2-3ba4ffa50e6d", "value": "185.107.74.215.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdca1d3b-405e-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1777091215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777091215, "uuid": "f0099e91-8595-41d3-8900-75963d6b927d", "comment": "Malware payload (PureHVNC)", "value": "135eef91c6f0f2bd86a64e578f3c7890", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777091215, "uuid": "00302fb5-2af7-4407-ad0d-1f816a1e5b58", "comment": "Malware payload (PureHVNC)", "value": "40954b27b8d9c5affe5035f26727cf48ddbc3479cc0aefa75f4394637534bb57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777091215, "uuid": "681ac3b1-8f26-46f4-9feb-d7532b551ba4", "comment": "Malware payload (PureHVNC)", "value": "22320c3b02d715157603fc567cae624f5cb82f5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777091215, "uuid": "49af08f7-b487-4a0b-bfa2-cd0b5e459d28", "comment": "Malware payload (PureHVNC)", "value": "d738a351cdcce69c783fb13452e98b3f1c21670eb3dd56c3f04524a32474d0ad5cfd5058d7fd90563fba1c1083dfb9ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777091215, "uuid": "34ac0204-66d1-4c8a-ab12-7d9cb0b2cbba", "value": "T1C9B4125E61C3FCABC6822372FD7613775EB195AB10A1CB4303A4269AFD227439D16783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777091215, "uuid": "99d34c51-7eea-4387-9315-731ea327330b", "value": "9a16e282eba7cc710070c0586c947693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777091215, "uuid": "d77c8532-4628-40e3-8c2c-f9e307929ade", "value": "12288:GYxQ7SCgRvReAxJEJZf8l7dHiYVVVRfdzl:RxZBvRDssBCYRPzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777091215, "uuid": "3f63f82c-972c-479d-9a88-47b7e86b5969", "value": 532617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777091215, "uuid": "605419ea-c83b-4e51-8e08-4de91b903aeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777091215, "uuid": "5e50aa45-5dec-4437-a6dd-d7c7598db99c", "value": "SecuriteInfo.com.Variant.Tedy.947919.13115.16471", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a8b7ad9-40b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777129032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129032, "uuid": "f762ddd5-e184-4fc8-a226-9f8a05059ea9", "comment": "Malware payload", "value": "eda0032ee3f4d3258436cd6cf7f09b54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129032, "uuid": "49c55d73-1fdd-44b7-8797-76b3811dd4c4", "comment": "Malware payload", "value": "40cb80b65c3f0dc8cfa6eaae51a475f79f0b8bf9a1406e3a5eed6b46f6c35a65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129032, "uuid": "b685e9d1-4841-49fd-ac6d-db00be81c7a5", "comment": "Malware payload", "value": "a95ecef7ca9bf6ca6a1915b7f6325d209532b4af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129032, "uuid": "26a13750-97f3-4d44-bea1-9cd321d75196", "comment": "Malware payload", "value": "bf37d43bd877fff4b024fc887e6d4abd8990ee5e332c6ab500d0e9a0ab259d919366262399912da0f2d9559c3048b341", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777129032, "uuid": "14b83e97-8402-4313-88bb-8fcc9e893e9d", "value": "T13807AD77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777129032, "uuid": "cb6fb93e-5b8f-4cc0-9162-4ee7b6301bd9", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ9:cqYUQuVDt0TZEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777129032, "uuid": "f4d90cdd-215b-4a09-97e9-202cdce779c0", "value": 16809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777129032, "uuid": "277573dc-bcaf-4eff-9582-8a90719ede20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777129032, "uuid": "f2b212b9-046d-4fa4-8336-7ad42107f2a1", "value": "40cb80b65c3f0dc8cfa6eaae51a475f79f0b8bf9a1406e3a5eed6b46f6c35a65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b636ca7-4088-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1777108954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777108954, "uuid": "ca6f84c9-0e85-4145-96a5-8d6dc7a289a6", "comment": "Malware payload (NetSupport)", "value": "d6934597e79a320a80c14e26640ba943", "object_relation": "md5", "Tag": [ { "name": "185-107-74-215", "colour": "#13E1AE", "exportable": true, "hide_tag": false }, { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "bksju-com", "colour": "#DDD9E4", "exportable": true, "hide_tag": false }, { "name": "bksnb-com", "colour": "#0FE618", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pw-grenworls", "colour": "#11A8BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777108954, "uuid": "f110defb-bbba-437f-9c7c-54d47fd6a4f1", "comment": "Malware payload (NetSupport)", "value": "41087db3ad012fdc2d19ce04b4cb14d6dea11e6f1fd905027f638654f3745cc6", "object_relation": "sha256", "Tag": [ { "name": "185-107-74-215", "colour": "#13E1AE", "exportable": true, "hide_tag": false }, { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "bksju-com", "colour": "#DDD9E4", "exportable": true, "hide_tag": false }, { "name": "bksnb-com", "colour": "#0FE618", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pw-grenworls", "colour": "#11A8BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777108954, "uuid": "bc37f84c-26cc-4d16-812c-8e46dc2ce814", "comment": "Malware payload (NetSupport)", "value": "5887fe8162ada6d86abdcab4841e53e29732e0d0", "object_relation": "sha1", "Tag": [ { "name": "185-107-74-215", "colour": "#13E1AE", "exportable": true, "hide_tag": false }, { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "bksju-com", "colour": "#DDD9E4", "exportable": true, "hide_tag": false }, { "name": "bksnb-com", "colour": "#0FE618", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pw-grenworls", "colour": "#11A8BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777108954, "uuid": "f5a34558-bf26-46eb-aa52-09b94a3a6ea1", "comment": "Malware payload (NetSupport)", "value": "bc1318243edf1da40e105601892897f0869b28efece71aa0e5e1e69ed04d0511b713261e59cba7aebea07aa4b9c1ffd9", "object_relation": "sha3-384", "Tag": [ { "name": "185-107-74-215", "colour": "#13E1AE", "exportable": true, "hide_tag": false }, { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "bksju-com", "colour": "#DDD9E4", "exportable": true, "hide_tag": false }, { "name": "bksnb-com", "colour": "#0FE618", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pw-grenworls", "colour": "#11A8BF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777108954, "uuid": "8f381d48-7d9e-430a-93b2-dd5a466f1578", "value": "T1AE65331A4D41ADE8E5DC9A886D0E8BF726821C2D903003E49F6F7E5E7502F1E869777C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777108954, "uuid": "aa57240c-f4f7-44b6-b4fb-40e05bf0e5f3", "value": "24576:3LqHwSlyL5ERKDlJ5WB5Bl+rkL33yUY6TXKwNg0i1lMQ5JAAZ8+2vbFaq:WHREqgw3l+r4xFQ1Sw+7RZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777108954, "uuid": "38fe4d68-385d-43c0-8e3c-cf8194c3b151", "value": 1506286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777108954, "uuid": "171658d2-945f-48a1-973c-70a47878a88a", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777108954, "uuid": "b01d96c6-43e1-45c5-a599-9a503ccea666", "value": "altera.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e07d443-40e2-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1777147721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147721, "uuid": "76dcd5be-7bb7-4fea-b7c7-2f9d5c3c3d8b", "comment": "Malware payload (LummaStealer)", "value": "7a5b14cfca712cf96c1d7daf91859404", "object_relation": "md5", "Tag": [ { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147721, "uuid": "81fcde18-4124-4498-a117-9b4d35baed3b", "comment": "Malware payload (LummaStealer)", "value": "4162f73e003955984db654daa5e75cae8dc1f0446ff8f137e8b9ef4064b8778e", "object_relation": "sha256", "Tag": [ { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147721, "uuid": "672c9875-3a3d-4fff-8cd9-26c4e4013931", "comment": "Malware payload (LummaStealer)", "value": "177df25e64cf7c82f57f218d25ef582aeb8fd5d1", "object_relation": "sha1", "Tag": [ { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147721, "uuid": "a203b0a9-7ed9-49ae-b00b-d3f0d38a314b", "comment": "Malware payload (LummaStealer)", "value": "5ebc531a00b2d3f16352ba20bef1b85f48e2cd0d2c41c570e63f26b3ecd76fb148d6c1d5cf9f44ed9466610c85b048b5", "object_relation": "sha3-384", "Tag": [ { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147721, "uuid": "cc7102b6-2937-45cb-bb84-320073d23752", "value": "T159747B86E7BB54B0D58B0938255FB33BDF3416294328CEC7DBF0DA4479672E21536A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147721, "uuid": "2053f4a3-9ac6-4730-b034-1b75755db73a", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147721, "uuid": "5c2e0bde-2062-488c-a3ca-ad39ddaaf9f9", "value": "6144:XvgEeOcmwvEL7fF1jTA659HSC8AVtZ5XlOHaoIhEFydst:/8OcZ07bf0OtDlOHaoIndst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147721, "uuid": "3f4a0d71-134c-4f59-ba4c-1e28dd1ecb7a", "value": 345600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147721, "uuid": "ceb01e9e-5a3a-4933-a8ed-9fcc2a856c11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147721, "uuid": "13ad3968-162d-4e63-85e2-b6804e46bcee", "value": "Build(2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8af9ff-406e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777097979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777097979, "uuid": "d142a1e5-73c4-4a55-8725-2a23c34f8cb8", "comment": "Malware payload (Mirai)", "value": "046d680cc89d43e750313fa6e8efc8ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777097979, "uuid": "1799a718-06d2-4001-b3de-f98027eef12b", "comment": "Malware payload (Mirai)", "value": "41d63ba68c9afacb761887340de39b39ca66df013ec0eb6ed279279ca901958c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777097979, "uuid": "37b37067-1318-43b8-b347-4964c8320af0", "comment": "Malware payload (Mirai)", "value": "2d12a523c0dbc706d2f7b4d24272c9357858d3f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777097979, "uuid": "3c5fcf70-03b3-4370-873d-f57bb69c4b40", "comment": "Malware payload (Mirai)", "value": "bef9d729fb344754b995d142e540aa58a31e0f16ca53fb2236450ad37f285caa4cb5c317784f9e959507f4f79ff90e54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777097979, "uuid": "e0e0e474-e1d4-443f-b132-a52e702b44e6", "value": "T10DB45C03EE94947AC0C6C2768FEF8227E774F4AE2338752B1756AF516D05E90DB0A391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777097979, "uuid": "60ef4a75-ca64-4569-9146-57cbd9e94010", "value": "6144:2FiC9DVwXFjnmHFuMo6FShjKxk7KYGt41nwohRuTdINE7sl:Y7krjOwwohRuTduEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777097979, "uuid": "34084a7e-ea56-4697-9ac0-3a367ef1a49a", "value": 513064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777097979, "uuid": "704e84e0-d031-4351-80cd-1c94f767e2bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777097979, "uuid": "2c410ac5-11ea-4dd7-8e19-88bb5bf6448c", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35897eb-4073-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777100083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777100083, "uuid": "b5bdb160-256f-4460-ab3f-6a016b86cbd1", "comment": "Malware payload (Mirai)", "value": "c1bec8990e0831d384b5cc1b2b15abf2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777100083, "uuid": "0a4e28d6-88d8-4194-a940-36cbff850f18", "comment": "Malware payload (Mirai)", "value": "41e26a1db2f68a2f9215ff63aa60974415e338e121d98c18bc80ceea9116310c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777100083, "uuid": "0c73112f-f925-496a-b211-4bcf891fff29", "comment": "Malware payload (Mirai)", "value": "93742acdc5003af2484711865fd248159a9ea4d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777100083, "uuid": "924aec5c-1cea-4137-9ef4-e2bd017b44fe", "comment": "Malware payload (Mirai)", "value": "71f4e2f94cef3be4066c54a2079a9d7ad7d482e876df33bf7690d38b9606fa68130b048c7583329b19f7e68cfa664a7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777100083, "uuid": "23637b53-f5a1-4b1f-be94-3ec3d52a88f3", "value": "T1B0D41B0AAF541EFBD82FCD3706A91A1634CC685372963B363535D914BE1B90B89E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777100083, "uuid": "47523f2d-07cc-4708-b046-4e7e737260d4", "value": "6144:Zxw6gaUzdOdLnt1omNkOJI72NSFp88K4tV/PClyPTy0tR6Jzgzf5o9PcMjD1:ZxZn11kOO6NSF84tNPCUPOi6Jz2MX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777100083, "uuid": "cc70957d-be49-495f-b2ad-ff1c7b12d08f", "value": 648556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777100083, "uuid": "e01d01ef-2c58-475f-99be-3bbe00bdcf0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777100083, "uuid": "1225b368-5e0a-499c-b1f2-549994b7cb73", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2daaea42-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128661, "uuid": "b4c5511c-96d2-411e-a1b6-01f31960b8c0", "comment": "Malware payload (Mirai)", "value": "3837396128730854e406dcab90b6cfd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128661, "uuid": "433b14b4-a17a-458d-b847-a33a4445fedc", "comment": "Malware payload (Mirai)", "value": "41f7cb6ee12c101ed6c46a36a3d7ff974b6961f81a2cb46cb3dc7d18c3dc3bef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128661, "uuid": "20d8a0b8-9270-44fb-af8d-adf711d2afc3", "comment": "Malware payload (Mirai)", "value": "6eec917231aa21cca34c20a0eba3f7992de42c33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128661, "uuid": "46fa6fb7-cfac-4afe-b2ba-390f1904fc3c", "comment": "Malware payload (Mirai)", "value": "b7619bfcb90875716ee41138f480979f6bdfa82e64e3ba01a14187b344205b15365c82b64a84ab36a967bb54f581bc65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128661, "uuid": "99006a8d-bd6a-4ffd-97fe-a5e7d7be7a9d", "value": "T155A33922B9751D2BC8C4A97A62F34335F2F6479A20BC8A1E7D610D8DFF2564032677B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128661, "uuid": "049b56d3-dc85-4f7e-b022-05973a8b8eaf", "value": "1536:VOyxOT6RwqR3X8GGhWxgIUfqD8tNxPJA5HrbU0s8rtUrq:VBhR1YkiVjJiEXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128661, "uuid": "47ff1b19-6bf7-444f-b58b-17d0e7edc36f", "value": 100139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128661, "uuid": "f7b974c9-fc67-40c9-b4e9-91276e7e47fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128661, "uuid": "ffa57e1b-543b-47e4-950e-853acb1edb2d", "value": "j", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c09718-4097-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1777115433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777115433, "uuid": "13c12944-e95e-4bed-927e-ad9cc258d2c9", "comment": "Malware payload (Stealc)", "value": "6a6a0d620ad332821e88b657409e24ad", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777115433, "uuid": "8d27557f-77a2-4047-975d-6535f538d127", "comment": "Malware payload (Stealc)", "value": "42d874277b3991034945afc2000d0bd75ca1c537dfec4b932e5d626201e14115", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777115433, "uuid": "173bbdf9-2472-4b9e-8a86-29ae5f7b006f", "comment": "Malware payload (Stealc)", "value": "30d0aa8335c1dde80d3dd06fab0c3ca6025bd6e5", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777115433, "uuid": "2982b5d3-5bc0-475d-87b1-d5b6334a851b", "comment": "Malware payload (Stealc)", "value": "b328a7f24a2833a90caca7f88f7c848c1bb2110cb6d334c20273050c90ddf1ab55419aa79e722290e6c0760f2f4db5ac", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777115433, "uuid": "711a107f-0864-465b-bc0f-676fe902ffb1", "value": "T152D6224BBC9908F6C4AA92328D7B91827B31BC490F3163D72AA4B6782F737E05D75354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777115433, "uuid": "80a0eba9-1110-4003-ada0-9c8a47e7d24f", "value": "9b763104e1c7e7b7334a1e9ed4235cd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777115433, "uuid": "307ce868-d970-49ba-83bc-28bccd9c3392", "value": "196608:MP8C5b8dG/LbyP37XHZkfrxWeKnDSiCOBerWDnN9Ysn7ggG+CM+YviJTy:MJgsTbmzgrxWesDsOBRXLoTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777115433, "uuid": "ba85bc4e-9878-47b6-9777-dedc74896411", "value": 13000192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777115433, "uuid": "7ae7faa3-1e12-475f-a263-1c4ba562b7a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777115433, "uuid": "f9cb77a0-5e70-4c41-924d-e8c1d13f0c3d", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13827650-4049-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1777081802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777081802, "uuid": "68cba84b-2c3a-4fac-89e7-3817beddcbb4", "comment": "Malware payload (MassLogger)", "value": "c895576a10640599287ad11e1b4f2dc1", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777081802, "uuid": "ce20d7f8-6ba8-4cdc-b2e8-9753ea29050d", "comment": "Malware payload (MassLogger)", "value": "430db4a8d31d11fa0d1fbca809061988adde96754a2594b4abdf474471fe2c18", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777081802, "uuid": "0a970b6b-6192-4ab2-8795-a9894f1180a4", "comment": "Malware payload (MassLogger)", "value": "c7e7e16397a2b21aef9b48d0534c45bf87a04764", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777081802, "uuid": "d7dec137-e723-461b-a4e6-e06c36d7e492", "comment": "Malware payload (MassLogger)", "value": "2dfbcb618749a39bed339c9cb1e87fcd0da4cb0e786e83a73a70845dca9e63f16caf0f246877e79cf49258e6c5abb40b", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777081802, "uuid": "8dae95d1-2d47-45e8-a094-08bfba3c944f", "value": "T1F34533A0A7F128A854C88529A23F9C5E46DFAD55C13C36B6369536DB2F0BDC24F47C32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777081802, "uuid": "8e3345db-13bc-4ba8-8097-a461b854a451", "value": "24576:12wtPO86hPvO6EPj6wT0fMesn2zpJpwnLsTNYzKGA95QlrYORL+AFBcC:AKr6o03sbzK36ukcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777081802, "uuid": "c11801ec-fed9-4c90-941f-daa53b23e435", "value": 1181977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777081802, "uuid": "924f9293-eb05-46f1-9cd3-aa427452875f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777081802, "uuid": "890116d8-3624-4a62-b366-2056edebd2b0", "value": "ps_xqBxSgq3Gb8e_1777018369901.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4caa28f6-40b8-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1777129572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129572, "uuid": "89e499a1-fbb0-4675-aed0-abe769b7d733", "comment": "Malware payload (CoinMiner)", "value": "83517e5c8c55f7ea31e5032ba30729e1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129572, "uuid": "c7612859-4ff9-4b21-8570-88a93748876e", "comment": "Malware payload (CoinMiner)", "value": "436753b45e06f5025304e6d07ebf7a5aabdcfe471c8c056d92316a3227ffc92d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129572, "uuid": "258e3abc-6333-4ef4-b3e6-a7a2c43ec58d", "comment": "Malware payload (CoinMiner)", "value": "89ae71a147bf397353578333dc62108c7a849e76", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129572, "uuid": "bac8e773-246e-43c3-8cd8-946ef1dc9525", "comment": "Malware payload (CoinMiner)", "value": "3b869b8f1c613bc1aef823c72b2a08149ed1c6ee2f7b0d0158846db5016e9d7b4b9994d41394ed3875731fe2b182a6b7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777129572, "uuid": "9b047716-105b-4aee-a8de-690f149e2903", "value": "T196679E49FC1E7462EECAB2385B1553A53239BC80DB42C26B7615B73CA5F37D4CB62260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777129572, "uuid": "82b1ae95-00cb-4996-8b8b-45d7be3032aa", "value": "786432:zL7XapUX5cPK1r4VkAMhrbYLLqVMeLxXyxFXfZ:7apUX5grnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777129572, "uuid": "d92bc7e2-7618-4842-ae61-e4f1c9e51f8d", "value": 31129784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777129572, "uuid": "ec338bab-c94d-4207-b3a2-03ae63c76048", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777129572, "uuid": "6520ecca-9b31-4c0a-99bc-f8894658f218", "value": "vca1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a3e1bb-403a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777075612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777075612, "uuid": "e029457b-69c4-4734-bf06-30d087b5b3a3", "comment": "Malware payload (Mirai)", "value": "9b8672c9460c186fc5588b6e9e1d04d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777075612, "uuid": "9450d990-a809-4773-837f-7dc26a03ce1e", "comment": "Malware payload (Mirai)", "value": "438e2c9db600829bea4b47d14811f254cfa77f6702e1d4490a4ee4a7862506b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777075612, "uuid": "77b6db89-b06f-48b2-8029-4b3ab85443e5", "comment": "Malware payload (Mirai)", "value": "8525625e81e79219f44dcfdf17f1afb3c1c03049", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777075612, "uuid": "840b8d1e-ad44-4339-a80a-0249121ed500", "comment": "Malware payload (Mirai)", "value": "4e254da39d1c79e07642d8eecd97b1a0a325386579dcaa949ce6291e951d66957660802ed30c0a245de7818c69a3e3b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777075612, "uuid": "b544e921-5447-4fe2-b649-73bdd8337659", "value": "T12704891D6E228F6EF668873147B74925976C23DA27E1D644D2ACC1106F2039E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777075612, "uuid": "27528ba6-473d-4696-a8a9-5f51e084e159", "value": "3072:q34LXksg2UP1lSiK8qiASFtLPdsa/8oSc:q3IXmtwXSbPdCol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777075612, "uuid": "5c49a614-1220-4059-ae0c-75e073fc39dc", "value": 173752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777075612, "uuid": "457e23cd-a004-42d6-b60a-d69a7e51d050", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777075612, "uuid": "8bdbe89c-62ba-4744-b975-0ea4cec2ba1a", "value": "jew.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f754ffc-40a2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777120209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120209, "uuid": "aae6623c-5912-478a-92f6-949cd494ea26", "comment": "Malware payload", "value": "dd4da10ae4715afda175be4e1ea350e5", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120209, "uuid": "661ed925-2934-4c6f-94df-cfded44a064e", "comment": "Malware payload", "value": "43d537586dc057fa72041aeac45ce51090b9da43bf513f8515d9db46f5f26bd1", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120209, "uuid": "0f9db78d-b30d-4119-b4eb-557bf118e4fc", "comment": "Malware payload", "value": "1e16b747bfe4c972eca6e6c6f06a27d2c53b6b71", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120209, "uuid": "7bb7594f-6e1e-403d-9a2b-5ee4702b1d2b", "comment": "Malware payload", "value": "e06967db64fa2755633059d16129239904699ab231853f673789225c486d6ebe9b0a00fb711735666a63459886b36a25", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120209, "uuid": "bebf5da9-4122-4ec0-b7be-0640019a7b66", "value": "T133D3C0CF898EC8DC861BA518025F6C27C59791634A1DD5917DFEFE863F32EB0606A8D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120209, "uuid": "3542f390-6872-4a41-8a0f-2e2667af6085", "value": "768:Mc/nOWDkWNHpE1t3vdR7lmEF5/aJL+QoQhQh1twxD6N0XOxxY8Hc5TQiMcnOs1Zk:NRMBBsvs8jybgjSke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777120209, "uuid": "a35f28c3-b62c-487a-b328-df8e5b10349b", "value": 135522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777120209, "uuid": "b225e9e8-9d49-4375-89aa-3c1deaa8051e", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120209, "uuid": "ef2cd45e-9a69-4c69-ac56-d6181870c1e8", "value": "Research_Config_Backup_9064.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8433c2b-4044-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1777079905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777079905, "uuid": "f60b746c-321e-4b38-8d9b-a73c5da2a8a3", "comment": "Malware payload (LummaStealer)", "value": "1ba4245c8ac3d86546ad6df88b9f6b14", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "RaccoonClipper", "colour": "#A869B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777079905, "uuid": "289224be-8759-42fa-8bed-8023da75aaec", "comment": "Malware payload (LummaStealer)", "value": "442f212e64ff3920baeb9e6823f59d6f2c12c5e34f244a23b6275cf856753e01", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "RaccoonClipper", "colour": "#A869B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777079905, "uuid": "feb1a6bb-1bd1-4c2b-b3e7-2adde3516e80", "comment": "Malware payload (LummaStealer)", "value": "232c561284f8d76b88bd818d70b8ced4b9e08f81", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "RaccoonClipper", "colour": "#A869B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777079905, "uuid": "cd297d1f-8687-4256-8573-17836b086991", "comment": "Malware payload (LummaStealer)", "value": "659d6990072d5684acccd312869c2da70bc8bbef7f0df6fb05daf2fd7e0f8c0af5c2ae0028ee42fcbe2567baa385ccb9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "RaccoonClipper", "colour": "#A869B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777079905, "uuid": "5ccaa605-36af-4552-9cd6-4a4425648e0d", "value": "T1A2450900EDC754B6E516133299F762EF333598090F339B93EA447B79BA7A2D12836316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777079905, "uuid": "c0b1eb5b-9fa5-49ed-b712-0652be11be41", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777079905, "uuid": "7cf0fb87-df76-4965-a326-0e95e0179996", "value": "24576:6yiERyf0ZgQvLuc8tlHRKHld9LKhFttEFC2YQThzlDZXEGKEuoCTFHfhD/d8IoHd:6UAwQxlglDZXEGKEuoCTFHfhLkb9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777079905, "uuid": "896dc0b6-538b-4c48-bfaf-9c897f8e4e98", "value": 1187984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777079905, "uuid": "c1bc8bb1-9b79-4a70-bfea-3982a8c9c946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777079905, "uuid": "4a63da0c-9712-4d1a-bf40-f0a495903332", "value": "eGlxCaft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef488de3-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1777128986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128986, "uuid": "05af0f1b-6d38-43d7-87da-f9b3ea2a42a3", "comment": "Malware payload (Smoke Loader)", "value": "b80700935a4ef074810583dd7e093c78", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128986, "uuid": "aac5b74f-e2f0-409f-9e1c-6532812eabc2", "comment": "Malware payload (Smoke Loader)", "value": "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128986, "uuid": "b70d974d-bea1-41ff-b9b0-ece5c71fa4d3", "comment": "Malware payload (Smoke Loader)", "value": "b2a22c7c348ab582b21057aac61b020585edce97", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128986, "uuid": "0519e4ba-7747-4596-9916-fc630a1b70b0", "comment": "Malware payload (Smoke Loader)", "value": "329cf0cda22bf86b357f4a2e21c799441764f0d68477b6e64fad56a1a5c6fc8bf5b223da3a6bf209e53cbdfb92a68129", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128986, "uuid": "7c594881-c3c9-482f-99da-07e2ab068532", "value": "T11B45225926F490B6E57A637889F24093E431B0A26BBA67FF15E8C63C0F765D0B031B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128986, "uuid": "937be2c9-eb34-4a3e-b0ee-72335be2acf9", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128986, "uuid": "73eabfd0-e1ba-44d4-8f2f-e053cf2b9cf8", "value": "24576:TjrUD+4hhV9unN2J0dnTffSclEjAEvkJI+jxeT:TjwD+oJunkJ0dujWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128986, "uuid": "58b30255-b1a3-4976-878f-1556576d244b", "value": 1216512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128986, "uuid": "539e6c3c-4747-41ff-b647-a7baad9bee86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128986, "uuid": "1df0496a-4b76-4d60-8104-684f06be53c2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a613fbee-4073-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777100087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777100087, "uuid": "4076cb4e-404c-4d42-a0c8-76c6638c4435", "comment": "Malware payload (Mirai)", "value": "eaa8ef5606337c861f5fdabdfe0c1a15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777100087, "uuid": "a1ead50e-8d89-4197-b71a-0e661ec92f44", "comment": "Malware payload (Mirai)", "value": "455fd8345586b8ef5d6bbdd9e180d91fe886ebc4cee6f59cee4eee92dfee1f83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777100087, "uuid": "9b99b218-b2fc-4206-81cc-b0d9ee4004cb", "comment": "Malware payload (Mirai)", "value": "dfc779162385e26e1f2487917a40bbbd70267460", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777100087, "uuid": "fc05be09-4025-408d-a14f-c933891e4c60", "comment": "Malware payload (Mirai)", "value": "bf7d463b56c9a2231c05bb4cef19096788ee89a11c35c49ce5536e4914c240b4ddefaa70c9133df8e54e45aa20f58495", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777100087, "uuid": "1cafb83a-fb17-47cd-8afe-336b8da4fdaf", "value": "T17A730229A22F4D31EE312F3FABBD8364FFA717B54090555126268F77D7E6001ABB8016", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777100087, "uuid": "96b988e0-172a-4833-9d68-9e4ec44ccd6e", "value": "1536:rhsyhtrEuaiHKuGIS9SwsF341vQ4wvmD+hCfR8AipS/o7gDH+2RHHZKxAwKh6AD2:TjrELMGIS9SwOUvQ4imDrrcvsr+2NQnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777100087, "uuid": "95fc315e-0a47-4a67-9969-dc265e285d14", "value": 79424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777100087, "uuid": "1b733a62-f29a-47e0-af57-822856b95833", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777100087, "uuid": "be9902d9-2bb8-4c3c-921e-c18403e8b822", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e85b9c00-40bd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777131981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131981, "uuid": "6487d2fc-5876-4a9d-aea2-98ab9c3f3468", "comment": "Malware payload", "value": "16ac773d70890b3d3ea327c605502d3e", "object_relation": "md5", "Tag": [ { "name": "agentb", "colour": "#C3F1B0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131981, "uuid": "940e1047-1f2d-4aec-887e-6463291d4789", "comment": "Malware payload", "value": "4560cd8dbfa76f0553a1c75275be48330f3edee1a5ff728f6f414b78454cc380", "object_relation": "sha256", "Tag": [ { "name": "agentb", "colour": "#C3F1B0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131981, "uuid": "e5cd4556-319e-4f92-9c88-c26a2be44746", "comment": "Malware payload", "value": "a35c91b5f44494bb8cfac0a22a6611e7331d003e", "object_relation": "sha1", "Tag": [ { "name": "agentb", "colour": "#C3F1B0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131981, "uuid": "c807b61b-a606-436f-a944-822c029256a2", "comment": "Malware payload", "value": "04ede12e0dc7c857cdfbf629f8aa3b5cad60fcc2388a3e0c7757dafb13c3aef5abe6e8e5adc995b1a4816aed03b2e4bf", "object_relation": "sha3-384", "Tag": [ { "name": "agentb", "colour": "#C3F1B0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131981, "uuid": "13989ecd-3de9-44f6-971c-b56c3773cf4b", "value": "T1CF96528FA2748613C8E263B5B2063572BE2AD435479983777CEDE435319F0BE4A728D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131981, "uuid": "9838b0f9-c008-47fa-99c3-c67aa6b675cf", "value": "5e8396e22fd6519d4a0cc04da5a8b346", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131981, "uuid": "36e1bd59-1af6-402e-b119-64cb3878f415", "value": "49152:sRdZPi//M4Zz5Ev+hzRO+Ek9br2OadP2fMROJpnCHY/wjBGRtg3snDej3uGeTJbx:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777131981, "uuid": "69b62fe0-8159-4080-8d47-1780cc9e2c67", "value": 9312256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777131981, "uuid": "38a06399-deb3-469f-a226-b8bfd972bd14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131981, "uuid": "c2f20b96-9033-434a-9ac9-a51da9ea2cb5", "value": "version.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0568a551-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128594, "uuid": "d0d07ea0-49fa-4826-98ab-1f7c73690c7c", "comment": "Malware payload (Mirai)", "value": "2b9c76c6f41ce6c4c0ffc7f5c933c911", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128594, "uuid": "b04a723f-79f8-4962-9f9d-d42f94895187", "comment": "Malware payload (Mirai)", "value": "45d38797f36885cbc2f80e77ff616e4e5079f9ec7ce0542b82b011da41a2fc89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128594, "uuid": "c012bba9-86cf-44eb-8258-50715980ff72", "comment": "Malware payload (Mirai)", "value": "ea948e3d4ea32328b2a8cb664a3c2926fa8dd677", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128594, "uuid": "e8164101-03d0-46c0-ab94-8af0a0d1337d", "comment": "Malware payload (Mirai)", "value": "3c46e4a658ef496e58a30ee4a6bf25ad5aec5d9590bdb112d1f3859b760a8f0735e33f86149ab18fd4228b9f2f527195", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128594, "uuid": "e4a1dae1-d38c-407d-be02-7905282d1c9c", "value": "T19604C616AF650EFBDCABDD3706E9070539CC941B22A43B353674C528F54B90B4AE3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128594, "uuid": "e9c628f4-a490-4f9c-9132-38befa4bc64c", "value": "1536:j7gUtnpni/FWwJNOw2++BN4WuFw7g06j+jG6dFg9ExIZ7dWylon5/TSn2D/5RLSG:vgUtA/MvLyWu7WFtI1e5/w2H2OC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128594, "uuid": "26a31f68-34eb-465a-962c-f6ba5ce3f88c", "value": 186028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128594, "uuid": "4f4b29e7-6bd0-4aa6-b33f-17029c7392ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128594, "uuid": "a43fdb4f-94c4-4fe2-b7cc-128388377b76", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d13d67-4088-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1777108898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777108898, "uuid": "a92e131c-3950-48db-9439-ebc89c671ea4", "comment": "Malware payload (NetSupport)", "value": "ba1a135c6b264cf1bbec6f79134ca8a5", "object_relation": "md5", "Tag": [ { "name": "185-107-74-215", "colour": "#13E1AE", "exportable": true, "hide_tag": false }, { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "bksju-com", "colour": "#DDD9E4", "exportable": true, "hide_tag": false }, { "name": "bksnb-com", "colour": "#0FE618", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777108898, "uuid": "47b0525b-9e34-486e-9ffc-007cab7fa6c8", "comment": "Malware payload (NetSupport)", "value": "46b7a1b85bcfcf536e6b479a6347150770021839664b1f03117db8a7d22771d3", "object_relation": "sha256", "Tag": [ { "name": "185-107-74-215", "colour": "#13E1AE", "exportable": true, "hide_tag": false }, { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "bksju-com", "colour": "#DDD9E4", "exportable": true, "hide_tag": false }, { "name": "bksnb-com", "colour": "#0FE618", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777108898, "uuid": "c56c9d17-a5d3-4906-8ac5-59c40f1bf405", "comment": "Malware payload (NetSupport)", "value": "4692f3eabb93837f6b2058b62e8b88d6df044407", "object_relation": "sha1", "Tag": [ { "name": "185-107-74-215", "colour": "#13E1AE", "exportable": true, "hide_tag": false }, { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "bksju-com", "colour": "#DDD9E4", "exportable": true, "hide_tag": false }, { "name": "bksnb-com", "colour": "#0FE618", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777108898, "uuid": "cefb07b7-167b-4af7-ac34-242dd1695652", "comment": "Malware payload (NetSupport)", "value": "dcad0c3fbfa806e888def4c41c3c5ccff53077b52ee4aaba74f1f098d26e63ac719d252b9f0ddcce76681f535073ad61", "object_relation": "sha3-384", "Tag": [ { "name": "185-107-74-215", "colour": "#13E1AE", "exportable": true, "hide_tag": false }, { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "bksju-com", "colour": "#DDD9E4", "exportable": true, "hide_tag": false }, { "name": "bksnb-com", "colour": "#0FE618", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777108898, "uuid": "b2551c2c-66fd-4e06-87d7-5b2c24057fc5", "value": "T1D5B5330F764599EAE0EA67B9154F97E31383AC09113003A5FE5EF46C0832F12A577BAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777108898, "uuid": "8d5b4f62-5bca-4a5b-83fd-100afcaa7a2a", "value": "49152:+hBR3kT3c9Db5Fh1iCfq5jk5uN/m7o08z:+B/95H1iCfq5A5uN/m008z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777108898, "uuid": "bb9d5b9e-1d5a-4ba7-b2e8-2af895a52013", "value": 2306048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777108898, "uuid": "ffa07ffc-7b9a-4560-8908-7b6b18a277b9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777108898, "uuid": "e32c1282-568c-4c7a-87c8-cab60fcf036c", "value": "185.107.74.215.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02a9894-4095-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777114814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777114814, "uuid": "be68d61c-b74f-4325-8207-df15c172a8e9", "comment": "Malware payload", "value": "6b8de6fcf1a33bc0c9a4f993221a80c0", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777114814, "uuid": "8016f4ea-3711-48cb-a522-16643e9d8a6a", "comment": "Malware payload", "value": "46d68fa9e19fd3c240e7086c01278d6899145db8f0f1e19696b52bbcc55e5c61", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777114814, "uuid": "9b3435dd-d2f7-411a-913c-db514fd06c84", "comment": "Malware payload", "value": "db7c3f3c31e4b9946912877b66f26158a39e9a5f", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777114814, "uuid": "06030c9f-fce6-48a9-8682-03d9451027c3", "comment": "Malware payload", "value": "772d59e1125efb1c16e18d05ea8640032e0b0efe199a01e8b15ef9d18ba8af656fb42375121421124414526328c4d906", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777114814, "uuid": "5e79a881-3df2-4d82-a442-7f4b39c91683", "value": "T1B65733D8D89AC6CBDD3F98368EF48ADCDE626D890D035525602AF31768F7FE0617A101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777114814, "uuid": "3373471c-44f3-4658-a347-6d62a8382852", "value": "786432:RLwWkNvEoajgK3yGHPR2/APi2o2/lEHZecg8VAs:RLwWkNvhVuy+PR2/APi2o2/luZecg8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777114814, "uuid": "7e7e7cc6-3041-4e23-8e0a-a5cfe3f558a9", "value": 29478912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777114814, "uuid": "397e8c69-aebc-4a0f-bde0-0d8c64e2547b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777114814, "uuid": "3709712a-97b7-43a1-a2c7-c3d68804576b", "value": "Extreme Injector.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b56822-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128653, "uuid": "4a7a505d-0475-49e0-9781-2250aec50e07", "comment": "Malware payload (Mirai)", "value": "296d26f02e9becc63dcad45691628398", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128653, "uuid": "356a52e0-2ae2-4f9e-8bd0-39b8e54277c9", "comment": "Malware payload (Mirai)", "value": "484397b39f890865f1123f7aa9801ebb3a32ef86127db5ee9fe931334a4bc0dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128653, "uuid": "9ac49e17-9cfc-4546-b4d9-36d0aca91a24", "comment": "Malware payload (Mirai)", "value": "9182b19a9acc67cf72353453c51ac2d21580688b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128653, "uuid": "69cfa04d-ea88-4fa1-b709-acb37bf8e425", "comment": "Malware payload (Mirai)", "value": "9054fe4157850db9e0b61bba13984694a4e455679aa1e471b0438c2fd90da1965e3e4fb9946b2dfaec5c7e52d9c55cd3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128653, "uuid": "d26ffe7c-e9e3-4740-b60a-8e1af639c73e", "value": "T1C05165518BE54DBDCCE4627F1A6347687368EF8280C27313430C6D94AE237AD6E22D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128653, "uuid": "41c0e6c6-e966-4db8-998d-71d3451b2258", "value": "48:qKGpa7UrLZGRlP9BuHAAAeTtnAGiBDCB1nr4ezSJp5l:qKGEP9+ncUB1nrBYp5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128653, "uuid": "c41552a4-8f4c-4032-8d1b-3e76e57cdf77", "value": 3127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128653, "uuid": "268c6933-4f07-447a-9472-1794ce6a1689", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128653, "uuid": "ef96fb95-34b5-4d60-8e4e-bd23504a0165", "value": "dlr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ead72b-40ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777139003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777139003, "uuid": "ca5e3323-042b-4951-bd7d-95fd400e04c9", "comment": "Malware payload", "value": "29258f5d43868ccb20d4a9768735bceb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777139003, "uuid": "cf523569-681c-4316-9ce8-5a734ce5948a", "comment": "Malware payload", "value": "4870ba6600e9045baa69f75226dd776c2a9fdd75347855ea2ce036811cdad7d1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777139003, "uuid": "da2c2690-dcd1-4323-80e8-332e6e7d7594", "comment": "Malware payload", "value": "e1f083f07ca420af0d063c5baa8eb28491eda2b3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777139003, "uuid": "79a78e00-bbdb-462a-8472-22e58d9955e1", "comment": "Malware payload", "value": "7e745c3f0e6f514da9260b34334b02cf0a149309b445ce054ab98c584c907103f0a4c64f7851924cb961eb1c5d66a803", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777139003, "uuid": "5adadfe3-7512-4aab-8b00-d83133a44009", "value": "T126A3342CBDAB419DA1A599B165D0004FE8287BFBB70E1B8745C7A3D40E53B0EE478D6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777139003, "uuid": "60d35d7a-8728-4215-98a1-249d87a5f0c4", "value": "1536:HS5F0Rhc+EIDuYhSyZWJv5m4vyKdnxv/F4cPNWkelA4zQ:HS5F0Rhc+EIDuYpId5m4vy01F4cY1lAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777139003, "uuid": "46fb145b-4e58-43d0-8ef3-daf8313dc3e9", "value": 98084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777139003, "uuid": "cc5c82fb-ea12-47a8-805a-0fed8643eae3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777139003, "uuid": "70e9443f-980e-4407-9b17-0fd97b42ac19", "value": "WindowsDefenderUpdater.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e925541-40e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777147266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147266, "uuid": "bd992266-e119-415d-826f-9616f98d9cbd", "comment": "Malware payload (Mirai)", "value": "ec9b62b34f6a33cce820bde489fbcb9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147266, "uuid": "b375d5fe-af62-4698-aa81-d5c63a81e06a", "comment": "Malware payload (Mirai)", "value": "487af1bfb3e90d1acc029407baf98b8276d4aa6a4a252b50d18dff71765c4d30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147266, "uuid": "94cbad92-37ac-442f-85c9-0af6a73b7138", "comment": "Malware payload (Mirai)", "value": "691d962dbf2efb3c4bce41fb8aa0ed26017d09d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147266, "uuid": "55be91ce-a7c3-4402-8d39-fe256aa99f80", "comment": "Malware payload (Mirai)", "value": "01b27bdd06f99f099ae35610d65bb57176bf612b53062cc1d85664cac67b183a5c3f2e2d4fa1a9e1a3d75ba36512dcaf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147266, "uuid": "bc1c1005-93f3-48c7-a674-0b9cef05e6b3", "value": "T13A7312B221ABDDA2D671C03263837D59B933847903B052BE7CBD972FB482E515C4C49A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147266, "uuid": "52ebd413-debb-4417-ad2f-390ee6772764", "value": "1536:n8zRnwvX0/jMQwZuOPFPijvDMwhQi1rYGhQZ9zWmHyorl:8zRnwP0bMQ2RijvDZZ1rYGhG13HySl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147266, "uuid": "8d61e4d6-694e-4eb6-928a-8c196d094ef6", "value": 74772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147266, "uuid": "227e33a0-ce65-4017-a916-10d42c31219b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147266, "uuid": "408ef48c-404b-4fdc-a14a-a8b999cfad1c", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecccff02-40b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777130271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130271, "uuid": "27f99b95-9665-4dbe-97de-6cab5221410a", "comment": "Malware payload (Mirai)", "value": "a8b7fefa6f6337ec31f28ad6c374d0ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130271, "uuid": "b6268e72-cd34-422e-8c23-d115cc33c8e3", "comment": "Malware payload (Mirai)", "value": "48c87a2b07e635d5f5179b0d20d02d07ecea72eb77d0c3c0b8c3c5cdf43a4ec1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130271, "uuid": "67f0796d-7eeb-442e-9211-3eaa2faaeeab", "comment": "Malware payload (Mirai)", "value": "35bfdafca0bb28be17c5f270ad01221ba7f8e67e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130271, "uuid": "09c5db32-51af-4f3a-bca2-88d2f8f04524", "comment": "Malware payload (Mirai)", "value": "592f6c5b4dc3d37bdff03748e00417d38e6313730b493807f58e3ca3891b124a1943a23bdc8138c43950d3378474029f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130271, "uuid": "f061b127-bedb-478e-8d1f-f9d79f3226fd", "value": "T170040905E8144B53C5C32BBAF79F42993B326B2897DB3301EA19BEB42F4679D1E39111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130271, "uuid": "578b4cd1-2a85-46b4-9150-657fe65a7916", "value": "3072:oJFTnVrSLcG75Hxqf64J4VnFKvD7Nt38+eilIRzbhmoknIDjZitsJUjRi3hi:QAUf64SVnFG5t38+5aFmoknIDjZitsJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777130271, "uuid": "1a843c8f-82e0-4961-82c7-2e34d1b81609", "value": 180993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777130271, "uuid": "87e045cd-d263-4abc-9f87-948908843041", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130271, "uuid": "897a9b0b-de0c-4dcf-ba63-7052e6dc5f76", "value": "bot.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a02bceb-40ba-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1777130320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130320, "uuid": "81a90d35-c174-489d-814c-a2d2275255c0", "comment": "Malware payload (DDoSAgent)", "value": "73c0a309739e34f3a696865a15ca8e4a", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130320, "uuid": "6a3d3466-644a-4aac-b337-cbacd6bdd92b", "comment": "Malware payload (DDoSAgent)", "value": "49245b71909266618ebf3394244568ce9dd68ccc455794701f7eff1283e0c379", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130320, "uuid": "964096a7-2602-4e1e-b470-2a99bd1b83ee", "comment": "Malware payload (DDoSAgent)", "value": "90c2c2bff482c786a43ae3e4b8d29a080f78c07b", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130320, "uuid": "5092515e-9652-47c1-82be-5567be460bf6", "comment": "Malware payload (DDoSAgent)", "value": "22a1f16d26eba6a07862097c4cea205a792a85ba646ef1545347808141639e0cecf50dd9e36a049d2637b8b5fb0aa519", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130320, "uuid": "50a3b0fb-f3f1-4bfc-861b-c59c4669f9c4", "value": "T108F32907771C0A83D0576EF036F717F183EBE81126A26240F61EFE846276BB16819F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130320, "uuid": "185748a9-3c0d-4cb1-b9e6-f69477472da5", "value": "3072:ToS9ZxeuW07vxT1gLasdDBZfmHkaNSrxth76XWf8xi:USDxeuW07vxTePd7fmHkaNSrxth76XWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777130320, "uuid": "6f9766a2-d23d-4141-8808-1195030874b9", "value": 166630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777130320, "uuid": "b87c475b-50d8-4d24-b5ee-ffe3f58f87a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130320, "uuid": "34964be1-90c2-461a-b81e-e745a37906e6", "value": "bot.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73aa24d1-40e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777147247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147247, "uuid": "5c7597f0-6b02-4827-846d-8f432909791e", "comment": "Malware payload", "value": "f6f101917edd93297f153217703da70d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147247, "uuid": "413a2504-e933-427d-b3be-0720151ed352", "comment": "Malware payload", "value": "499c47b454b1148641b2128aaa8c76d2c7154ec5111662107ccf0109f532bd90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147247, "uuid": "96f94dee-d408-4232-a7d6-ad3e392cdd6f", "comment": "Malware payload", "value": "8505ebe4c9e4a0ae98058f31d30d477281f103c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147247, "uuid": "9c660dff-9784-4811-b430-3f22f12ce699", "comment": "Malware payload", "value": "b7f511e845c8a7a078b412b90f4ca67aa686eb0665201e307aa965ca58a75aefd996065f75fa1dc4e40b7e7f2c3bace1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147247, "uuid": "2ef9ac23-1ad4-4e4f-b925-16fff4f673e0", "value": "T161631286FFD81FECFCEA27BC07AB61CB2351942550B701A40DD68D89905FEB1518A8CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147247, "uuid": "1d2764c8-fd92-4b6a-ad82-6a85c0b55fb9", "value": "1536:27MbwKNGjjH+Xq34n/q8Zu41zmX3sDg0fM5AHrP1:27Mbp2L+Xqdfoz2s7fMiHrP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147247, "uuid": "98791f55-6be1-4351-a929-20b0cee5f4e1", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147247, "uuid": "5ebafee2-eafe-45d0-8240-146a16e54642", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147247, "uuid": "1f26b5a6-3848-450d-9111-fbcd25bd9a20", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f7944ef-40ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777124933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777124933, "uuid": "ecc74bfe-2a2d-4281-869a-04e36bc4476f", "comment": "Malware payload", "value": "49682145a84034b27525832dbdb20fe7", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777124933, "uuid": "2eb6bf7b-2e9b-45d4-abab-4cd7c118ba3f", "comment": "Malware payload", "value": "4ac9b45c0ac70f9f1e9d863b282ddaf1f1ca214a81a5b7d3bb8ca0a6ef690453", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777124933, "uuid": "7c5a63da-4a82-42c0-adef-215e7d0ba83e", "comment": "Malware payload", "value": "b74d3c8c09cf21b2fe88fcfbd1306d9e40cc16bc", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777124933, "uuid": "9b2ed015-d29a-4eff-b13a-7a23ecfc94cf", "comment": "Malware payload", "value": "feb5fa32a60196c7c7840e5a642672b3a664815fb382e7b750dd7fa96ce2318566dd3b0280d492fada6da67940bd6b03", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777124933, "uuid": "f7650ac6-fbcf-4db7-8275-1e60b9e03ced", "value": "T11F4162F43EF1B5FC288EC4DE9A0C729469751CA6BF2091C89850BC65623B27C598B883", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777124933, "uuid": "d8c0e4d8-9dc4-4b04-872a-89bbb0cc7d3d", "value": "48:kO1W6XOAxvT17J23rXtKulyCbidey3il5sLwCIRYpm/:kO1WEOCTUXcuECbQ+5sLBI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777124933, "uuid": "e0841700-a957-433e-93a4-891d70f39096", "value": 2420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777124933, "uuid": "a46f4443-23e7-4f36-b7cc-d97e55bf2bfe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777124933, "uuid": "903c6d01-1400-4443-87c6-72b0a40a31bd", "value": "zHPWvUqBBt.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf9421d-4095-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777114432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777114432, "uuid": "6fe589fa-8843-4c76-8af9-f9411c6b356e", "comment": "Malware payload (RustyStealer)", "value": "1cc7dfd1b1215fd971dfc16864d09b3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777114432, "uuid": "52be659c-5fc5-4dec-a236-f381d87c2a85", "comment": "Malware payload (RustyStealer)", "value": "4c351350f946bd33db9e87df3ad0dfd9547bb88156318df5129a7438b79d4b00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777114432, "uuid": "58a2c08e-9df2-4419-96fc-4fbeda2726d2", "comment": "Malware payload (RustyStealer)", "value": "5cf4a55d8a51ec7af02105a1f707b92d10252005", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777114432, "uuid": "5d1a45a0-fd92-4bdf-9ef1-f0a374637aac", "comment": "Malware payload (RustyStealer)", "value": "5753a48ed9bd2cf9c49a98ac5e495e3554c1c5422c1c2b0842d530b9b6ae4a4a35b4300ea028e2f5e2aa60cd80806010", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777114432, "uuid": "42e18714-811f-402c-8425-4caddba692fc", "value": "T187151252B55895FCE056C0B8934A5973D97638C90F322AFF068172383E58AF12F39B5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777114432, "uuid": "bb0315a1-88f2-4c82-9703-e25005fb0acf", "value": "e8bebbac382e8f9d628420af78a47536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777114432, "uuid": "be3d462d-1b1f-4dab-aea8-f6ae50dcdc99", "value": "24576:eVBtyk01z+AslYu+4A6X4fym0jZN8rgcN8:eVB4z+Ju46Km0tN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777114432, "uuid": "72d4078a-dbe2-40f4-aa0d-5f962851de8c", "value": 957952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777114432, "uuid": "19763bc8-f045-4b75-a44c-53123a5d8bf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777114432, "uuid": "cc505bdb-5483-43d3-9699-6e00fc871eb1", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f9e1e8-4049-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777081783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777081783, "uuid": "8fab1845-11c9-4267-afbd-4ca53eb3a63e", "comment": "Malware payload (AgentTesla)", "value": "fcbc9cc22d7d8de2042be832993d1dbf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777081783, "uuid": "fad87aab-f7fa-4b02-bc99-d208ad5dce9a", "comment": "Malware payload (AgentTesla)", "value": "4c9d48e9f6419b4a022c6dfa6c4cbb675fa5043df2d5cb39462078c843ac22cc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777081783, "uuid": "5b00466a-209f-4e43-8dda-28c8966b9ac2", "comment": "Malware payload (AgentTesla)", "value": "c7eb239f776a1c1da4955cb2324b4ede6523bc6e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777081783, "uuid": "5d1923e9-31d9-45ec-9901-88d132f99010", "comment": "Malware payload (AgentTesla)", "value": "cf011404125ac5ded74f8f077940786f32e19baa50d5aafbe07f0d92258dd90d095f8ffbb589946d4f11e90a8a25efaf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777081783, "uuid": "4c2e2374-3369-4be1-a8e3-0a75b8498bf9", "value": "T1363523302DFA5F5B225CA30E699F7F1E972A0867C484F44B39F5A7F54B36A40620B46C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777081783, "uuid": "5e10827d-003f-4863-a8ee-f9c9849581cd", "value": "24576:kERk4B23C0J9mnCDC2oybpUaWHPpBzdfhfZzFzM2U9:7V2y0J9mc2BzzU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777081783, "uuid": "56c4b6d8-11ca-4bae-8c17-afe16eb831a3", "value": 1072637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777081783, "uuid": "ac1fdba7-b4a8-4a53-adec-31efd0e40ea0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777081783, "uuid": "4a967a63-c1e5-4e8f-8a42-3b0e695e4cc2", "value": "IX9GT6HS.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a387cccd-4066-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777094499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777094499, "uuid": "3b767505-c9f1-4f60-b3f3-6d5b9f41188c", "comment": "Malware payload (Mirai)", "value": "accc5a8bf7cca8742646fc0f884fc119", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777094499, "uuid": "b96d9f10-1a41-479c-acc0-03b088c498cb", "comment": "Malware payload (Mirai)", "value": "4e34bed7d00ee821e79b58ed6354210fea70f6a94314f9af253434ea0cc2743c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777094499, "uuid": "3611281b-b5ae-449c-a54e-e04ca167d64f", "comment": "Malware payload (Mirai)", "value": "d04f7b2db3549256c519bdc5dd9db96afb33a8e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777094499, "uuid": "fd3d0106-76c6-4d2b-b43a-e5a53ca4200b", "comment": "Malware payload (Mirai)", "value": "9d6edcb0d76705dff0af769992af97ce8d2772592cdeaf0391490b1fce95c5318e0693408ffa0f2f4187c0ac00be8a64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777094499, "uuid": "68a62277-fce0-4fad-b7d9-9c94e95612c6", "value": "T164848613E91584E5D414CCB213673356AC4793BF88A632D3EF5A4AA5FF2481B42BEEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777094499, "uuid": "09df4305-1e81-44ed-b227-67fd40ac98db", "value": "3072:TLmVm5hghe3xTIH2xD1ZXbWCrAjITIMI3Ja0fD4BAJ04v:TCVm5/dV5rACC3D4Bozv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777094499, "uuid": "131b20b1-0dab-463c-9eaa-b50299802519", "value": 390088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777094499, "uuid": "ec5ffdb8-b84a-441e-bfdc-a6492a3319f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777094499, "uuid": "5ddfb996-0b9c-4dfc-8d22-d7d5a0812889", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661181b0-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777128756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128756, "uuid": "5c653545-4bb9-4fd5-8586-8e19b4d2ca54", "comment": "Malware payload (Gafgyt)", "value": "1ef2b8070f36d2dce49e376ed5127fdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128756, "uuid": "b2db1fe0-9a73-436f-819f-4591c17cc264", "comment": "Malware payload (Gafgyt)", "value": "4f2d3089a1af7c9aeee6492cd09f9c012e0420728cc4003725813a4f502bc345", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128756, "uuid": "d08368fe-fdca-4031-a513-bc03781af020", "comment": "Malware payload (Gafgyt)", "value": "522d2691212a34cc411d4824a2c7bd20b46f267a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128756, "uuid": "6328d62c-61e7-4adc-a855-494d928faaa0", "comment": "Malware payload (Gafgyt)", "value": "3db0ce040ad53acecad8194074e812473029c0fe3025197bb1ffcf0de1f358d08c46160710dd333f5d3fd635fc0605d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128756, "uuid": "9d6b6ed8-1dcc-4d87-9ce3-972b0f0e76eb", "value": "T18513E1D3D7B9EDD5C4B6697404520740AC83F4AB98BF1F7B08A82AFC8ED25132B55B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128756, "uuid": "abdfbe46-c689-43a9-8c94-1a588a0ceec3", "value": "768:G1kNnUB9rSwYp9LimpnQoV04lQDVYbgXCfi8q90HW6big+Dx0Vx:B8Swq9LimpVrvfiH0HWsa+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128756, "uuid": "cff95a2a-58c0-40e8-9ff0-c6322d476ba1", "value": 42559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128756, "uuid": "3034a9c3-18fe-4fa5-a218-94c38cecd11b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128756, "uuid": "acefbbf4-68cf-48ff-ab9e-7071f1fcb53e", "value": "a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c410e063-40b3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777127625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127625, "uuid": "c55ab681-9c5c-4cbc-8160-a73094fef4e2", "comment": "Malware payload", "value": "831a0cf0284b9952b6c8fd436ee67252", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127625, "uuid": "e3e10b4b-33e9-435c-b0b3-173fc0863b8c", "comment": "Malware payload", "value": "4fd7eb9f3eccd174d4ca6b66f842617198b1c54b3789311f2cfb34a1c5862c8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127625, "uuid": "c577a792-7ffc-4b4a-b98f-f4621cdf721a", "comment": "Malware payload", "value": "8d0fce774e76b3d3a301c3024cac976c12c0d767", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127625, "uuid": "304dde7d-f12c-4830-a1a9-0675446d54b7", "comment": "Malware payload", "value": "2d0d5881148857877d45f8926100a1ac5ffafa1185d4abcfbe0ffe2f3a11322f52d8496119a2f0110a1b29e5dfb5bdeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777127625, "uuid": "c91093a2-cd29-49f6-9215-50d592cd613a", "value": "T1E485AFC1EB1D9A13D843027A2A47477F223140C44998FDD656B8DBEE6BBB11530BBB72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777127625, "uuid": "54297f2e-79d7-47bd-9cd7-579b883f8cb5", "value": "59cf6205f0d55e08de66f73ba4498e82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777127625, "uuid": "036f7f23-d2b7-4559-9fc9-f4560512fb1f", "value": "24576:/qWPZ9Cdfvfur9/ZnVUDi6dtSKSELN6PBHiEYDK4/5idt2IbODolD9r+iwLFLz3J:NZc75ynVIzVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777127625, "uuid": "0c7c1aed-2d6e-4202-90b6-70bef41e28f8", "value": 1816552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777127625, "uuid": "e6fa18b7-81d9-40fb-a94b-4a78d3cc1ede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777127625, "uuid": "c019a14c-3cd6-4aa7-8f9b-093181e0cbe0", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f91978c9-40b5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128573, "uuid": "7b5cd89a-f086-4cff-bd2a-42f01af16ddf", "comment": "Malware payload (Mirai)", "value": "5662b557ce9a9a66135c1581c76eec54", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128573, "uuid": "57b5f214-24c7-403f-bb68-f24e9a053ef0", "comment": "Malware payload (Mirai)", "value": "5014069a4ebef713b57cb666e6cb334a6bca1ebbdc0270b932e9bd6cf300ae55", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128573, "uuid": "a6b844c9-3a5f-4525-a596-7757a84ada71", "comment": "Malware payload (Mirai)", "value": "975bc7ff0cbae99b02aba02d481e195877de40f6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128573, "uuid": "dcbad702-2ba5-425e-9cb1-5b608c53ee81", "comment": "Malware payload (Mirai)", "value": "c31908c9eb6609d091a60b840c2a2f803ae17e798f8790535d1fef721a334ae1db4d2b0de50266c355d7ca442e7bf65c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128573, "uuid": "86d77a14-1d36-4ebb-a5b8-587f7d6fa5e5", "value": "T1F3C080DB0521731041456C19B165012F5683D51434901F897B953D116ADDA80F026B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128573, "uuid": "b7c49485-022c-41b1-b9eb-bd9c0af77aba", "value": "3:O22exARm4XV3FOdJ2GL9rSe4XqBFS/TWUKT6VVI9LJdvvvF:O252A2GLNSZQTT6IZJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128573, "uuid": "0c0558ff-e9cf-4b65-a01f-f36f46cca1a7", "value": 164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128573, "uuid": "14a8fd23-09de-464f-ac7b-e06f781e11c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128573, "uuid": "7a0e14ef-63c5-4ce4-a530-b924effd9c54", "value": "lterouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51fef27b-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128722, "uuid": "b1b97b62-3666-4522-af2f-125d39510fbe", "comment": "Malware payload (Mirai)", "value": "20f6689c2e99995ad35eaf96a55531b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128722, "uuid": "1e9501fe-6d99-4223-9614-5300c4e1fd4d", "comment": "Malware payload (Mirai)", "value": "50b5a3446251b5289266120c508a0b6950e0e430ed3f468f77e6b18ced372366", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128722, "uuid": "ba7bac59-001c-4fe1-9e7a-7c793280c9d5", "comment": "Malware payload (Mirai)", "value": "2ac55ab576d776d54eb66a98c5c0fb01c8a38854", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128722, "uuid": "7a1c57d8-4535-4f9a-b4dd-8b81a8cec276", "comment": "Malware payload (Mirai)", "value": "94952840ee9bceff92b93ca53b568f1e9b303ae34fb842a7fb51dde763d6ed0accde475fb58944e4ce4d13baddc3a546", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128722, "uuid": "09564f40-7d9a-4230-b154-1ed789414aad", "value": "T187D3725D3E355F3DFBEC823897BB8A309208339A26E1D584D19CE9012E7074A741F7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128722, "uuid": "1ecfb8a1-323f-4389-9ab8-67106ee7ed14", "value": "3072:UFEl9vh0Q1GvDTmvzMVERmPSOh1xD2vexBw:UEl9Jo0qERmPS81xSmHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128722, "uuid": "8fc4e1e6-0005-468b-91ca-42f04918312a", "value": 137880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128722, "uuid": "32811b76-64cd-4d46-b7ba-e060fd31bc42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128722, "uuid": "b9f7e4d2-cd09-4b60-aec9-1ceaeac4195e", "value": "KKveTTgaAAsecNNaaaa.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d389232-404d-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777083751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777083751, "uuid": "be0eac2e-666f-4cd0-8e4a-dbc8dd1457a4", "comment": "Malware payload (AgentTesla)", "value": "0271aea1ea4314b0373304c374809082", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777083751, "uuid": "d97886be-eefc-41ee-b9e3-38fe58f726d2", "comment": "Malware payload (AgentTesla)", "value": "50f00b4b9ade133f22a09996a28c8ee6010c598d61408da185ecf45daabe0fc0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777083751, "uuid": "3ea34517-e927-4a04-8818-a5c835d712f1", "comment": "Malware payload (AgentTesla)", "value": "3a508b1a84b125808634d48b4237de80b279a957", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777083751, "uuid": "2a6591fa-ea70-4b6d-97c7-fcce7c0513ff", "comment": "Malware payload (AgentTesla)", "value": "d9c59ee62b6bd38d99d151f8c4761757fff30843893c62c6b48eee4cbd8544dfe4792f79c8fecd4c1e35f8894cadd175", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777083751, "uuid": "68e2562d-095d-47e1-aec3-d25ec5e62a35", "value": "T1D815232477552FBA46B9C288D4DFA83D05042E655820FAE722761DE7211FAF6D60F03F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777083751, "uuid": "3f6926c5-848a-4bb4-b7db-009335db4060", "value": "24576:aPLhkBatRny9muDFJLdiFJt+lHwi12/5Q/bvAcpoX:qltSmuW6mMbInX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777083751, "uuid": "64be1f30-1032-41e9-b213-272fd1fbb7e8", "value": 952832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777083751, "uuid": "873e537b-258d-4907-9fcb-ae3d3c605737", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777083751, "uuid": "e10b9ac9-568c-4332-ae8e-f41d21b287aa", "value": "ps_irUy3bJKkmsa_1776697552359.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b3fc14-40e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777147242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147242, "uuid": "962a1e75-fc6f-4803-a470-ca4540d3cc0c", "comment": "Malware payload", "value": "2e9ff9b1313761d9a19cfc6889703a0d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147242, "uuid": "83b0fedd-ab60-4bd6-9735-107c07693354", "comment": "Malware payload", "value": "5120ac99787720cf3bdb680552ddeccd2c15dc630dc9aafbd5e61cf3cb5e2a7b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147242, "uuid": "4c8fe3f8-eb01-414b-8db5-33def15829ea", "comment": "Malware payload", "value": "e7f61737513f8b515d2431e057de6c77b2e557f0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147242, "uuid": "d70908a2-ea71-4226-abf4-f7a7214d9c8c", "comment": "Malware payload", "value": "59def6b29bf1f1f79d0a2c40c7bdfa9a3a84fa0709713cdb8e226e015449c2db57b57fceff9af480516332b5e894287e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147242, "uuid": "5d6fc729-471f-4581-a70b-1fe85710a807", "value": "T1125182DB0180EB73F65CC54EB7F0B135650AA0835ADF9A48EF90181E8EC5D4C7296F54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147242, "uuid": "e9962872-b0c4-4655-a8f4-7677eea51807", "value": "48:q6hIOI2JMIByBbiB89n9uZUcUccvyyQJsnsbwLDhVBKx01rOrhM3I+o:6P2JMeQbiBO9uZSsbwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147242, "uuid": "e110000c-d602-4357-b317-ee3a35f98a95", "value": 2907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147242, "uuid": "86f4a19e-59ba-4cbf-89c2-62d28d55a4cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147242, "uuid": "09b1a998-8e47-4b19-9ead-1242e033612a", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c5c9c0-403b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777076147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076147, "uuid": "899d727b-3957-4de7-b7d1-dd58cd990abc", "comment": "Malware payload", "value": "5e5c31b7e447bbf92e690a79c694a156", "object_relation": "md5", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "jdjj-cc", "colour": "#212AA7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076147, "uuid": "da0f307a-1a16-4a14-a3c9-2cb5f10f6be1", "comment": "Malware payload", "value": "5129d1d27201db762096d7798fc330e673a6cf1a6e562e57283758265edc9f6b", "object_relation": "sha256", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "jdjj-cc", "colour": "#212AA7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076147, "uuid": "9bafbd03-407d-4d3e-bf3a-bbd08c18de6d", "comment": "Malware payload", "value": "9a84a440a7c559f85174fda24857676d9ca3595a", "object_relation": "sha1", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "jdjj-cc", "colour": "#212AA7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076147, "uuid": "45918629-a4c8-408f-a3fb-0e5758e7274f", "comment": "Malware payload", "value": "531155295cb877704e89135724d1fdd7f5198f9393dbbf6180f089fd454ccf5adf5aaef7366f9d6420ee1cb7db6f6446", "object_relation": "sha3-384", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "jdjj-cc", "colour": "#212AA7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076147, "uuid": "152189a8-9282-4019-9949-d5738420380f", "value": "T1C0D49E42FA80A1F1E6D9017611BB6F7A4E39A1145361D8C3ABD428F88D207D16B3F7DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076147, "uuid": "78c79cea-c229-4b6b-8630-117c7943f99b", "value": "dd3e349851bb8de3cf4430fb968445ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076147, "uuid": "949116d2-7079-4b8e-977c-5d7f5eb5f98c", "value": "12288:KYwHARUxxW2bYAAVPEiy+P4WZX4Br+Quxeh/QYe:KZHhxLeGw4eyue/QY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777076147, "uuid": "36cbcc75-40ea-4daa-8d73-9029e7012c80", "value": 647680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777076147, "uuid": "d10bd4c8-1494-4985-9603-2de98c34186c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076147, "uuid": "32d16925-d7c8-45ea-a134-db2f2265e109", "value": "XLLiveUpdateAgent.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d28a9feb-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777128938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128938, "uuid": "8b1470d3-6512-41b7-95b3-0c89cfcf57f0", "comment": "Malware payload", "value": "a2c51177f53a7c0314751586e9f45d31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128938, "uuid": "0361d358-6438-4018-961d-d04608883105", "comment": "Malware payload", "value": "51482f5b91c23ee55ebd31afa3f1eaff41ea6727204802cfa28b39d6c6a41103", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128938, "uuid": "5a89c261-04cb-4082-9eca-45043eee630f", "comment": "Malware payload", "value": "82bdc55d606aaf8d8bc434771ff9014b52534cd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128938, "uuid": "500969b4-b8d8-4c62-affe-61aba7ffc1f0", "comment": "Malware payload", "value": "9167a497a1e3de693e5328d05b32315244035405504a76fbd22665b72eaef85112a5df5f9abdedab0007494bcdcd39ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128938, "uuid": "276c9032-2f70-4cfe-9cdd-5e11db20041e", "value": "T11B051946AF903FFFD42FCD3702999B1A258DA94622D57F3A3578D804BA5B10B49C386C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128938, "uuid": "b28fbe84-a452-4a68-b9d8-374fc415c034", "value": "12288:3C8rHzh4r2BIpkYNGHoR0F06S+WT7o0/:3C8rHzh4rDpkYNOo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128938, "uuid": "f3608135-0fb4-4c7c-8696-65d70700f61b", "value": 823156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128938, "uuid": "4a8b0773-54d8-47b1-bbc6-420acaaa9557", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128938, "uuid": "e992c651-06c3-4999-9998-d2d8d2db7929", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "401288d0-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128692, "uuid": "60ec4313-ab28-4bba-8fc8-9fc339cbfe9b", "comment": "Malware payload (Mirai)", "value": "08c92905b36648b789e99240f4159f77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128692, "uuid": "4863944c-b456-4f0d-90ee-524469676ef7", "comment": "Malware payload (Mirai)", "value": "519a53c74248f148f1018433642241af0fc1645353a4f0affd57547267e52838", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128692, "uuid": "7241746b-3a17-412d-80ce-6595db3a2e1d", "comment": "Malware payload (Mirai)", "value": "028b3ebdfd0f6d8857be7ed264e4a91515572578", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128692, "uuid": "4b18007b-51d7-47d8-a57e-3e6eb78a6734", "comment": "Malware payload (Mirai)", "value": "170e72d33ad217bcab29c6c2163c97820b6618b90e6d80729af6aa6b48df879d26a4bab24abb8902cd280156c7f6b2c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128692, "uuid": "a10a1c65-5f03-4797-a5fd-dd6c1758e9f4", "value": "T1E3930749FD406B10D8D635FAFF4F024973934B6CE3FA7201AA245B2523CAA6B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128692, "uuid": "fb32daca-51b5-4d51-b584-21e80d0deeab", "value": "1536:wqnZT8D4zgUdtS0tFbvacgzafVAweBuqKlUI9HiWNRIbT2gZ1YIn:L8NUv5nTacgzafVAwe4BNRIbT2gX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128692, "uuid": "c297d1f0-31dd-49c1-be18-ae7bcdafbba6", "value": 93252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128692, "uuid": "5c4c70bc-de24-416f-9161-da62fe931089", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128692, "uuid": "317c8ca4-29ee-4802-870d-57099720f0d5", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82743eed-40b8-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1777129663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129663, "uuid": "3384592d-b4a0-4209-ab18-7a8476f9862c", "comment": "Malware payload (CoinMiner)", "value": "114b4fd16e4085d6a70fc09b091add97", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129663, "uuid": "41c5c69a-5535-4a50-88a7-eb51a03655db", "comment": "Malware payload (CoinMiner)", "value": "523c29bae61819c500be4eda407515bfcc1044904eda53c9d78e0184f1dc633c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129663, "uuid": "72b8b82f-9743-4bdf-af35-e1cbc09f9472", "comment": "Malware payload (CoinMiner)", "value": "63334918cdb36ee514080dfcb0517a44306aa107", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129663, "uuid": "41e55f92-ba1d-4cb7-ad31-9cd5a9ddda9c", "comment": "Malware payload (CoinMiner)", "value": "0b323109ff15dd5509b9c9395695f2696f8930d0e630bd69c998cc7957577d7f9880861e7a4e40737c3b52ad00117b02", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777129663, "uuid": "5fbbc55c-ee62-4556-954f-c1a6c701520c", "value": "T10797AF49FC1E6866EFC972345A5653A43339BC40DB82C25B6611B73CF5F3BD88B62260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777129663, "uuid": "1e5b4139-18f6-4307-af8c-78c271619fc8", "value": "786432:L3T9apUX5cPK1r4VkAMhrbFfCy6vjR45QSSXfwFSMokMOfQt7j:dapUX5gPSlFZoeYtX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777129663, "uuid": "17a8c77c-e871-4fb9-8940-133a618dc879", "value": 40204663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777129663, "uuid": "7466e642-d25e-433e-bb3f-8b427ef7e34a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777129663, "uuid": "e6e405ad-f536-45c2-bb73-88a9906a2db1", "value": "vca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93650f9e-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128832, "uuid": "2e093170-29dd-45d4-98e6-8e2082dab538", "comment": "Malware payload (Mirai)", "value": "40e03abbfcfbe1800780186dff3a74ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128832, "uuid": "1e064d8a-d58b-4037-8a1c-899557c6f9c1", "comment": "Malware payload (Mirai)", "value": "52d8868b2e66f5587bd77067c6aa685e912920becf7878a19b89d42cbd404a25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128832, "uuid": "c4392942-9e2d-40a7-ad92-a1668c073b35", "comment": "Malware payload (Mirai)", "value": "f532eef84ea3731fd27b01895c87dcdb4e14aa3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128832, "uuid": "008beb61-fa67-4421-a141-6755f2426437", "comment": "Malware payload (Mirai)", "value": "13518b6203e5ac301e7d32178f161f1492e1f1864cd2b4d4b27935543e07e82cde30f8259a7339b7b49c9791710d56ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128832, "uuid": "9fc0b21c-da5b-4fb7-9d03-20965954ec86", "value": "T18213F2A8EE941FEECABDADF6C0CD1FB517455143724B1A08A302EEE0A667179B48C074", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128832, "uuid": "1c9e9b96-e021-487d-89c8-664dc44df184", "value": "768:1iPvJYv4xBeuMenVST/f4GPxsLfxM7+3W4Cn1AzBAcGrBARplV6BWc6L2WR:05pMikkGPxirCOFf6qpW16LN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128832, "uuid": "9b452ff8-3a38-462e-9ddd-0cbb10a9c527", "value": 45271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128832, "uuid": "61077c0f-4601-43b6-95d6-43d6ef53a074", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128832, "uuid": "9d71fb41-5d78-4f36-ab0a-815db6238b94", "value": "d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b8ca682-409f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777118726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777118726, "uuid": "1d09367b-a4e0-43c3-bb1e-e85a90d67f50", "comment": "Malware payload", "value": "2e3685d6016b2bc7b245e44be236f2b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777118726, "uuid": "7a127cf1-d04c-470f-b34c-c4c2ac7b63a6", "comment": "Malware payload", "value": "53e8f182bf378118b327b901130a3ff9c9d7fa560592aef7e9fa666c4c57b279", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777118726, "uuid": "04b7c5d4-ef8a-43ed-9949-aae7ae5dfc8e", "comment": "Malware payload", "value": "2b36820bb4c2ecb5e811334769966eea0b509930", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777118726, "uuid": "78708b61-9cd0-4070-88df-dcf602849643", "comment": "Malware payload", "value": "fd13126a5a7741f05b01a76a2be1553848fbe8066c8db7fffcfc7ba2709f47d9fb613f3d2e6ed8e9e297b844499ef9d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777118726, "uuid": "c9887fba-18d1-4c40-8649-838b455594a0", "value": "T16E95E15AB2F374FDC067C030835BDBA26936F46541222D7B21C4D6352E96EB01B2AF76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777118726, "uuid": "730afe73-fc3a-4469-b9e9-cfbe07a781f7", "value": "49152:A19DV6Ab6AGREj95/yQlMwji/zocyV4yvX9:K9DV+RAnTj464yv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777118726, "uuid": "f4c21ae6-37c2-4d80-9d39-7685df20d40b", "value": 2030973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777118726, "uuid": "f61045b1-b947-46e1-8b5b-dfe21537ee7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777118726, "uuid": "0f75853a-db9e-4801-9cd7-a5d8efaaace5", "value": "bot.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0095c483-40a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777120855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120855, "uuid": "685b29df-3da7-41cc-bb73-ab219b983f11", "comment": "Malware payload (Mirai)", "value": "92ac6159875e563095df510a4a582c82", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120855, "uuid": "8eb619a6-630c-4873-a416-02d282230f1e", "comment": "Malware payload (Mirai)", "value": "54b492f5881437245345f1f917db28c3dbebed5aa746dcfb8c177a9fc038718a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120855, "uuid": "7c05f3aa-f7de-44f4-b76a-97dc33c79a47", "comment": "Malware payload (Mirai)", "value": "7cd1db92a0978910165c3dd4b973f7f95e075c81", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120855, "uuid": "e311e820-ba12-4afe-b83a-3b3e0d47e62d", "comment": "Malware payload (Mirai)", "value": "24884bb2cf0a6a3268d56fd6e0e97213e9308896ea2a0cb961fd16a9798043499817e645662a811013bb988832348eb1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120855, "uuid": "74b30f28-caed-4d9d-8ae3-fdd313b4f5ab", "value": "T10C91E7CD126293613C3FAC337ED94F487281C6621194AF90B9C9FCF5878CD3B5969A46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120855, "uuid": "8db60af4-fa11-425c-ac60-8da8c4e4028b", "value": "24:vXx7fx7QwtfXx7Ax7TNBfXx70+x70dafXx73x7oWfXx7Gx7lhJ1fXx7K+x7Kd4fW:vH1W6vSxqNxu8jBGZxT3M0d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777120855, "uuid": "c06b8f98-01fd-47b1-886d-185932ecb9ac", "value": 4470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777120855, "uuid": "dde5778d-1f5a-4df9-bc14-657a66b8388d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120855, "uuid": "e947b58d-cc8a-4ea3-ba64-33fda2e99e90", "value": "ohsitsvegawellrip.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "766328c9-40e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777147252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147252, "uuid": "a9061aea-bfdc-43b3-887c-0d51921a4bf1", "comment": "Malware payload", "value": "861c2b9b553f61a0b44fcc2308975e60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147252, "uuid": "e17afe92-fd4d-4a0b-b1c2-3a410097bdcd", "comment": "Malware payload", "value": "5506f17dcbc55894d85ac5649825102bda3afa239f37b1b37ef91b6362dd4032", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147252, "uuid": "3128f8d1-8141-4492-9b20-7ab7040731c0", "comment": "Malware payload", "value": "dc2ae00ed39d0859eec7e7dabaead23cff1498dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147252, "uuid": "f753a16e-146d-4c39-b4d0-5354f8f77d1e", "comment": "Malware payload", "value": "081bcb19c0476ec00f659fb6c9f0e8edced6ed49e8dd5df2739db0d73f0e48449894dab68b410f8920d8290ab733002c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147252, "uuid": "5a4d147e-b1b3-4af3-8c4a-cf1586aa72ac", "value": "T1795302EA90D8BECDC1595730020F4A073EC26779609A663776C5E1A98BF2740CFD87D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147252, "uuid": "5eeb0e33-dd01-4419-800d-dc28717ee279", "value": "1536:C1/S5aOdeB51F+yuXkoPgvFbFX6hTZ0f8ASAy0X9Lkg4azHj:CM5az1Fy0oPgdZX6hTo8RyNLGazHj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147252, "uuid": "e92bdd8d-5e06-42a9-ac4a-1fde21cf4a7f", "value": 60808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147252, "uuid": "40a72f21-07cd-4998-a2e7-4818e0d05cab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147252, "uuid": "3be75fec-dfc5-4bc0-bc40-dd2df41beafb", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c20a38df-409d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777118173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777118173, "uuid": "3a17be41-c558-4983-b01e-389fdd0354ec", "comment": "Malware payload", "value": "1006eeca695b16932158566b72a882f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777118173, "uuid": "a72f2f29-691d-4b97-ad4a-80a427a4cacd", "comment": "Malware payload", "value": "560ee8338b00324ea38f6558ebc920733b7f65d0a9e75e2a838d12cbe7e07d1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777118173, "uuid": "e29f88a7-3705-48ea-b7f1-e22287102cc6", "comment": "Malware payload", "value": "6878150378df47bffd0cd86d102762d0444f66d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777118173, "uuid": "0d64f936-ac6d-4aba-b718-2c71fa5794a2", "comment": "Malware payload", "value": "d8216dde1cb885b7667845cc9bbb56968d3d1ab06ea283472ce6d0d6b9898783df04f5dec4f89e9fe18926a9299fc6c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777118173, "uuid": "df0cd278-612e-4255-b0a8-b23e6d4466c3", "value": "T1E765DF93A7258956C0706E3BE0A7EFB183677E3119D86A0F9D48F77648B33048F15DA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777118173, "uuid": "b08457ef-bf57-49d5-bf55-7c39a4c1b0e3", "value": "24576:fBAXobSBtriTNJbWk71XZJEK7p3IXirNBHuWS9b5atEl0BKC2ig:K2ik7egFBJdFcws4l2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777118173, "uuid": "4985d445-e648-41e2-a91c-6b059e958329", "value": 1490123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777118173, "uuid": "6999f39a-326a-4308-8fee-d547cd5d9430", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777118173, "uuid": "1aea1b99-5d44-416b-afcc-f45159683401", "value": "bot.s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38929dd9-4045-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777080147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080147, "uuid": "fe571271-025d-4423-a32b-3b825e4756ac", "comment": "Malware payload", "value": "6e71ca79f3a176a6c8f7cd225f1255f5", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080147, "uuid": "15ae41d0-5268-42ea-a681-ddb5a434358f", "comment": "Malware payload", "value": "56e4b2405a08af6729d3d15cc13ad9be4f4ef0f80941b8c1a4370d162f1174ea", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080147, "uuid": "2f8a80ba-9dc2-4b7d-a5d1-392ddeb596dc", "comment": "Malware payload", "value": "1bd20d578fd0d77b5342d8f6551c746822b1b4dd", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080147, "uuid": "f538ab5d-9fa5-47f5-98fb-921e00b2c90d", "comment": "Malware payload", "value": "28ec17dd5a38948d5a9abda183dc77aeab48b043890abf9e33a137a7b14bc90d63687934f89bb7c8b0322a451f61a0da", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777080147, "uuid": "2cc2608d-f3de-4be7-bc80-93598c1ccdd1", "value": "T148E026103CA586B88963C83A629AABB0CAA3E92C734D110173AA864FF600A29546C55C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777080147, "uuid": "498ea7df-e1d8-42c3-9cfd-25f4b2f79c3a", "value": "6:htdL82cTn+R9e2jInytGQO0cZAuBn2nK4sKm3ZX5d8ZX5SWjVgrtH2cG:hoTn89jjInGHpc+e2qZz8ZgtzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777080147, "uuid": "c0eaf05b-679a-4fe8-8db1-aca2bcdddc8f", "value": 320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777080147, "uuid": "87acc4f2-c52b-491c-9b7e-e805e0c0a8d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777080147, "uuid": "07109f11-baa9-45c9-86e1-e0c8a2db1f80", "value": "wcaea.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a91ff0b9-40ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777152061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152061, "uuid": "8c446de2-50cc-4504-a945-a2e32761af5a", "comment": "Malware payload", "value": "f0217193410638741d2b06abb1d9782f", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152061, "uuid": "a0dccf23-1c34-43e8-84d5-4d2a3b3567bb", "comment": "Malware payload", "value": "5772c238fa72be7c1939b044430f2a950995029fe863fa35f4850564005aac8c", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152061, "uuid": "cc565795-c227-4ae0-9f83-e6cd7a31f8fc", "comment": "Malware payload", "value": "4a633502110b41b9aad14032e4a615fab493cf37", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152061, "uuid": "7f08aab2-6891-4c3f-9243-2960dfdc0422", "comment": "Malware payload", "value": "b3e89dfa5572175ac934409959d783047d3fad05d992325b16840e7f3d92e3d4143fbcfef5bdecf0f4f8f028c3ced5cd", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152061, "uuid": "7aa99c60-7cb8-4927-a2ab-4feb63c3c08b", "value": "T1E7F4F15B726B24FCC17BC1388197A6B3B671F46402607F2F0A54E231AE75E503B6EB64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152061, "uuid": "5908da15-4abb-4e6b-837c-fa024316bcf1", "value": "20148a980d23511ab2e23866f23b2c9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152061, "uuid": "155962b7-a74e-4ff3-8d6f-907e88e2347f", "value": "12288:wQsOZt/iQujEtkWNx2ROVQJVnft3u1CUjCbAeaahkWwKgMIKOXJ:KOZtqFjEtk2xx2ft3vBkZwIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777152061, "uuid": "8ac3b093-a108-4859-8a76-3e8871cd8b16", "value": 723968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777152061, "uuid": "ab919592-bb8a-476a-be62-53bec6b0a420", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152061, "uuid": "74e593ca-3eb2-4623-908a-07b1074c85de", "value": "2_iQCgJTYFDVss.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c13fccde-40e0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777146948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777146948, "uuid": "a996e30b-8d6c-433c-9bf2-eed3bacc6bae", "comment": "Malware payload", "value": "5892729124a932ac0158b04db4aeca2a", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777146948, "uuid": "db64f0bb-5fa3-481c-a12a-01f8be858955", "comment": "Malware payload", "value": "583fbd09c57c0c0992a6aacfbb1d2814b32a834535ff2c3d218e70e2025ac6f0", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777146948, "uuid": "115af8c0-abc5-4fd2-b83d-31c5c06a1ce2", "comment": "Malware payload", "value": "4bfab37d56c3346944b7fb54c2b4bd20127c23ab", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777146948, "uuid": "1fd56f2b-0f24-4554-9817-a9b339ba755b", "comment": "Malware payload", "value": "c54476da775baf7e98b69aa8350b434368aebdc85d0d95c78f3354739dde92fdb8d5aeab828cee58a478b91b6aa7db60", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777146948, "uuid": "ffe77c49-1135-48ea-994b-129ac8db65c4", "value": "T1296533014F863D5E595CB25312BFAD7D42A54EA1A9E5A0E38BF022D323B6BD5C303D2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777146948, "uuid": "3c2ae844-62bd-452a-9214-09c66f34004d", "value": "24576:j9ypmVpJ7sR8Qg2nnAZ7z3LfxoCEda+x+4mlQ3kmxSb4fTiJh8D7SHaH:vZ4KQznQvlo1d1+hC3NkkLdCHaH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777146948, "uuid": "564f40d3-b277-4f99-8323-19d4ae4ebb18", "value": 1427352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777146948, "uuid": "985535a2-2a4c-41be-b370-76b7ae43758d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777146948, "uuid": "8694a156-711a-4594-bd85-4e8238ecef9c", "value": "2VC2XRE3.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a67c157-403c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777076204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076204, "uuid": "7acb3129-7dba-46ae-b23a-00ee6149bc93", "comment": "Malware payload", "value": "bc5fb02396d21f5b0ed5ac41f8d6a26c", "object_relation": "md5", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "jdjj-cc", "colour": "#212AA7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076204, "uuid": "61852365-77d6-4d7d-bc48-d4149f04f38c", "comment": "Malware payload", "value": "588aa05bf5ea03f491ad646b4bffa3c0fa023c0325fdadd38b23d064ffdece37", "object_relation": "sha256", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "jdjj-cc", "colour": "#212AA7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076204, "uuid": "66e7418c-0218-495c-b7d4-571b28549654", "comment": "Malware payload", "value": "5e9430fe60e782179fdddcdba3ca5dce4b015239", "object_relation": "sha1", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "jdjj-cc", "colour": "#212AA7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076204, "uuid": "f583308a-ccc2-430c-bf1f-28e59f2a8439", "comment": "Malware payload", "value": "9e3107ee930cd44d00159f05a0ebebb9e7a66fd09d5aea7562ba6b21673e32282e779591fa859fc8b6a67f7480acf33f", "object_relation": "sha3-384", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "jdjj-cc", "colour": "#212AA7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076204, "uuid": "87cd46f3-6251-483f-97c7-870ed958f82d", "value": "T152648E00E551A172D8BF0475AEB95B269D2CAD7007D9B9C7B3C81DAA8F355C26B30B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076204, "uuid": "a85eac4b-c918-4268-8e2e-f7313eb4a737", "value": "1912543cde812e2e91462258d9ea8641", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076204, "uuid": "a63edf88-b94a-4960-ae64-9e382f80f6ce", "value": "6144:NNG3gMSBnEL68VYFg0qj/y4IZSgo4xEveXRjqptmw:Ng3rl68VYG0q/ybxvWPmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777076204, "uuid": "c295d250-6899-492f-a45e-304ff5a7afa3", "value": 314880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777076204, "uuid": "83acda23-c590-4b1d-97f7-7fd76ad94e5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076204, "uuid": "f41e4fc6-20b0-4ecb-baad-ac7308c6bd27", "value": "XLLiveUpdateAgent.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e08a616a-40e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777147430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147430, "uuid": "85180cb2-a140-4dcf-ae33-f78d50522252", "comment": "Malware payload", "value": "92e85c6f0cac2bf1362b20331dced818", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147430, "uuid": "34ea34cd-8682-45d1-9e01-4228199296b1", "comment": "Malware payload", "value": "589cbd7d356ceadd7ee63973c2fcfbd42b7dce72b42971580cdab81a54b16dd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147430, "uuid": "3e05edac-a65e-46f0-89d2-3a6f36117505", "comment": "Malware payload", "value": "394e7a0d3460402769a09532458daba80ad4c44a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147430, "uuid": "fdca7c16-6d23-4169-9346-aa8139e3f126", "comment": "Malware payload", "value": "631751aaa353e773c063acb4ebbfd5118b8024211fc6e262a5c73dc9df0b6b6ced8af7b3ffc3243e00a7c320b4a7ea09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147430, "uuid": "cc92f9b6-038f-47c4-9074-b79d268802fc", "value": "T1FB145A05FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147430, "uuid": "13e1aaa0-0089-43c9-a6fd-008375bc1a58", "value": "3072:ESZAGIiEgACYrerYqlNSwppHaecY4NXkUaN:HZ15BTYCrYq1QDY614", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147430, "uuid": "177c14eb-e83b-4637-ad44-e83f10412af6", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147430, "uuid": "40f1d61f-0be5-437e-9287-5364e1d8e3df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147430, "uuid": "d3fdb1d1-a0a5-4f39-857d-df936b19f33f", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3049a955-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128666, "uuid": "7f1e8d2c-a049-4f64-a9b5-ea9cc8e70e91", "comment": "Malware payload (Mirai)", "value": "17046f1d16f9f33a16eaf9db2ee8260f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128666, "uuid": "27a28e28-2ff3-40da-a242-7652c8ebb6b0", "comment": "Malware payload (Mirai)", "value": "59b998a75871fb925e09c4f317dd4124e4be7a40ce4c67b9a2eb6e63068485d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128666, "uuid": "60a984ed-aad5-41db-ac00-a0f3caaa1e90", "comment": "Malware payload (Mirai)", "value": "89e04b77f908e2017208309767d23ebbcd98b162", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128666, "uuid": "81c0069f-1e4e-4a94-8912-f43589332582", "comment": "Malware payload (Mirai)", "value": "a9329c400701bd879176c4b1bd46829512bdc323d801a0613b5c923c270f122645fcbd5d72de0aa0b7bfdbf3140eb080", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128666, "uuid": "cb2bd3c4-1983-412f-8369-6545589e16c0", "value": "T15AA30789BD919A21C6C526B7FB0F018D370263E8E1EA3203DC245F6176DB81F0E6B656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128666, "uuid": "5fb89609-4bd8-4215-9a0f-cf1a828bc4c3", "value": "1536:HXHRnvW8TOKvyY88Gzv4G8204dzEsbEs3Xw2tdIYAHDnmJN9qAWyyvULJ:HBnO8KKL8SG820azELOXw2PIYAjnQY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128666, "uuid": "99c187bb-937f-4361-a907-947b1cc6d205", "value": 104068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128666, "uuid": "32fada90-da8c-412f-81ee-bf0fe0f32e32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128666, "uuid": "4b92dd3a-0bd2-40a9-98c6-a8dd58fb2b76", "value": "KKveTTgaAAsecNNaaaa.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3321c02d-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128671, "uuid": "bf9180a5-5d33-44e9-bc6f-67a9745e347d", "comment": "Malware payload (Mirai)", "value": "4d94d91512505fd0d68ce066886a3baf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128671, "uuid": "a66705a2-a89b-4095-b22b-cfffdc173b2c", "comment": "Malware payload (Mirai)", "value": "5b40a4fed66e08fe58536c905c498a160900728afed6a320a221e27f8d95b39e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128671, "uuid": "8c451b35-9b1d-4a5d-b6be-b7efc57e3a89", "comment": "Malware payload (Mirai)", "value": "ab3423e4514099a461ab0473c0f3f162d8ac649c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128671, "uuid": "3103d740-7414-4a1d-8928-38d136cade68", "comment": "Malware payload (Mirai)", "value": "59a232de4bf837f27863f9a396cb07ef684b00cebae9f8af9c0518e3088d7ad4e6eedecc1afe975b7de69a52440a866f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128671, "uuid": "b0b3f4e5-6e60-4cca-9809-ed0da5592bb6", "value": "T179A32AC1F8C780F5DC5B8834609BB77FCA31E96980309B69EF95AE25D63BA01911339D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128671, "uuid": "cca4a7c6-3803-4ec4-8380-41e429dc0827", "value": "3072:vl8jdYcBgdHSZL0H3exJ01WCTPVBicz3fThQ:YBBglAjJoWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128671, "uuid": "7aeea4ac-49f2-48ec-85da-80343786a558", "value": 104112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128671, "uuid": "74614056-d733-4b4f-b918-d5c261733fb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128671, "uuid": "9863457a-1492-48a5-b6e3-938ff0fc8072", "value": "KKveTTgaAAsecNNaaaa.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c702a8d0-40ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Vjw0rm)", "timestamp": 1777139227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777139227, "uuid": "0105e042-9b4a-4b14-b756-a413a5bb5342", "comment": "Malware payload (Vjw0rm)", "value": "ce22a149e892a6cea8978c4f16f2c12d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777139227, "uuid": "4f28cef0-7d9f-4aaf-88c1-b5c3521db166", "comment": "Malware payload (Vjw0rm)", "value": "5ba2389f00876cc43286bf45725e4e94dcecdaeda7bfdf0a9f310f49590c1e54", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777139227, "uuid": "f38b144f-ab4c-475c-9c6d-1aedf1da88b6", "comment": "Malware payload (Vjw0rm)", "value": "5cb6894f503b8b1c7569fdfaadc6f0481be68a68", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777139227, "uuid": "029fa4b3-2c34-44e0-936e-4bd5eba1c2f7", "comment": "Malware payload (Vjw0rm)", "value": "cafec4c66adc97bc5b3a9efa0c9ecde100410f2d70b536cb79a974cf98b9db9e803f73f096aaabd43cb87bdc94d9e55b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777139227, "uuid": "6be78563-4a41-4f59-a11e-30ba41e2852d", "value": "T1DE835CACEDEB412F6095C995A6E12183A4AA379F720E5F9A00E5C3F1075354EFC7AC1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777139227, "uuid": "f239bfa8-20ec-4272-b1fa-7dac84b0c574", "value": "1536:zCcb/qcC0f2A0qwmpc1PXEYRTSxthclomgQ0KMg:Wo/qcC0fp0q/O1PXEYVcWomgRjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777139227, "uuid": "a94321be-2ca9-4eca-826c-c6c786e98fae", "value": 83994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777139227, "uuid": "1cfac259-e48b-41b3-8be7-c5b58fd9d9e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777139227, "uuid": "1b42ee6a-6e06-4d03-80ec-eb4d80733795", "value": "ActionCenter.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfdc308e-406e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777097983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777097983, "uuid": "e3e6cdf0-12f0-4a63-b10f-f0d2082e1f75", "comment": "Malware payload (Mirai)", "value": "95700c8b172f5b6e3c6efa6096aafb9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777097983, "uuid": "19a94e51-8587-4f66-9ff0-fde4a2e6cfee", "comment": "Malware payload (Mirai)", "value": "5bac9c6c950f082d0451b9c9d25672427ea8eb40a97c21e4eb8034a5cf56cbed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777097983, "uuid": "18a429fd-a589-4098-a3cd-b6612a6ca9ba", "comment": "Malware payload (Mirai)", "value": "e327d37f82f0f38e116ea88ebce551632efe341d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777097983, "uuid": "24547e4d-ddb3-4380-9836-b85136ab7a54", "comment": "Malware payload (Mirai)", "value": "4eca485ab7a41f4a3ccd248e70d24c5d6054395d6d8558972b5a1a2ea7b5f9db2422c2faee600dc1ff48e27124b4cb06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777097983, "uuid": "2512ef85-de00-4226-89e1-04180ce46e63", "value": "T16A849713D9118991E0654CF3227B3245A94787BB8AE732D3ED1A4EB1BF2151F42BBEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777097983, "uuid": "99e1e0a5-0a55-4eb5-a597-ab6269883e12", "value": "3072:qpeLF3Lneaila1X56sRg5TYz+8D6J+joCg/vFv2CLQM/9uItyT:oeLIbla1X56sS5W+Q64jov92C0M/9JyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777097983, "uuid": "b93ce670-c753-4607-baf3-be3d135b8476", "value": 394022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777097983, "uuid": "e88adcc5-9e46-4fc5-adc3-5d3563962859", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777097983, "uuid": "a49089a4-7c55-4841-9a17-8c936a51e73f", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca5c76e8-40e0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777146963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777146963, "uuid": "e7561ac0-f0e3-49b9-8250-a04c5eb1b428", "comment": "Malware payload", "value": "7de512f429109ce14c5be52a686153b8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777146963, "uuid": "a43ad9ea-ed18-404d-a746-b72a00cb8599", "comment": "Malware payload", "value": "5bd2c8db938ab79d24557a480156f445decd300fd0920142e8f3c721771c94b2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777146963, "uuid": "bec0e562-7b30-4476-badb-b06c145491be", "comment": "Malware payload", "value": "c1e1c410d6c2f400aa379b691b6274c877e23716", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777146963, "uuid": "3e0766f6-37df-434e-ab64-08ecaad02da1", "comment": "Malware payload", "value": "97892e99ec62db4c22cfac65542a932e509b38d3d5a2740cb1696e2a54078a2688e8d2966e1b1f9a0295a0f0360daac8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777146963, "uuid": "1260b144-72de-4ff3-a1df-118996490304", "value": "T19EC60904E0AA759D44F2EF09A42A80E26D8E36FDDE7DC951381BE47A0D09E537D3225F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777146963, "uuid": "71ff765d-0f09-44d6-b2a2-e1fcf633a5e0", "value": "196608:opp/JMux+bEOoIAuvAmFQPIgcNa0oyHNJ0wdCCCw/eHPtA0zAGqqQooUNb5u8oLH:YDz+bE2AzmFuIgqah00wdvZ/eHmXabbg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777146963, "uuid": "2a02784b-dc31-4877-b0e0-521a4b2b4b73", "value": 12458491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777146963, "uuid": "cbba98cd-3b3e-453f-9b8a-1d897bc3ca9c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777146963, "uuid": "10112f34-cebe-437a-8d69-abc8799f6456", "value": "bevzsmvq.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd013dbb-40a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777120795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120795, "uuid": "f398a748-ace2-4390-9bf4-065111771cb4", "comment": "Malware payload (Mirai)", "value": "be9d8a44049969b1d344c7581192b5be", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120795, "uuid": "17241080-64f1-46b3-89fc-4b2c6d4974cd", "comment": "Malware payload (Mirai)", "value": "5cf82f5efab5b4b815ecae0f19125f0206a66f8ab5e373c24668ff440c38942f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120795, "uuid": "ef204138-da43-44ab-83fe-4bef7fe880c8", "comment": "Malware payload (Mirai)", "value": "13279cff49c27d6e0be6a2a5794cf4d57b60af4c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120795, "uuid": "e4c2f9be-fbc6-4276-892c-ae82ecaefb1e", "comment": "Malware payload (Mirai)", "value": "54911b3b911bc7f3e9ac368eb69a63df0aad3cc3412304df269c244f335bd28a26433c8b94840646efc8e7e52b380759", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120795, "uuid": "24e0a0a9-b4dd-4d41-ac1a-d3815abba0c0", "value": "T1E34163D924315333C00A9DCEF6905A9DEAC651F4B1C7650FD69D1EB738AC450B8A2F64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120795, "uuid": "5584e175-bfac-480e-8af9-2f24ec9282ce", "value": "24:IVcl3XQQFG9dBhF3yNdDBoDuEDCucwVcEErTBEyuKkJ7kr9h:OAoi+9CBVGwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777120795, "uuid": "5be6f33d-2120-41b7-9365-2f016387da39", "value": 2133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777120795, "uuid": "96e52e4d-cfd2-4790-85a5-7f49c2add3cf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120795, "uuid": "77ad1619-3dda-4e03-a76f-fe3bde5bbfa1", "value": "ssh_config_upd.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f508bd12-407f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777105374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777105374, "uuid": "3a2297ea-c38e-46f0-9594-0d83022573c3", "comment": "Malware payload", "value": "281280885138065347cd3330849c37e5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777105374, "uuid": "b1569600-4966-4f84-bcce-3f2eba346930", "comment": "Malware payload", "value": "5d52ce8969aeda3f414c72968d51f623b5d0a88deb9e749e9742a5e046946cd8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777105374, "uuid": "ef9614e5-eb5a-49d5-82db-330fbb8a3cdc", "comment": "Malware payload", "value": "f52d1ce28181d4cdcd214b885afbd809dda50515", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777105374, "uuid": "c81bf684-76d5-44d4-84e8-c4a179263efd", "comment": "Malware payload", "value": "86b835863530d55d2ecb4a9638e1561088f192360acb12adbbfd8622add447065b43b0fc86ca77da18cd549afe7e05c7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777105374, "uuid": "eeecf817-1712-4a94-8c71-abd7a8526f58", "value": "T161E423EF9A5F7AF568F1613597AC0F0236B7200A15267408F946EFB41A21CF84BB094F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777105374, "uuid": "04430ef9-b42f-4a47-ad4f-e8fbae6f2861", "value": "12288:pNSa4yXYcwqoPsbLjih/cGSA3woX/VvGstvPBMto+ohboqQAES31yJxhZYWIrg3k:7OyXvWPsb/iCkdlBu61ECgJLeWIrg3sv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777105374, "uuid": "11d2d608-b8d4-4555-93fd-858c3ae2ac2c", "value": 659004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777105374, "uuid": "084bb44a-db90-47f9-8573-ac359e65d9bb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777105374, "uuid": "85bc9200-bb96-4bff-b892-d3edee1fae2f", "value": "Max Reporter (1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29b7c13a-40e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777147123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147123, "uuid": "360252f6-055b-4ee5-a086-63f90e0858de", "comment": "Malware payload", "value": "5d894c6afc67c2a621aa177a17328bf4", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147123, "uuid": "45e3f3d1-df8c-4699-b1a8-73041a076af3", "comment": "Malware payload", "value": "5e8ab2235927971a925fc35bb498c69130b22a62184d6e8ff8f186dc267ed0e1", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147123, "uuid": "b8635bff-e2ec-41f6-8c64-6479731438c7", "comment": "Malware payload", "value": "72e0e49fc88d24344979696ae71bec5da78ba8cf", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147123, "uuid": "31e9a02a-7b37-4bb8-9f50-d1ed2b3bd475", "comment": "Malware payload", "value": "6657098ab247b3e04347cf216857a136655aa4209c8df4e699a3e73b55378ec91622898ed6701a73b0bb444576dc0866", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147123, "uuid": "59c458a2-91da-49f9-ac62-7d362f637f77", "value": "T1846523705FAE7BBA43D6A75880FF7B8703A5437AA019E5E73B1211821FAEB19453F401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147123, "uuid": "dc85939c-72bd-4fd8-b028-ccf9eddba9ee", "value": "24576:ooVEoAegESfqNXgZ4xEf8pdSFXBF/3iYeXx5YFGrOEciQe+6fPD/p1vUK1ve:OBeOyDZKFjyFQAPF8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147123, "uuid": "107fcd36-dfce-4238-881e-efc947ebab9d", "value": 1424797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147123, "uuid": "3aa30ae6-076d-45d6-80bb-c707f445d643", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147123, "uuid": "292f675b-f9a8-4bf3-99a6-d5c63d48e041", "value": "ps_ZKYiZUTHl2XS_1776684145888.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02cfce63-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128590, "uuid": "38e55994-5449-47e0-bd18-91d80c23bbc3", "comment": "Malware payload (Mirai)", "value": "8088ad5d19a4af717426168623639677", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128590, "uuid": "3ad1a30f-fccc-4f5f-9ebc-e166e09faab3", "comment": "Malware payload (Mirai)", "value": "5eba95e323344730cb12f476f2e97459741fda92a15a5bbd7e8ab626b449b82f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128590, "uuid": "79652970-108b-4edb-b2ac-71c1b4c8b504", "comment": "Malware payload (Mirai)", "value": "d9854fd9d6bf1f8a4e1c3ac95d6f3f9de3be6585", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128590, "uuid": "b73ceb86-77e5-4766-9d36-8defea663c2e", "comment": "Malware payload (Mirai)", "value": "a1ec14278825cedc68700b1fc47ef0a9251ec3de0ed9e52b7481729299588fff2a3eb553c9f4431800a1e0e6118a50f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128590, "uuid": "89630831-d766-4155-9234-d68d2cfe638b", "value": "T16D510E560BE60E2BCCE2023B99A76754AB16FD434495FBA7E31454850D3F38ABF32158", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128590, "uuid": "c6758338-3ef5-41ac-a984-2092ef0e3f14", "value": "24:JZ+GgP9qD0at6EoWG8rUlFSs0VzLCkIdhUg0RGIGQFmFmFmFUNoam1pzb4PLYql:JkPFqDPtFrkFSsCzL8IHUUUGNk1pvWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128590, "uuid": "f24da356-6488-4cd3-9077-95e9479190a8", "value": 2677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128590, "uuid": "ee6993e0-77ba-4ad7-a223-b12bffa18e6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128590, "uuid": "a771410f-5d8a-49b8-bf03-f2088ac7febe", "value": "dlr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "786bae61-40ef-11f1-a769-42010a9c0008", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1777153268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777153268, "uuid": "33eff3e6-5cb3-4ac1-af4f-04c7cc68a18c", "comment": "Malware payload (ArkeiStealer)", "value": "1e48ca819f6ec9b090dcb773dd7d5060", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.aaa", "colour": "#884164", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777153268, "uuid": "db844f59-8de7-44fa-b7f3-3f7614d212e5", "comment": "Malware payload (ArkeiStealer)", "value": "5ef95ea03e9171d205d0f3fe1b9aff0e1933a38923385357e710949cc0b85b72", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.aaa", "colour": "#884164", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777153268, "uuid": "9024c74a-bacd-485b-9ef5-d90f526e4f70", "comment": "Malware payload (ArkeiStealer)", "value": "fb7e817d444875f3eb952516503ac3354ea2beeb", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.aaa", "colour": "#884164", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777153268, "uuid": "b090649f-f859-41f4-9a4e-6e0c02e48062", "comment": "Malware payload (ArkeiStealer)", "value": "07d9255f2c8937aad9efa508cd927d51b2c02296e4b09b62b699eee88567757a5497e08a53862dbe5d789c5593dde265", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.aaa", "colour": "#884164", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777153268, "uuid": "03dd3a3d-aeab-44c8-b1a3-addff2605df4", "value": "T16297BE23BA51C5B7C3920034CD6A96BE57683D2D4BF072FB764535EDEA322C53938226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777153268, "uuid": "c28985ee-8454-43ba-b8fa-c775c7efaaf7", "value": "011afae80ddae6165d516edba92e0983", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777153268, "uuid": "3c7f38fa-c27b-498b-8e62-5783c0f1eae7", "value": "393216:dWPuqqS6qef/RpQA2F3jYdxoqtL50mPehXSCN2mn+z86cI2kYEcd8w:dWPuxf/RpQA2F3jD25ehXtoXz8JI2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777153268, "uuid": "371efc1a-ef4f-43ab-b422-e9d62447255d", "value": 39644160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777153268, "uuid": "7107e52e-909e-4882-b4f0-44f4536a3fb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777153268, "uuid": "047e6172-757d-4402-927b-f931f4c5b668", "value": "Quick.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b94366-40bf-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1777132564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132564, "uuid": "c44db56d-5d76-4ded-8f29-2327778a3ae3", "comment": "Malware payload (SalatStealer)", "value": "88c21cabefc716f7cfd01beee45e73a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132564, "uuid": "ee751fcd-58d3-4c48-8d8c-5b84e365239e", "comment": "Malware payload (SalatStealer)", "value": "5fcc6ae192686e696d618901f374ecf8aecc5ae5b591973c8dba2f877f128cf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132564, "uuid": "f7d0824f-ccf6-4e11-826a-788e3665dceb", "comment": "Malware payload (SalatStealer)", "value": "813a27b8f4a0e40b09c409430e208016cc61c304", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132564, "uuid": "d37bff2e-93a3-48a2-bd87-5bb171a9bb9f", "comment": "Malware payload (SalatStealer)", "value": "524b8f8c405ac84d86235423cf2a0e7a93cb32f22cf3daf6f8c0f3b5d2e5ed4b85b8bb901521d5e14b756c5a279eb6c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132564, "uuid": "35f8040d-5950-4475-ae13-a4064ba0c9a0", "value": "T190F53313704E2862C46BA1BD16495CCB8FE5E448818A36EF2799EE8E115FE5EC3F14F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132564, "uuid": "43afab2a-254b-4b24-8f23-5d27e32965ad", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132564, "uuid": "6bc90b49-c917-46e9-aca8-9ade71887d85", "value": "49152:WZ/dQcHON5M9alYQ2BESFAXiKbLSS+2zjlKnocYSnvxBgW88y+6varf:C+0OL6SNEEzXixS3z5K1xXEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777132564, "uuid": "bff5f405-33e9-43cb-a51a-f2ef931da509", "value": 3596800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777132564, "uuid": "c75b0b3b-33ee-409d-8526-b853df523cd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132564, "uuid": "9cbf6a81-f328-4578-8ddd-5aae3f9ed6b5", "value": "Dior fix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ddb3742-40ee-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777152767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152767, "uuid": "0e82053c-b782-48c1-86a1-bfc79fccb717", "comment": "Malware payload (RustyStealer)", "value": "e6f2e5db2a3b907ba8ec68b7f3b3f98b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152767, "uuid": "730279d0-47da-475b-a91d-ea51d57f9902", "comment": "Malware payload (RustyStealer)", "value": "60090a7079a37d7c55ec6aff11e52d37a1d032d06d21954d655dfa4acd7cedd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152767, "uuid": "151dc221-353e-408b-bba4-b62fbd3d5c25", "comment": "Malware payload (RustyStealer)", "value": "a4da604b140a3f2cb99b5c0a0491b7b1f7ad5167", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152767, "uuid": "ee59bbad-6860-44f2-afb8-12fab60ad43d", "comment": "Malware payload (RustyStealer)", "value": "9a189e8f9f9768d2e38899307a1f46805905caf46a54a2209455235a1546efff8e7e2e173e5ea46d3bac42cf96306f24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152767, "uuid": "56f92a1b-6fa3-41e2-8624-af2b95f4529b", "value": "T11BD46C4BF9E755BCE16AC038920A6933BB76B8450531BEB706908A313FA5B217F3C715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152767, "uuid": "7428cd85-0b67-4b90-9243-91c1e8ee842f", "value": "e04bb28ca98bec3b38336bf6babcdfc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152767, "uuid": "37b6045a-2e6d-4a2e-8283-f39bc7f954cd", "value": "6144:raWbCwc5p2jIUbjZRAcZVWtF7/LtxVd+F59p696rRyg6ZIa85rS1ruiCH0YtJvBH:rhGp/+jAWVQ/nQREJZIrS1uiCUYtLyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777152767, "uuid": "3d06682e-ba2d-48b5-83dd-216cb15b4e86", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777152767, "uuid": "7b58e883-d498-46f5-8f38-b0485fa01bd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152767, "uuid": "41114088-396e-476c-8c2f-74fb48de4e1c", "value": "2026.04.24\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u6848WPS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af74e9e5-40ed-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777152502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152502, "uuid": "047fc605-fc7b-45e8-ba7e-8835c8e79c6f", "comment": "Malware payload", "value": "5de1594b08160b4e5f09f899da4833a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152502, "uuid": "b6d33b20-b54d-45f1-b45a-ae591fbd79eb", "comment": "Malware payload", "value": "60f3d1e526279ef0db780d0a1f3473d09b977db43af8b7d157df4213026a09a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152502, "uuid": "4cf76992-ed9e-4340-9fc5-0e4b3326456a", "comment": "Malware payload", "value": "c92094b2d39e885ac9fbd625dc7c7a57b81211be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152502, "uuid": "1614ffae-30bf-4478-a28f-c1130de14ff2", "comment": "Malware payload", "value": "ea304cf7703a5cb04eaeb1f9119673c453eece517cf9f11861c2cd21b6921ab4e7f71a36bb0bc725feef37b6f6c868f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152502, "uuid": "9e94c31c-e57c-4a85-83fc-ca8399d8c354", "value": "T1212833217586C53BE56A01B1652C9B9B5538BF720BB204CBB3DC3E6E1BB49C21336E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152502, "uuid": "e890d030-e5e6-42dc-bd2d-c7ef5fb22b20", "value": "608505ff1e7e27ff4a42ea9c4e9f4192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152502, "uuid": "64d7387c-fc27-4d0f-a58d-94ff72ece117", "value": "1572864:fx02UeoUKKuC05F9hLaYVIYyyT2SX+p8Tg87WLjl6HRIM0uM0q4sEc8Nl:fBlKKexhLLGyDX+yTm4xV40q4sKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777152502, "uuid": "7f670228-e06c-4a60-8ea4-db123eeef548", "value": 93766092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777152502, "uuid": "2b9981af-8289-4870-8128-71116f2fb2f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152502, "uuid": "94651a0f-c750-4a8c-a7df-0694425c7f9a", "value": "Neon Genesis Evangelion Mugen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0709643d-403d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777076628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076628, "uuid": "91832a8e-bac7-4698-8e10-c0fcc1e91296", "comment": "Malware payload", "value": "78097f96a3192e9db3fd0d2710e8caa8", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076628, "uuid": "33e7f1b5-8da4-4be2-8a25-d6beb53e3a86", "comment": "Malware payload", "value": "626aaf473f93ec8ab7380f8cc7cbfea50ca5e8d182a545eb2ed44280da4d43b5", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076628, "uuid": "ab9d409d-7eb5-436a-8ab5-6c9c4fe92513", "comment": "Malware payload", "value": "f67a2016188964f3d66b118169b371c0bffab024", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076628, "uuid": "aa00c87e-ba9f-4fbd-883d-743c1cfcb5b0", "comment": "Malware payload", "value": "ad916e62cf883eef43e50f85f9af77be8a998ba937115953dda5c578dc0db59f8dc1d0b34b7bf1af38f955d480ccb98d", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076628, "uuid": "15ee6556-8bc5-4f51-94c3-57b52d2bc150", "value": "T153D0230CE012E384CF0E48A29300D43D3C015FA887202FC00C88DC05800321D703CF73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076628, "uuid": "9a53ef78-860b-4052-8ec7-efcd2345c2c5", "value": "6:GigwqK+NkLzWbHK/818nZNDd3RL1wQJRMvO8cksaCawIiCHs:GoMCzWLKG4d3XBJGW8DsHIFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777076628, "uuid": "6b3a34dd-5ad2-4c15-8299-ada2df5aa4de", "value": 215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777076628, "uuid": "af334df6-6f64-4d89-8496-b42adf3cb963", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076628, "uuid": "be4e1836-2732-40b0-b1ca-07b6f9285741", "value": "UklNL6g764fGfi0VCC5BU4S.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c8e0d8-40f0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777153685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777153685, "uuid": "3cbf7b0b-a4d1-407b-87a0-06d14d2647f1", "comment": "Malware payload", "value": "3f684ae77a19bc016e80e2e4fa500f1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777153685, "uuid": "a4db8257-84ba-43f5-a5ef-65399bd05097", "comment": "Malware payload", "value": "6357059ba1b68376b11311cd1679f93e3709f48c8e6e9e84e88d4c27ebc00e1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777153685, "uuid": "83972dcc-8828-4dfb-a9d0-6be8453ae87e", "comment": "Malware payload", "value": "183d10dedc1102afd8c2e3a5b94c0d555beeccc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777153685, "uuid": "4088eb0d-b48f-46af-91c6-d3647ce8f0db", "comment": "Malware payload", "value": "c059d04fa03ca65e23cd5c1de278ee16e006f8c5f379f7e451b760206e2792cc5931542c37e82863f890e6a74ac7a184", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777153685, "uuid": "0d890a2c-7684-4a14-adac-49881a218b94", "value": "T1C757AE99E9D92298C13B807846AFA743FA21381947741EF302E58E741F777D07E3AB52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777153685, "uuid": "7004c325-3a25-42f2-ac52-53133a1931b8", "value": "d6282b899ac9647f57bdc6b00a424b44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777153685, "uuid": "f4ef6a49-b857-46d5-a148-87939eb6b504", "value": "196608:lNCTYT2EsH1b9L1BDdPij/9wlgQHjoD3pXjWR6OQ0sfv3iDCe4Wjh3iLiAUjUhqV:lgTYT2EsH1b9DdPijFJQ0r3hslSLiAU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777153685, "uuid": "27e94bcd-f424-47bb-bf15-8d2d6ec24770", "value": 28129280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777153685, "uuid": "a38af21a-17da-4d6d-a7bc-e8b0c533472d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777153685, "uuid": "f07d73e0-733a-4360-bdc1-3b6795f92ad2", "value": "\u6587\u6863.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4de6a0-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128768, "uuid": "e78009a9-c7cc-4d33-a8a7-a36b33ae31d7", "comment": "Malware payload (Mirai)", "value": "006e3e4c36ba20f562285d0044506593", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128768, "uuid": "f27e0af1-7763-4bfa-8502-99fb9ab9b03c", "comment": "Malware payload (Mirai)", "value": "640274ff5590d8a0af04d3e062ac2a7757227a3b9d08df1aa96ef196edda5ad1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128768, "uuid": "df5567ac-c6f6-43ea-b298-ac3732c1a73a", "comment": "Malware payload (Mirai)", "value": "adff52dabc1488d54882c2bab0b7869d919b89d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128768, "uuid": "1c46dbce-0ac1-412d-ab33-496cc0a788ff", "comment": "Malware payload (Mirai)", "value": "836ca261566b7e0552dcb9fa7372d365a4405ef923556f971cfbe0166fcb0855c331ce9e5e475b0d2742099460f9f6ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128768, "uuid": "c8e2e10c-2f1f-4cee-8260-a4c14f57720f", "value": "T1E8A33906BAC188FDC495E57807BF7272C561F03C2276728723C4FF297A1DE611A9E299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128768, "uuid": "458f18e4-344f-44d4-8570-e3863a28d97f", "value": "1536:YxL0eOj0jqcMKP4yaGekhHFossyUnYUYdnuN4tf+Om1CVl+20Yqe0qCy2oeXoXnF:YxLOj0jqy3FnuN4tfM1Cq20YqYCy2NW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128768, "uuid": "0ece5db9-f87a-47ef-9e80-f679bdf957ab", "value": 101088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128768, "uuid": "7bed68df-8262-4c6f-a9c3-8ff971c24c0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128768, "uuid": "1d7008d0-e275-4bf1-9f00-d4cda96d3220", "value": "KKveTTgaAAsecNNaaaa.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f36d741e-40e0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1777147032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147032, "uuid": "43d967e7-9af8-4d20-b8e8-81a7cb9d9e1d", "comment": "Malware payload (Formbook)", "value": "ebf9e504f1d1cd1f8aa810c201e4badd", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147032, "uuid": "a223e970-e8af-4e71-934a-7ce3a537581e", "comment": "Malware payload (Formbook)", "value": "640360104cb1434560454e5ee586ed959ca1f8a8278c9a4af0e8793efc9a0a71", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147032, "uuid": "d7c441c6-4c3d-4368-acfd-c9462a48614b", "comment": "Malware payload (Formbook)", "value": "49d3b30baaa04f29d21dddd837215a8f35e2908f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147032, "uuid": "03bdeea2-ba0c-41a5-86e5-29d7e0d9dfd1", "comment": "Malware payload (Formbook)", "value": "cdfc110c0ac62199104b36bacb9701aedd1f42ddcf47469c955d56090244cb923a91196d1d666f4f36a55a40ae30d43c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147032, "uuid": "ce20fb70-6ec6-4387-8b24-3a036dd927d7", "value": "T1256533202FA65CBE8774CB7D85F75F140340A6AB1482D4E3ABD12E9B5EAEB81C907D05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147032, "uuid": "759c6725-96bb-46e9-949e-ac2944af25e8", "value": "24576:aFUPQxY5Ilpo5L8vXjGnidTR3hBvYFn8a5AB3QbUFs2DQ6edqFnBxG7:aZy6O6Xjfv33YYy6dBxU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147032, "uuid": "5b0338ac-11cd-4246-bb00-d9c8c2fea0c9", "value": 1539606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147032, "uuid": "1eb6f490-d36e-405a-ac9d-39be9e23923e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147032, "uuid": "ee087980-c79e-44d0-bfbc-1c2e16ba1114", "value": "ps_flYfjzAfXz8C_1777022684927.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0879d1c0-409f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777118721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777118721, "uuid": "704c34e7-fdbb-4f2b-b765-7366322d7c6c", "comment": "Malware payload", "value": "6aa956ad038ffca674f014fd7bd23243", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777118721, "uuid": "c6adb9c4-1a5b-4041-bc44-a34a1c5d83a0", "comment": "Malware payload", "value": "643fe80d288c09fe70286757502e0cc55cf8ac4723eb7ee56a9d11fa4e7c8c82", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777118721, "uuid": "42e505b4-0c65-4e89-8213-beb32af133d6", "comment": "Malware payload", "value": "77078fdea9e0233c94ee42d178b3c5e97013ab9c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777118721, "uuid": "38b99edb-4b8c-498e-98c3-0b667259d49e", "comment": "Malware payload", "value": "22e6f1580e0c5d52ae9a2cbc4311d346560cb9f6c92e7e34cc93fcce94f5b3f45a48cbff2d91a63fb4ac70847d4eb2d1", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777118721, "uuid": "5e520ea0-c38b-45ac-ae3c-f86106e8b1ed", "value": "T1B79723A2F724DF1FC4BB21B24D6A3136229A0D668F438747A508771936737E84F59BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777118721, "uuid": "d59c8980-c5af-4ab0-9efe-48edb19e6611", "value": "786432:f+ey3GzHr8iZZ3wwZ/FGPUjZfHdWpf0nwJGB+pshVZ9SuDgnOlZ2SAL0rF:fwGzHr8iZZgqlsJJGa+HSuDwYZrAL0rF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777118721, "uuid": "bb1d2d29-68eb-4dcf-a999-1a09d2d5f9d8", "value": 39705312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777118721, "uuid": "bf239112-9a48-43cc-aafe-a8245a78188a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777118721, "uuid": "7f44c8bd-c58d-4e8d-845d-49c5f98b8b69", "value": "maomao2.3.1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "651a1fae-40b8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777129613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129613, "uuid": "d9c1db49-c6d8-4bd9-9053-e96b83833c22", "comment": "Malware payload", "value": "8f1d04a1b8882d53dff8d353843e6a99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129613, "uuid": "68713d41-ef74-4d08-bcb4-cfcae7d0d3ad", "comment": "Malware payload", "value": "6462b9c8fd8416413c866491a348b8fe503c10a75b3a3c25cb40da00f4e5e0aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129613, "uuid": "099a7cf2-aea6-44b9-860d-62bdbeff57cd", "comment": "Malware payload", "value": "e6917a25ec01e08896b072d3ee260658aa362a21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129613, "uuid": "b444333e-cd84-49c1-840a-501f497d7743", "comment": "Malware payload", "value": "38ecf5e08d75a7b3afededafe8d582a38f2d7a534242d0109164872fc3c46dd53f6dd38b2745ad2e4c1a8c1d0e11e11c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777129613, "uuid": "7e2e6ce2-5230-4e1b-a453-e3d61b63a00e", "value": "T1A5476B43E8A544E9C0AAA535C565A263BB717C894B3023DB2F60F7382F77BD09B79350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777129613, "uuid": "817e1328-169c-4d35-a71a-6faf50101eb7", "value": "196608:yRePA6Wq2H2MSNJiHdSQ6gHVRxZtY+wCO38uNo6x8I33BUKA3:yMPA6X2H2IVnxrY+1O3Xpx733aK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777129613, "uuid": "e091e6fd-6b9b-43b8-8bb2-a6eaa6fd1015", "value": 26295320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777129613, "uuid": "91d07a48-8e61-446a-a16e-22a779d7be95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777129613, "uuid": "d0719776-1150-44f0-b38e-38d4e7b01ebe", "value": "vc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a4ba6a-40e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777147282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147282, "uuid": "244224b5-813d-42d9-b6b1-4444c9430ca6", "comment": "Malware payload", "value": "664248d9b1ee735312f8921edacbc86f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147282, "uuid": "bffc9c03-289f-4156-93b8-3407292b2fef", "comment": "Malware payload", "value": "64d00c63707cf3cc150881ba6fa273ba21cb79fbd7f0bfb1f5cedd75eff0dca8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147282, "uuid": "28a3e2f3-6409-4ed7-90e0-4976bf717faf", "comment": "Malware payload", "value": "0b1e4b1d652d4a51ef5b5a1807bc6264621e60bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147282, "uuid": "bf5f8d43-b2e8-4aa3-a456-b784fd909b0c", "comment": "Malware payload", "value": "c344cd84df1635820709b7168a7b41cb68d5d6c64f2747f34f095a77f5a155bb730a06d20449a0b5e25ec14a6af56601", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147282, "uuid": "11be607e-6898-4326-b1d0-beea4aa0e4fb", "value": "T11A6302CB6EB03B27C0D8A1B270381595CD3ADDCAE283C69D97E2A756473943750C8B1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147282, "uuid": "adb82724-bccd-4d77-adcd-8579d897592f", "value": "1536:1axZLmYKVDNSl2y08yumeJyGYVmIMGAE8yNg:1axZLmYKX+t08jmeJhYTVPNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147282, "uuid": "03fbb9d0-6836-4493-8a64-5f8813cda9fa", "value": 70460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147282, "uuid": "1a85d0d3-7c32-4804-89f8-f397b3bbd11e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147282, "uuid": "23d6754a-dbd6-43e1-84b1-83096eb107c4", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e725abfa-40e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777147441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147441, "uuid": "22ee6215-0f94-44d3-abdc-522cc7e6c6b3", "comment": "Malware payload", "value": "4e462a8a927a348eaf0888a34ea5c243", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147441, "uuid": "b283dd91-f8f4-47b1-81f2-d42ff6ffae06", "comment": "Malware payload", "value": "65ebb57686cce29c44ea40c6fb0a826a0eb86f2277d53cea37c6b557cd2121f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147441, "uuid": "cbbba80a-6ae2-44bd-986e-fb386bfad7ca", "comment": "Malware payload", "value": "bf152b93b9b0059bbcf111fcf0e3aca471ab61d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147441, "uuid": "241de5a0-b142-4744-91af-6b031004bae4", "comment": "Malware payload", "value": "d7e40e5626046e33eba5f8f4630d886476671cf4b3f5712a0b9c895e6aa969f8686bceb354a2b0b38cafece1b6b4b97c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147441, "uuid": "22c0180b-89be-4a18-ab27-7a4f49e11639", "value": "T136F33B47B7208FB1C368967109B3CB67A6E6269216E19985E66DCD107F3035C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147441, "uuid": "0083b0bc-f59f-4644-9761-39fbc8df6198", "value": "3072:93VJgTdgahP/2o/ZrTheIsnjCWRXFm4UpM1wLxpPNNOziHbfam:9FJMgWPZr8IaCWReS1WpPe87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147441, "uuid": "0cf6fcd3-69f0-4aba-8682-4d84f38ba245", "value": 166976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147441, "uuid": "e7fcb05d-2985-441e-8f5e-fb273d4ff5dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147441, "uuid": "fc074995-bc3e-4029-bc5f-3629d6daff46", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26517923-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128649, "uuid": "0bc2267b-2dbc-44e6-a843-be87a6f27050", "comment": "Malware payload (Mirai)", "value": "16caa1e282fbced87fb5ea00d928afbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128649, "uuid": "a83de750-80cd-4854-921d-9d0a7b7cac85", "comment": "Malware payload (Mirai)", "value": "67911940123ed6a8e4a94bc0b9580c38dbb8f86d4128ac6ea3d713c0099721ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128649, "uuid": "52f44982-c6d6-4ad4-8171-6c9240c94628", "comment": "Malware payload (Mirai)", "value": "17ebd70e8bc3791924747d0ea80affdfa5540acd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128649, "uuid": "8aa1aea4-e471-4986-ab65-d12c8b113890", "comment": "Malware payload (Mirai)", "value": "9c772afc063ed7094a60c5581c2bd5b1e69300a1d153175097bdbbf431a90858e700305acd9896fe07c3e108e49f15dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128649, "uuid": "f0b83aab-d022-48df-a085-3cd2fd2bb949", "value": "T1F7934B81A5C3E8F1EC05143A317F9FB29DB6E67B3035EE92D7E8AD229854A02D1057DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128649, "uuid": "66eac341-0745-4d80-9737-b39fd846a352", "value": "1536:6KLtcEOx4HzcR7t9YRG74QDipmxQCpMmRUqUZ37KoBree9Dt+EJAY:RhdOx4HZRG/D3xQ2MEUt3Gote0R+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128649, "uuid": "a8d9a54f-5518-4dcc-94bd-a0f8f29c0cd9", "value": 95120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128649, "uuid": "7389f95c-6e94-412b-a932-b5d23b852eae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128649, "uuid": "56aff097-3e31-4dd2-9740-6c1a3a67d0d3", "value": "KKveTTgaAAsecNNaaaa.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9472d320-403f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777077724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777077724, "uuid": "a00cc6bc-92dd-4588-9949-7b7e63ecbefd", "comment": "Malware payload", "value": "6730bddb01c3c48478ee681c5ffe7b02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777077724, "uuid": "ce9e6d2f-6184-48c6-bd50-b6cb07a71029", "comment": "Malware payload", "value": "6794142adbd95dea9b166c156932f1f3799c0e04f9f6565e9b400e54e0ea1efb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777077724, "uuid": "a0949418-c48c-468a-a9e8-2c6c255e9f5d", "comment": "Malware payload", "value": "220cf0693188abd6499dd3ac0b9c6383f23a8526", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777077724, "uuid": "4ab09298-18c6-431d-8488-8999eb08d6c3", "comment": "Malware payload", "value": "3b981f5a78e94863b1ed3f4f9f2ee0c924966e87cf4a1983254e36dcc4657e15e7a62dd87138c7521cfcdfaa50ef1480", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777077724, "uuid": "4835463c-547a-48eb-a5a4-d7c376654c4f", "value": "T13365D002FF816FEBC06FCD30492EC35711EDD9825691A62A71FC4B9CBA9D2590BD3588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777077724, "uuid": "e2f64b0f-7c81-4439-8a78-4364e279f39b", "value": "24576:ZYnr5PrLsOf860KhwVfLeyxek+o6TNX3M0MfHpm3EJCkIe/KK/qyTMc2u9W:ZIrLyrVT8k+vNX3MFvc3Hhe/KK/qyjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777077724, "uuid": "4b1615ac-ddbd-4149-8576-aa4d7b3002bc", "value": 1492491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777077724, "uuid": "12d5ae6d-3ff2-462f-b26c-f4c47a81b420", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777077724, "uuid": "d0177d6c-d9f4-4376-b837-725e7c3c4d0c", "value": "bot.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac0c1c0-4089-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777109437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777109437, "uuid": "0066bc60-d038-4e76-9fe8-964be884f3cb", "comment": "Malware payload", "value": "2757db4877974d015a3f5c31ad7ebc98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777109437, "uuid": "3ae73895-0dec-472d-bda1-9a298e583e1c", "comment": "Malware payload", "value": "67db999e9ab18659c1d595c9112ac9b22065cf05328c156585bda8589d10cb70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777109437, "uuid": "ff7e0484-481f-474d-bf66-b04084f0b6b3", "comment": "Malware payload", "value": "10ec4c2bb0522a1632bf5af8c630e1ed372d2ad0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777109437, "uuid": "d90bfc25-c3c7-4fc1-b9e1-f9dcd0170713", "comment": "Malware payload", "value": "99bb12daaedaf5ac8447ff50f16d0f5613543a968de5a271ad7eb10587b49e852b6f5c128aea04e8ebfacca2ed6f3827", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777109437, "uuid": "594e9ee9-fbe7-4595-b60d-1d9122ce3ecc", "value": "T17BF4E757A89550F4C1FEE134C666A213BDA13499073427E72FA187F10B26FF86A7C368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777109437, "uuid": "4a6f99ca-bc2b-4aef-9cd6-1647238bc5d4", "value": "12288:ciZLBtBn77RD3w2AJK7g9rb/TBvO90dL3BmAFd4A64nsfJEGF0h:ci3nHRD3wC7g9rb/TBvO90dL3BmAFd4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777109437, "uuid": "2a3f6591-aef1-4281-b070-561501621551", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777109437, "uuid": "78d06349-d59e-4466-ab05-65082127bf0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777109437, "uuid": "630360f3-e1be-4b07-ada0-de30e834baad", "value": "67db999e9ab18659c1d595c9112ac9b22065cf05328c156585bda8589d10cb70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eab08d5-4097-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777115295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777115295, "uuid": "b94ef7d4-6b48-473e-87a2-6623cda9ea1d", "comment": "Malware payload", "value": "65dc39ecd6b40c5a1975f82431275905", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Injuke", "colour": "#EEFE40", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777115295, "uuid": "6fb3e55f-272b-4eb8-9603-f63a03fc20ed", "comment": "Malware payload", "value": "686f496d5e1957bfb58e0b47067fc6842f0010d0b4688b61ff5c9a6c7a7b6a02", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Injuke", "colour": "#EEFE40", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777115295, "uuid": "9a18a3ee-3a90-42c5-a97d-1491fe936ac5", "comment": "Malware payload", "value": "5042ce01da1ac676daae791bc4d458ee03707106", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Injuke", "colour": "#EEFE40", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777115295, "uuid": "19e05ef5-720b-49e0-8c0a-c177093c0021", "comment": "Malware payload", "value": "18f38f55c958ff7c7ff5513869edc47ce45f4c2668c91f3a4172b1bc78b0c19495f4a3c01bc0ed7a579ee8395efebdae", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Injuke", "colour": "#EEFE40", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777115295, "uuid": "673b60e5-6ec8-4b08-b9ce-66b569ae691e", "value": "T19C162319D7A404F9D1A7E2B4CE924A03F7B5B80D67B1E7CF039499B65F236909C38B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777115295, "uuid": "7358e3bf-56d3-46a8-9d90-58654df0e729", "value": "2057790ae7855765d51bdc4142e62f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777115295, "uuid": "3409bff1-4ca3-4470-b173-daf947b448f4", "value": "98304:y2qewG4gSeFpYZFVMP70YiOpmYruXiMTjJ2Y3/k98q8NS:sojSIpJKOpLuXHTjJc983E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777115295, "uuid": "2aee2870-9bfe-434c-8a6d-eba63b47b983", "value": 4316062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777115295, "uuid": "65f99ded-e1a9-49d1-b5d6-fa68a377480d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777115295, "uuid": "39d376e8-7d1b-48ca-a17c-d8e4849a332a", "value": "Predator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f9bd666-40c0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777133094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133094, "uuid": "e9c1379f-c3fb-400e-88c2-e2d603cdfdef", "comment": "Malware payload", "value": "c23f1e6cc3147149d7fbe35cba3c9258", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133094, "uuid": "d0eb960f-0c35-4085-9117-7b6e040c544c", "comment": "Malware payload", "value": "6a3b8e012d6c2870297663c90ef7d69636a167b1ebd12fb7f1d7521a32f7f1f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133094, "uuid": "4ff6bc0a-ba46-4ef5-b248-cd192c17793d", "comment": "Malware payload", "value": "7794f427052f7ca0eca24568ba754166fd386388", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133094, "uuid": "32df524f-4f78-4f40-80c8-7cf7581f355e", "comment": "Malware payload", "value": "9851e1b0a3e9b7a22986edaced3139955a7197cb671948b605666b8bfbbde1f285370e1383a9f3bb682260e915e902f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777133094, "uuid": "3fe5ca2c-9dc2-4d2a-87ea-2dc1aef0ded0", "value": "T18A761957B8924942C4E43A37B8BE81C433630EBA8BD716576D05FE383EBE5990E39744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777133094, "uuid": "33ab70f1-aced-4d3f-9bf6-c459c6b9f10f", "value": "49152:4248VO+AGnHybZJGIks9isHZMPlp7XZBJtTp2ehSp5E+:4GVaGnHybZJGIksFcjJtd2eeE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777133094, "uuid": "8fec033f-470a-4779-9d6f-aef1dd1381a3", "value": 7274680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777133094, "uuid": "9af92046-ac13-4331-ad72-ed38996407ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777133094, "uuid": "25c6e1ba-1d45-41f2-af7a-98437d3a8586", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9335dc5b-4066-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777094472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777094472, "uuid": "5eb5f78a-6729-4493-9086-127c5601b4a3", "comment": "Malware payload (Mirai)", "value": "4a06ffe3aa63a576c90a2ba51492a6e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777094472, "uuid": "61e9afac-89b7-48f3-83b4-b72263e343d9", "comment": "Malware payload (Mirai)", "value": "6a5f806b5bc05f28b07aae9e88aa3aea06849aca369b0bd82d07152ece4d6ca8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777094472, "uuid": "bcb95dfb-6272-400c-9448-4c3f22e64ad5", "comment": "Malware payload (Mirai)", "value": "1d4fceb759ea00e90969daad74ce343ec1375aa4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777094472, "uuid": "d30d391a-697d-4381-9e9f-fc05b646c951", "comment": "Malware payload (Mirai)", "value": "03fde557e601c6661b19a36ef789a67cfd9c8d853f7927d8aca9aadb98911beff1a8a9b746380a7c2902bbe1fd22ae50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777094472, "uuid": "52b4796d-abdc-41ab-97a6-917e692c2ffe", "value": "T19A7302D7926A41B4D13327F283F2568871B9FD2B3762AB1301EE50AE7CFB45982305D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777094472, "uuid": "0353d387-7730-493d-89d7-ad74667e4796", "value": "1536:Hcl4if3hAgB83hVQYaJUTp7MLDDqwq07eVD1Xc0imryzm:Hcl4ivupzQ+7KDDqwq0qvXcxHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777094472, "uuid": "a16aa9bc-fd4e-476b-9b6b-141e396a1577", "value": 77640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777094472, "uuid": "b087d43d-107c-4dba-9ce2-9c6232b075a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777094472, "uuid": "7c6c51d9-145a-4917-a925-c50ecb8f9f2c", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a70cf078-403a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777075608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777075608, "uuid": "f6c7f40e-7bd7-4653-8426-2899bb1040fe", "comment": "Malware payload (Mirai)", "value": "e2effd92b45c4dd1d36881f8e5112a53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777075608, "uuid": "20814863-1d02-4f28-97e2-f90365b5a1c7", "comment": "Malware payload (Mirai)", "value": "6ae9d50f69eec3642546e788f22a334a7b16f0cb705ae942e0f5f570102cda56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777075608, "uuid": "4e0f0c2f-66ff-4c75-835a-9b612ad22bd9", "comment": "Malware payload (Mirai)", "value": "aa64d3a6318eadac3ea11737790b465b316a8de4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777075608, "uuid": "7dadbaa8-b3bd-4db4-807c-73f83b09cfae", "comment": "Malware payload (Mirai)", "value": "d81988c6ebaeb5cf4662b9934a9ae9a1dfa55fe27a2998988053ce50e498d2a4dbe59be4d264a3b1a4cb3e8071a1d8f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777075608, "uuid": "706effe8-d88f-4116-b2ac-612a9ca136bd", "value": "T1A8A43A51BD419B26C7D06ABBFFAD828C331327B8D2DE7112DD064B3136DB95A0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777075608, "uuid": "e07c3350-6d7a-4766-868e-756ebab76063", "value": "12288:nXRsK/kvdLrpwjIQjqUJisYGsE83GO61Dsduy/Q7X/T0nKr7Vn5yyctbsagz6fot:hzqKVcma1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777075608, "uuid": "faebe629-4cf2-4a9a-a52a-66a4a1d47e68", "value": 467188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777075608, "uuid": "3697bf88-080e-4b53-953a-0ff9cc3eb9b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777075608, "uuid": "dfa1d630-2f31-48ec-95e4-94d25d03c960", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68682be7-40e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777147228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147228, "uuid": "aa6262dc-d78f-4c79-bfdf-da7bccd56c94", "comment": "Malware payload (Mirai)", "value": "e3dbcf5e054de21e8095e248fcde229e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147228, "uuid": "9446a5ea-4309-4fb9-859d-a18e57e49de7", "comment": "Malware payload (Mirai)", "value": "6c34adbe36691c7f6e6432d84b8bfd542d6e5fe869fdbd38fb626f531cca12df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147228, "uuid": "31bb5184-c1ea-4376-b346-dae0c1c09212", "comment": "Malware payload (Mirai)", "value": "aefd54166a3769c220906b8907819d8f5a16dfb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147228, "uuid": "aa5d3a61-ec0d-478b-b96d-f56be7eedf1d", "comment": "Malware payload (Mirai)", "value": "ecf13d0e3feedfaf38dd94b44eb66ad04649d0ce68fab3ab565b0ae66112e954da0844a9b7c941e7f8e3bbcb96b8daf6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147228, "uuid": "8bc18954-f31d-4106-a081-c6f8c85a6a28", "value": "T1ED146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A99772256246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147228, "uuid": "556cf4ab-ce47-4d2e-b3ab-81306ce34ced", "value": "6144:1R9Om5159ZA0mzoWcz4Mm4ztkES7IKTtB:BZAyFzQSdS7IU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147228, "uuid": "fd3f6dac-946c-4b31-b706-ce0e86d32090", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147228, "uuid": "0c3ab787-f6f3-49f1-a13c-c172dc300a82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147228, "uuid": "deb4e74e-b015-4186-a0a3-a636355e5230", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afe77c2-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128764, "uuid": "c69a4dbc-37dd-46e7-bf28-5289391cb8c9", "comment": "Malware payload (Mirai)", "value": "626c7d4bca74020c4b63c160d4bacd0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128764, "uuid": "17b21343-bc32-4d31-901b-7c42fd092f3d", "comment": "Malware payload (Mirai)", "value": "6c5a99234316120cfee7f0afcaceb51bafe14c9f42ab6c8f1bf211cf72d39840", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128764, "uuid": "6bc6f32c-bc2d-462c-9d2e-4677aec3b883", "comment": "Malware payload (Mirai)", "value": "4444e087c8a83db9c408432d51080c1d168f0415", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128764, "uuid": "498ff116-e7cc-497d-b44f-74b50e565ee3", "comment": "Malware payload (Mirai)", "value": "781e2a14f838743071ba169956869d92e420bb392d1b9a5e151ee039be6423696c46ac84b9499cc325ad591c613a0205", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128764, "uuid": "c93bc0cb-a696-44ee-a6a9-6ec33c6ea18a", "value": "T1F0E3885A6E228FAEF67C873147F74A20976D23D623E1D684D2ACC1141F6038E545FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128764, "uuid": "18e53a67-f791-456b-90df-6265575b7bc3", "value": "1536:p+qTcKot8sp2MKypYz8ZOfGQ+v3eB/hub8mXRCTUGk4onuftL4VxmdbK:pJlybKpzEOfGQ+vEubTt4ouftL4ydO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128764, "uuid": "aa0f26c2-383e-48ef-8cb1-ce4db9fe0f42", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128764, "uuid": "59a8c8c9-dc14-4794-8e3b-49e96dd50a41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128764, "uuid": "30709296-7b3d-4c55-a8e9-40301d082cad", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213c8586-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128641, "uuid": "3d74a7a4-00aa-447f-8558-72c18ea10988", "comment": "Malware payload (Mirai)", "value": "a3272736bb02e69eefe3cf12e1e0b47d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128641, "uuid": "9637fd30-adcf-4045-ba71-51b14a60437b", "comment": "Malware payload (Mirai)", "value": "6cf3afa752de73fdb9e1e232d0507f1626c132243fb5d7c5cfab9221fae80ef9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128641, "uuid": "5ac0d938-1995-47b3-8fc2-640da49b6611", "comment": "Malware payload (Mirai)", "value": "080d8448a0d79f16d1c95371e334891895eeb502", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128641, "uuid": "0e1449cc-3b90-4a6e-8010-def5c2248967", "comment": "Malware payload (Mirai)", "value": "b2d859bbe0636f8e90f31d555b73f3aa3a93f85e687b31220bf1ff4d91e5c344aef728decaa4324b7bbcf3c3644afc8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128641, "uuid": "e7ffa28d-543f-4ab2-95b3-057a8a2fc0b2", "value": "T1C913F100A5497CB4D8306F76FF29C59C37F53BBE62A4B8A72611C128A24E027E1D1E5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128641, "uuid": "e953b6f5-6d47-48b4-9887-79673297e40a", "value": "768:f6pGk1fgz73Wtktq0vXVp9XTGcoIe89K8Mt43Gpjvdr2584OVKS2jw75qdYn+AsK:mYz6tktq0tXT1PeM2lpD/4OVEMqGnezo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128641, "uuid": "71c08bac-7ad5-4a97-a24e-8f2079007915", "value": 41595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128641, "uuid": "e017b02c-5318-4546-b15e-5a88cce2a752", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128641, "uuid": "07719376-6ff7-4a17-8763-ae7359b1ef62", "value": "e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10bd12e7-405e-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777090817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777090817, "uuid": "0e778850-7413-4c11-bb2d-4938556f9329", "comment": "Malware payload (NanoCore)", "value": "83475d27bd262724990590b58cdf1e6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777090817, "uuid": "6dd30918-cda6-4b37-ab50-c7904aab356e", "comment": "Malware payload (NanoCore)", "value": "6d0e049a0d63ca850cf647b0fccddf3c26dd1f724ea117fb80594c8aab5ad53a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777090817, "uuid": "d0c742dc-cd69-49dc-bbd4-ce65cd62d6ec", "comment": "Malware payload (NanoCore)", "value": "f6ece2b362e670a2fc22df6879e7b99b7d8b68be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777090817, "uuid": "f1b0809a-b8aa-43f8-be82-c494553a8377", "comment": "Malware payload (NanoCore)", "value": "299cc7c64c6275ef46c402854a7ed72e5468d14bbdcc86bd21f0bee8eb7c2553ae822fc6844c2a3bd960d2744c9ae3fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777090817, "uuid": "7ffae588-c5d9-458b-842d-4d1adab2b9c6", "value": "T1F014CF1677A88A2FE2DE8679711252129378C2E3E9C3F3DE28D455B74F667E10A070D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777090817, "uuid": "3730af62-5f52-493c-978a-32ac9898bc23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777090817, "uuid": "7abcb666-ffad-484f-a8d2-ecf51a3fcc4d", "value": "6144:YLV6Bta6dtJmakIM5BG1amlMCGx5PkRKMV9z:YLV6Btpmk2G17lMCGzPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777090817, "uuid": "be530df7-1b93-44aa-8d4e-d131548c3787", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777090817, "uuid": "5b332684-662c-47b5-b298-f81cf2bcf796", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777090817, "uuid": "478303fe-50fa-4941-a31c-ad6ac816df71", "value": "theponzu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af986476-4097-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777115565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777115565, "uuid": "2a6b068e-ae16-4735-b6b8-a4775f434238", "comment": "Malware payload", "value": "a60b7363180407d3ff8ead42c1b53183", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heracles", "colour": "#5A9737", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777115565, "uuid": "1309e019-fd15-44c2-b351-99f4d5f14542", "comment": "Malware payload", "value": "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heracles", "colour": "#5A9737", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777115565, "uuid": "6522c7c0-129b-464c-a164-d4e0aa6771af", "comment": "Malware payload", "value": "3872d736cae6bd178458835090df0405f51e3c11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heracles", "colour": "#5A9737", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777115565, "uuid": "2cffb884-3eb5-4f57-848b-37b50397b39f", "comment": "Malware payload", "value": "4424c422e9b962318ef4f281af4956ef6e70ecc8a39c2fe0674557b49705d0ba2b8f27c8d89c680bba0be10dbed40fdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heracles", "colour": "#5A9737", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777115565, "uuid": "fa611e3e-d6ef-4e10-a960-201fc651e3c6", "value": "T108B6BF56E2F900E8D9BBC0B8C6575517EBB1345517309BEB56A08A692F33FE0AE3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777115565, "uuid": "a6ce676d-7e0e-4725-9888-a127b917303a", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777115565, "uuid": "3a7404bf-59b8-46d0-9632-926777efece5", "value": "196608:WdvIyQs3CY9eO8OwcPFGUeuPIzBGuwtq/YHg7DQ:Wdrz7whrQIzBGxTkQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777115565, "uuid": "b26755ed-f4bc-43a0-9b46-f751e59d1e23", "value": 11391282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777115565, "uuid": "4eab4e25-bb20-4878-a3cc-5dc1c57826f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777115565, "uuid": "c936a1c4-7330-4bc5-b9db-cb19fb3868b8", "value": "Setup_x64_x86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ef726d-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128776, "uuid": "474ee7ff-5d07-479e-bd99-dcf57577a692", "comment": "Malware payload (Mirai)", "value": "a0af41ec8f0002df308a2204c85c86b6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128776, "uuid": "34886432-a0a7-4437-94cf-9a8acdf2a38d", "comment": "Malware payload (Mirai)", "value": "6dc04c163a1374d4bc760422bec10476fa05690d810198578c7a287fe6089c14", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128776, "uuid": "7dbc54e3-b571-43ac-86b9-f2a039382b99", "comment": "Malware payload (Mirai)", "value": "3bdbc076ef03d2055addcfa69827b6fbe1a17456", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128776, "uuid": "116653cd-6109-4989-a12d-fd03927e7e5b", "comment": "Malware payload (Mirai)", "value": "f32c2a95fb16cb7b1e3beb8b2f75e34b6880356e45e4fae9b861b443add5746c093a8178cbd1a5a02854ba888355e38d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128776, "uuid": "dd86c9a2-7187-4ce9-8aba-f87f37e2c112", "value": "T19A31A4BFA2F040F3C4029D42FB95A6C5E5CC46D262E5EFB874BC45B2485C58CB9A5E60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128776, "uuid": "5108acd8-28aa-431d-8bae-8929c0ad3f50", "value": "12:Hf2Gie7ee/ZR87EZR+s5BNxoNIh2zNIhyDu6aNCDu6abLDmHb5nb6w7SG:HOJ1bkBHoNI4NIkKPsKPbvmH5jT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128776, "uuid": "b7034d8f-0c5c-4fa7-b24b-fec716612ad0", "value": 1450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128776, "uuid": "9d1ce0eb-84f1-400e-bf6e-c6822d715958", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128776, "uuid": "3bfd47e1-c5da-428d-a5fc-48d3653bf7a9", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6220a324-406b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777096537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777096537, "uuid": "98888633-7f71-4096-b072-17eb16715b0b", "comment": "Malware payload (Mirai)", "value": "106498fbd2af725b8971ce3013c0915a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777096537, "uuid": "8980e312-c8d5-4980-b68a-d80960ab8303", "comment": "Malware payload (Mirai)", "value": "6dd922be8bc12f002b8597cc8a3e17da2be778655d387c3968f6072cf4443df1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777096537, "uuid": "6bc70a8c-eb63-4426-895e-286a30e015d8", "comment": "Malware payload (Mirai)", "value": "19088949de782f0d476e74b1a5b8cd65c3e4d429", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777096537, "uuid": "df8b09bd-61b9-489f-9d0f-e9cf0dd4b305", "comment": "Malware payload (Mirai)", "value": "511cfda34414d9ce250c42ecc05d5bb320ea9fba5444ccfbc612bd7751555caccdf0e9286d0fca78b1c9461abb3d4ffd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777096537, "uuid": "82445c57-eba7-4628-9964-a5c3847dfef6", "value": "T1A1948413DA214DA6E465CCB312673341688F82BB48E636E3E9768960FF2551F42FBDD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777096537, "uuid": "989369c2-6ba4-4d10-a283-7d4c100290f4", "value": "3072:6Yuvu7uDyvoj/d9fqxzX+eUxmphRVp3ULmkgCbp4PIz+joCrG1:6D2yDyvoj/d9qB+enhTp3ULJbibjo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777096537, "uuid": "a88abffd-b8a0-467c-a3b5-547b44050ee4", "value": 423716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777096537, "uuid": "cdbde13c-4427-4d14-80e7-7cca5bcdc296", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777096537, "uuid": "c37ff1ee-0c00-45c5-840b-45c2f5efcd43", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee52523-40b7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777129415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129415, "uuid": "e2994552-7b7e-4a2f-bccc-e6a6df2fe585", "comment": "Malware payload (Mirai)", "value": "db4792281dbe94dd45e3b599935238ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129415, "uuid": "c31222a1-a896-4c30-a932-7a28fe5e6a36", "comment": "Malware payload (Mirai)", "value": "6e08236af6539d6fb654bb7c5cc8634bc2ecc0bf1738733ca2b984feae5bad7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129415, "uuid": "ba484718-36d9-44a7-821b-ce597fbee7a5", "comment": "Malware payload (Mirai)", "value": "f0f8e791952acd86a01aba963ea1ef5d70a4818d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129415, "uuid": "b090acd2-5c78-4e71-be18-df75b19eb147", "comment": "Malware payload (Mirai)", "value": "718563e977f4f9f1f2222101a125c60f14afc2104fcbac017e282032b2179c14fdb3dde53455e125fd466288f01903d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777129415, "uuid": "7f29b443-b9d9-48c5-989d-05877cecd350", "value": "T1AEC533C70B6ED29DD7AA83B89C50DA4560EA066794315B00AFA1F4FF2DC750EC641FA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777129415, "uuid": "8f68d6e6-1a54-4af2-8c19-4ed7155c2dbc", "value": "49152:x2jChx5VWupW8QkvUdjw1IKe/OAbS218QSk4iOLSJ725pegj192SG:sjC9VW6W8QykqIH2MSNk4iwSJ6jgSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777129415, "uuid": "6558fc17-c8b7-414c-9a41-2c68170631f2", "value": 2646092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777129415, "uuid": "57dd6194-375f-4df6-b559-c45fc5243fd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777129415, "uuid": "3c303f34-7abe-4692-ab8e-e96dfbf583b0", "value": "kamd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bea6734-40e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777147261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147261, "uuid": "8dd768f7-8343-408f-840c-e912e8134f31", "comment": "Malware payload (Gafgyt)", "value": "65fc065595e5b4d28ee8f1bac715cc99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147261, "uuid": "99237ec9-a35b-420b-ae6f-5d234612bd28", "comment": "Malware payload (Gafgyt)", "value": "6ed10f9632ae6934f6abc5315697e1fbd30a246445065083ddf785349e1cfbc0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147261, "uuid": "7e02eee6-dec0-4ac5-9ada-231d22fd066b", "comment": "Malware payload (Gafgyt)", "value": "6543c911360031254f9d526044577f128f52ab45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147261, "uuid": "00b29e5d-ee9f-4711-b82a-3cccd6009170", "comment": "Malware payload (Gafgyt)", "value": "111c8e8938b8a9f7d8d050b9ad5b0c8223b10019c9ea1e32c4c08b183656b6d620606a9d40a2e85248002d46974ef5ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147261, "uuid": "3f40bee5-a7c5-47b9-b7e1-c740061323fa", "value": "T100D3C021E4006DD1EC2129F578BA97B80350EE700BDE1582EFFDF95E647BD9438AD2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147261, "uuid": "1d128de2-a0f2-4b31-b150-3286da0ef0db", "value": "3072:PnicTtkAg7FSGp+VJE6AqUjq+c7zAbpb9/xe:PiySSGp+PMmT7zMplU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147261, "uuid": "9f719a5b-cee8-494a-9577-abb5102cfd7d", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147261, "uuid": "dd420656-4d28-485c-9f82-8ea358d9960d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147261, "uuid": "1e9985ca-52a1-4fb9-827c-0aeb987c6751", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d36edd0c-40e0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777146978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777146978, "uuid": "791b37a7-436c-4730-b5a1-323bdc9136f2", "comment": "Malware payload", "value": "c960fb9e10a4bbce0431eee036692991", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777146978, "uuid": "0fb2f94a-4d98-4faf-893a-da432f69a279", "comment": "Malware payload", "value": "6f502816b337a5cf2434e231c8fee9c17a3ece2397e0fb98eb0478c3fd91b817", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777146978, "uuid": "7f251591-587a-4342-ba78-07d3dbcf785c", "comment": "Malware payload", "value": "82e997419881f9e2b255e753020e277bdc45022a", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777146978, "uuid": "8ea50e95-3812-447a-a1dd-71bec330faea", "comment": "Malware payload", "value": "901743336529065c30f752111c704adf6fc7438dba52cee225bdd3d23948cf84f156908a7982aae237d77366852f0484", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777146978, "uuid": "7ec77aea-6477-41ad-b1d3-5e94ba9bf0e2", "value": "T19E653331EDE22AEC46A8111EA0BFADA557900FE25CB4DDAF844928C7476F3C5CD0BD91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777146978, "uuid": "6d93c229-8bfc-47fb-8787-16b5ba5cbaee", "value": "24576:tFHe6qbnjz1xaEMaC6xJH+Ecu+0wZCV2UCL8rdXer/28FUT:tFY/dMaR40wZ41ZCUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777146978, "uuid": "1e400db5-41f7-4641-8190-0e891b89d137", "value": 1530247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777146978, "uuid": "d620c4a3-5a6c-49f6-8b5d-1304efdbc577", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777146978, "uuid": "86fc9907-754e-4cab-b14e-239da4cfa65c", "value": "JHC6AWHS.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded2746f-40e0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1777146998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777146998, "uuid": "c7233121-706d-462f-bc73-8aacd63a85bb", "comment": "Malware payload (Formbook)", "value": "510dba9a84e72004f4ca4c34efe0875e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777146998, "uuid": "7bb313b2-1455-4678-ad72-e2e9f4c7b667", "comment": "Malware payload (Formbook)", "value": "6f52da3fdfb1e1500b18955235c8ffae291872f10071236671419ebd7db7baa0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777146998, "uuid": "6e1ad99e-6dee-414d-8026-5a162589d687", "comment": "Malware payload (Formbook)", "value": "64788c302fc784998801ac832864fdfc9f94014e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777146998, "uuid": "4b7a8b45-f226-4a14-8c13-a292044714ab", "comment": "Malware payload (Formbook)", "value": "220d0116482a5904c7be61b5bd21fc3839ae8ab1426cf19b8948966704044f3b02814591cbcc6ba1f7847e5d2830b47e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777146998, "uuid": "ccaf6fb5-62a8-466e-b743-b8ee72b1414d", "value": "T10B6523317EEBFDFA2440561CA1BEFE7952E37BF2A02D9093C0B15087048D79A8616677", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777146998, "uuid": "36adddf6-0bdd-405b-8ac4-ca41101d66d0", "value": "24576:t8kzwY4Ylbc2CUXI4Wl9a2fcd4Hrwjpmyeh1PikX+DRb2K0bgCBj1PQSPaBdUtb1:t8ilhSDvNrwwQPlb2agjYB0gg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777146998, "uuid": "401182f8-b3e8-4c64-ab72-09843e8849c1", "value": 1535332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777146998, "uuid": "bb910683-c5a6-453e-aaf9-f7f31620983e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777146998, "uuid": "3002c68a-ca90-4df3-871a-966d84d748c5", "value": "ps_33iPwjToFyPP_1776423583841.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3183169-406e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777097962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777097962, "uuid": "0e9bb97e-eaa3-43f7-b4ab-70d65a4ad570", "comment": "Malware payload (Mirai)", "value": "cb706c680c0da7eec029a8a83c6151b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777097962, "uuid": "a1eddb58-2f2b-4cdc-b9b6-de008d051819", "comment": "Malware payload (Mirai)", "value": "6fa6e0b0edc4ddf602176532b4c70894ff84a2fa9587201c967787149cef3da3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777097962, "uuid": "8ee6406e-54ff-4d5e-bcb1-5b63ab47dafc", "comment": "Malware payload (Mirai)", "value": "0b394782e7071d5c9f5dae665a107a5f3342aae1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777097962, "uuid": "7ce51f1f-6f9a-4210-8047-714fabe6212d", "comment": "Malware payload (Mirai)", "value": "d0bf07f6efa338741c0ab25f95496add186c83b661d6a54f6ee60d222ac4e9c35ff393e1247c307aee0af3ec4187c8da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777097962, "uuid": "a91842e9-8049-448a-bffc-4f0a02658ad8", "value": "T1DE747713C8254894E1148CF2226773659E4783BB88D72AF3ED5649A1FF2381F61BAFD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777097962, "uuid": "4952749b-87d3-486b-8071-91b972e21182", "value": "3072:bZk5dxdetsQ+u8F658wjQhsH4WRTS6b+joCdNT:b25kyu8F655LhRbSjoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777097962, "uuid": "63ac833c-5cee-49c2-89da-0602570aa2fb", "value": 358596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777097962, "uuid": "e6895167-9900-411a-b414-c7cfa741e854", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777097962, "uuid": "0cf0c0de-95b5-4563-9274-cf23bc9637d1", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e7ac24-40a2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777120199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120199, "uuid": "08647f7b-d02b-4966-b932-3669833c79a8", "comment": "Malware payload", "value": "eb17f4bbe4c11ea2f1e7cd5a459ddf19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120199, "uuid": "b13498fd-f9b9-4acf-85b8-cf504f41bc00", "comment": "Malware payload", "value": "6fd05650483548823fecfb864518d39cc3bdd437d4f98f7e0c0fbbfd6117a7cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120199, "uuid": "c9a93fd0-53ef-45ab-a225-866e7f35e25e", "comment": "Malware payload", "value": "3079da473d677122617b5d8ea0f0fe2304510f4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120199, "uuid": "cdd08eee-11e6-4b43-af99-39e1d5f7576d", "comment": "Malware payload", "value": "213e45231c7b2ac9aa9535e97d9be8ec86faaa78b7a59996d65ac4a5b5d881f9fb4bccfb887506baccec11bfcda3ef86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120199, "uuid": "aae59eb6-41f3-467c-afdb-8225fb51a9e1", "value": "T11385D043FB1C4422C8571EF0197F43D5F7617A5345F5A22A270E6B672222E3ADAC738A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120199, "uuid": "b7d6a1ec-bf9a-4c2c-a52a-7df0e443b438", "value": "24576:xHUcf3MuHMwp1W6mYSWgZXpAvMyqqPVmdF1gOdCmYiz5Ekp59SdEM09QD1cxS7:xHUcf3MuHMwpsdZXp5T1hdEiC09Y1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777120199, "uuid": "6365be1c-dc64-4c73-93db-2865e4394633", "value": 1708930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777120199, "uuid": "240aa1ce-6e5e-45e8-98fa-78802b1b490c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120199, "uuid": "08cb34ed-ee53-4e2f-9d6f-9ee0cd6a630e", "value": "bot.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3af4449d-4074-11f1-a769-42010a9c0008", "comment": "Malware payload (Adware.GeekUninstaller)", "timestamp": 1777100337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777100337, "uuid": "c3ba20be-8e08-4253-9f70-ea672d0f7ffd", "comment": "Malware payload (Adware.GeekUninstaller)", "value": "234f314f904536e9ea73f52e1f0ffa13", "object_relation": "md5", "Tag": [ { "name": "Adware.GeekUninstaller", "colour": "#D14196", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777100337, "uuid": "ac6bca62-bc96-4383-9fd3-05ee086a8331", "comment": "Malware payload (Adware.GeekUninstaller)", "value": "7142ba9a0a96e7184d8da2d5514d4416191494cc709f424f924ceb26332171ec", "object_relation": "sha256", "Tag": [ { "name": "Adware.GeekUninstaller", "colour": "#D14196", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777100337, "uuid": "58685629-97a2-4475-bdce-15ad555884f4", "comment": "Malware payload (Adware.GeekUninstaller)", "value": "430d72aad2930ef28d9270db87bb14260d3e613f", "object_relation": "sha1", "Tag": [ { "name": "Adware.GeekUninstaller", "colour": "#D14196", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777100337, "uuid": "2378c54b-88be-40c8-994c-8dd9bb3b1312", "comment": "Malware payload (Adware.GeekUninstaller)", "value": "b864061c4ed837caea324bb2899af179f6a5a25522631b6801be8b91509a291d4cc0d72e5c5db9e62ff4d4199e67a8ca", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.GeekUninstaller", "colour": "#D14196", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777100337, "uuid": "741afe9a-bd51-44b4-baa8-2fe584645b25", "value": "T16B669D1576E840E8E073523189569A5FDEB5B9261B3642CF368C5B1F1F336D28E3B322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777100337, "uuid": "75c0cf72-3040-4c04-89bd-aa22582cadde", "value": "5e8cbbcab1ad548c50dd01ff47098b0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777100337, "uuid": "e43063a3-33c6-428f-a9f2-75dd6e224e2c", "value": "98304:3qJbc5xtz+kl/m5lifMc/PKkuExnaZ/l+7Y1rtJKCg85:6Jk+y/mnifVKkbaZ/l+7Y1rtECg85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777100337, "uuid": "29e7fb18-2e07-4ea5-91c7-722a21a81a07", "value": 6632744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777100337, "uuid": "33b5ddde-2e67-4ef3-b025-5b6550d6a336", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777100337, "uuid": "2f7cefca-fe06-412a-a2af-e1aa94ca4827", "value": "geek.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f0dabe-403c-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1777076490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076490, "uuid": "6060c3f6-be7d-4a4a-a6f2-5895789d5f98", "comment": "Malware payload (CoinMiner)", "value": "c2e7efed175d3b248b07240596757c2e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076490, "uuid": "f00771f3-e16d-46e0-af07-eed09986f1cf", "comment": "Malware payload (CoinMiner)", "value": "714f329b1b1bf157c3d0d43af04f74213be84cdfc207a61933a01598b98e026b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076490, "uuid": "b60f5591-a884-4cc9-afd4-6ef8c24b9d97", "comment": "Malware payload (CoinMiner)", "value": "6ec94cc48917fe4911cd791807cb016f801dd466", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076490, "uuid": "720e438d-15a4-4177-b753-bc0fc77fc3e8", "comment": "Malware payload (CoinMiner)", "value": "4a6d3c9c299349738085e9cc0779b0dd229bc32b84a420e146503fd198c1446935de51e649644f7c0e912a4884ea1220", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076490, "uuid": "2520d958-c24a-40cd-9798-3b174e4dc343", "value": "T193B56C027C9105FDC09A773248F23681BB75B8580B3627D32E95AA783E37BD01D7A75A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076490, "uuid": "c2200470-ae6a-4271-9500-a60c30be0a32", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076490, "uuid": "47e89b77-d36c-4635-bc04-77b04425e5e5", "value": "49152:zGO2VxtSwZ2ZCzqxQXlxhbycQLTfSIfssmjV1Gd0:zWpiMjhbycfvGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777076490, "uuid": "1759fc57-eedf-46e0-a286-fb273b6f7bc3", "value": 2485424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777076490, "uuid": "721c5795-ab2e-4266-b944-26ac28064ff3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076490, "uuid": "4c977468-e70d-4ba2-9d88-fe4a205fa21a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f38b0e8a-40e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777147462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147462, "uuid": "a3439912-a3cb-4ab3-a7f0-f9d6ee93f404", "comment": "Malware payload", "value": "698712a7f886977a25006f5f8a4e9b73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147462, "uuid": "975f2b08-f4c1-4955-bc5d-dccf83c6d7c6", "comment": "Malware payload", "value": "71bb7561bd1d6ad79a6b9c481d28979ec36cf4d4cb86ecd8da797a11a8d53c21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147462, "uuid": "841a9ed4-47a7-4b3e-8e6a-9259cd84fed5", "comment": "Malware payload", "value": "f355d0c45bc22f9d346b25cd26921914ac52991a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147462, "uuid": "fc13c759-511b-4c74-8f05-916151b907e0", "comment": "Malware payload", "value": "197a07eb29f913d538ac8822bc84cde4fec9edadec9d13495d0ab999c9717266c6f0eed00e2cffd53d0db5f2b51de16f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147462, "uuid": "bb4809d8-58b3-4fa4-af8c-5885372a29f5", "value": "T141148D68FE4F68D2D2C7E37DAE4A0FA2302779749565C0B51A00929FD5EAFD488D0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147462, "uuid": "0f0348df-a884-463f-8a44-44fd4f9d93f6", "value": "3072:badBpAIWIfbEdOcdY3rZiigZ2eNRzPxx:bOVfbEdxm4iub3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147462, "uuid": "b26cf708-9c14-40c0-8804-4ee6109a28d1", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147462, "uuid": "8ff9fa54-e3d6-4d40-8985-abba8874438f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147462, "uuid": "1179d4ce-2572-42b2-a7d1-d16698673831", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe055bb7-40cb-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1777138030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777138030, "uuid": "81fc2df2-0285-4fc0-8a51-d7c952b9e74e", "comment": "Malware payload (Formbook)", "value": "9b192a2f3857a9acc39da47efe5c683b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777138030, "uuid": "c22bbf5c-7b4a-463b-8f41-d4f70d0f37ff", "comment": "Malware payload (Formbook)", "value": "72232b891935312980c27ef030e0f8734c0cc446bafba6ceaed3f8044982bf09", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777138030, "uuid": "17a011ae-563c-4396-b3ba-5172e041b4ce", "comment": "Malware payload (Formbook)", "value": "4d70fe7c057998f5dfad5974b573055d27b2dd35", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777138030, "uuid": "ffe43fe4-6c8c-4939-9da8-d9c7f9afdb25", "comment": "Malware payload (Formbook)", "value": "e70bea93e2e496de11c2a036f2595759f60ce8df380aa99da374839de17a9d625204821613c8cb6cd1c0df19aa63a54b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777138030, "uuid": "890e2fa6-1d6d-4a61-a5ea-f30cadeb9f86", "value": "T11E6533B186AC3DF9073C6328647FAF0C97A14A834E38B19B129175DB471DB5AD3A3C58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777138030, "uuid": "814f626a-d5ed-4917-a74d-ef230710ef5c", "value": "24576:hz4j4XEwd9CX8re3ZAMiow+XIB56721cpqw8QhrlYbkXhLUZMDYXOjfFxm7DolW:ue16b2+Ye7fqUtXmv+767f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777138030, "uuid": "a5c8155f-67ca-48f5-bafa-a93ca51999a3", "value": 1539517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777138030, "uuid": "7ea7069f-6389-44ec-9426-b23b0d5e55f3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777138030, "uuid": "b93ba3e2-a467-4263-969a-faa95e3f486b", "value": "ps_acwITg70HO2F_1776434573872.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48229b02-40e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1777147174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147174, "uuid": "44917762-7ab8-4a9e-a947-32cdbe37a3e9", "comment": "Malware payload (Formbook)", "value": "921f0b41c7381bbd03e684d325adc27c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147174, "uuid": "af09797d-2ef0-40e7-b567-023469487b60", "comment": "Malware payload (Formbook)", "value": "7260bf9530e349bb1e8037739ca6ef4c28404f305f70f44087a6156f0c32c678", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147174, "uuid": "f3d61ccf-bd74-48b3-8153-8b0326622b8a", "comment": "Malware payload (Formbook)", "value": "b339a05cb0ec395e533454a2ef15d8c05e31cc59", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147174, "uuid": "6192e6e7-dbfe-45d6-b774-ad916d4f3930", "comment": "Malware payload (Formbook)", "value": "d441a630cf2b2446247055fd608ae3e9c024e526332354b7f4393011894605f6676cebe65129d49b01da264aba97caf3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147174, "uuid": "9116bef0-ca9d-4af6-b595-342af5397ea2", "value": "T13DA66C08A25C99EF14F6BE00816981D22F4E32FEDD35D605B419D9BBA11E4937FA360F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147174, "uuid": "ba0c94e7-48ae-488a-a070-34ad14c5ddcb", "value": "196608:n+JuQ7EAPVGSuh744pwkEh3DuQ19BEd1ME4gVICsHc8p48gjfuCFSQcXPwj58SV9:+JuvCVGSuh7Wk6DuQC1MngVI88uN1STG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147174, "uuid": "83b0aded-0768-444f-83e3-d651b45ee546", "value": 9648492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147174, "uuid": "21209f9e-a53d-49c9-8c14-30b4b3bb2170", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147174, "uuid": "1f51956f-e3c1-4e28-9c88-2514832b707d", "value": "znznjcea.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f47385-40c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777134682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134682, "uuid": "c0709099-c8c1-4eeb-9aa5-b9e16e77e9db", "comment": "Malware payload", "value": "4d98feb61be8ded44ea8a63685882ddf", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134682, "uuid": "abd27322-7b32-4532-ab37-13bec89d49b2", "comment": "Malware payload", "value": "75c7f3cff2e10830cd6885be679c0fa372216fc617c4a4203909ca3a0b02c30f", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134682, "uuid": "56914169-31b9-4590-9638-312cc8bc6885", "comment": "Malware payload", "value": "2d4c68a902d9d7eb8c88a467b5de5e5444111e43", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134682, "uuid": "e0d01516-c140-4a2d-bb94-daa27a04c1cf", "comment": "Malware payload", "value": "be8e10bf289214c339053201e630114a1ab26b5cd289a1979245ecdd7306b6efcb22510dcbdd8a577d48a2f7faa08b99", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777134682, "uuid": "d39d5792-48be-43fe-9d11-78ad3d41656b", "value": "T1F76533762AC83DBD8214D72D907F5F0EE6F32173E84A822BC5D915830B5F685829FE52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777134682, "uuid": "94bd7415-7ce1-4c65-9542-3b2e8ca1bcfb", "value": "24576:GLLLZkeyVB2BRM9ti9PnlBNZbh+uu+xt7D1wouKfuR4WroHYsC:SalyRbh+Epw28Ua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777134682, "uuid": "125939f7-c873-4531-8baf-ea659b7d2490", "value": 1422567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777134682, "uuid": "8b4006a5-5046-4cc2-acea-b8247ef21075", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777134682, "uuid": "0c84b757-5d9e-49e7-bf6f-446bbb9d5ef8", "value": "ps_z3jLKWNXiDmY_1776697632927.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf78545-40b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777130294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130294, "uuid": "6fbaed88-488c-4934-a40c-d2d2a985de3d", "comment": "Malware payload (Mirai)", "value": "b707545ea541de333ea46a7a303b6ac7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130294, "uuid": "e6266ea8-0090-45f1-b541-991f824067db", "comment": "Malware payload (Mirai)", "value": "765b338be709b6126af60462c62d3edbd69ea1672f92a6c1e8c836ac4a0c1c4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130294, "uuid": "3688de54-c760-4348-8adc-833243c3b03e", "comment": "Malware payload (Mirai)", "value": "a96a26eb85c03536422d0ae3ebdf7517f56282c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130294, "uuid": "2cd9efa4-123a-4927-b8ae-9c7b1d8660da", "comment": "Malware payload (Mirai)", "value": "bfe69ef36dd789d00ab116566d0bfe12672684dbf45cfbd6413162477b9c374c880b5865e797c0fe900b5b4b5b5a7d67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130294, "uuid": "12ba4da6-a26f-492e-8006-915896ac3ebe", "value": "T15944AE27F7058C66C06606F98E8B035D1373C0005F1BEBDB7A2C6A386E5769E9D97B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130294, "uuid": "4e611654-6eb8-4bb1-83bd-d1e87bf9cd35", "value": "6144:G/CDf657IhSqhgCsd2+aqNe66Hf8PDQKFm1A8Gmc:G/C74ESm9+fD9m1A8Gmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777130294, "uuid": "2790e11c-55f4-48dd-9b38-9170ce492973", "value": 268080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777130294, "uuid": "a7d93445-fc76-44b4-8f68-151d197f75bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130294, "uuid": "295524d5-e037-46c8-9308-6665c00cbc80", "value": "bot.arc_gnu_2017.09_prebuilt_uclibc_le_arc700_linux_install", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d4aeae7-40ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777130352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130352, "uuid": "1c07cecc-3c4b-4011-bc0b-1d9b29ee947e", "comment": "Malware payload (Mirai)", "value": "f1903ba052d6706b03e10714efc284ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130352, "uuid": "456dc093-9132-43da-9edd-fbdb9579e7e2", "comment": "Malware payload (Mirai)", "value": "76c6edef02fee0bf9de205f5c6f48dc93e8984d0f02462fc0dbb4aaa0fe2ad9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130352, "uuid": "b1b29b4f-4cdf-4ee3-8943-070e1f865f20", "comment": "Malware payload (Mirai)", "value": "1358eba89a9cf9dcd1b9b08850ed87f392911a7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130352, "uuid": "62f33810-0ace-4e13-bf90-51c343c4de28", "comment": "Malware payload (Mirai)", "value": "3e2e3f205e846604338eae896b5d440f4b3d46b55b769faebea36899c126c4678ca4ae282f5cbec7865ec816ebacd9c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130352, "uuid": "d175c575-727a-444f-83c6-8d124ca56851", "value": "T1B0E329416686CAF3D5C31FF612A757220633E83A1B1BDE05E32DBCB45F19188F11AA6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130352, "uuid": "674f37a7-3ee3-436c-bff9-7316af097d0c", "value": "3072:pRleG2jGkKSJ+/+FllVJtt4mnmyanDdrh350BXDfwhc:pRl9m/rJL1nmyanDdrh350BXDfwhc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777130352, "uuid": "87044c99-3282-4684-877b-1974eb263b46", "value": 147224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777130352, "uuid": "25ccd776-1f72-4f5f-9731-ccde1cc1785b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130352, "uuid": "1707c40e-8ce8-4554-b2a0-4f7acde17b46", "value": "bot.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c8ff1a7-40bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777131263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131263, "uuid": "46a8e099-1c99-49b1-8efb-32ecba5ac8ae", "comment": "Malware payload (Mirai)", "value": "2251cbc3403e3685469f0d70f2ee72b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131263, "uuid": "5c12577b-93fd-4184-8b35-58cf8bcd7285", "comment": "Malware payload (Mirai)", "value": "770b034fc4c84cafbb782834e888843aa42da36f6a7b05b4de2a369d993f5489", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131263, "uuid": "e31889e4-3daa-4372-afb9-788493ec049d", "comment": "Malware payload (Mirai)", "value": "e7ba850b590ffb26b4e884522e156d7847ea80cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131263, "uuid": "716cefb6-1f8a-4c51-bcd5-cdda87bd45fb", "comment": "Malware payload (Mirai)", "value": "0cd6c5e28f0e08291070b0ae27e941a2230acf0591e0860b2e7f812221da13dcbfd52ff6c8cc195315dd18b75ea89d09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131263, "uuid": "aeeb31ec-ae6b-49bb-b449-6aedc3dd67d3", "value": "T18C465B55FC2D6462C6C9B6756FB643857239BC488F82C3236618FB3CBAF27548F12261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131263, "uuid": "1cd99242-84ec-4c08-bb23-033f7f9e3ba2", "value": "49152:CVOZh4QKKScbOm7Iz4F6Sc+ZkU+pKajTaRwjo5ExsX:CVsmQNScbezo65RORYaEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777131263, "uuid": "da114a1a-e0b9-45b6-a6d1-bb412a37180c", "value": 5636258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777131263, "uuid": "53a8baaf-f0ac-481a-9dea-6cf90ef3146f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131263, "uuid": "58a741b8-ce7a-4fb8-a36e-228f941191c3", "value": "arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f2e5b17-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128745, "uuid": "e5dfff01-a550-46a6-bc15-cabd518841d8", "comment": "Malware payload (Mirai)", "value": "f9d8a227f81495494984131dea7e6f03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128745, "uuid": "3f66174d-951f-422c-9139-83368d7caca5", "comment": "Malware payload (Mirai)", "value": "774c41f09d9b0fa7e17efe706b777aa4c8af862bf0ab7e33e0e52a23bc7d9a5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128745, "uuid": "de3241ff-a2ee-401f-8be5-e93f95a861a7", "comment": "Malware payload (Mirai)", "value": "7022462854f5139ec484fd6830f1e23704c97239", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128745, "uuid": "6e14ac12-133a-4feb-ac89-d78b4adc2084", "comment": "Malware payload (Mirai)", "value": "e63281a45eb13dc6521224dce9b3bb58e57e03e921528bd97a5a0b0d34d57d4d64dd2da5e8ec42e57455104650621e22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128745, "uuid": "9a049153-7cee-4a66-a371-a3e9eb9ffaf9", "value": "T133730989FD91D728C6C512B7EB1F118D3302A7D8E1EA3203DC245B6476C690E4E67F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128745, "uuid": "d2df2842-32f6-486e-9197-daa65ef5d857", "value": "1536:tjCDjb/jXNciLw/yGGLL10w+rzP+52UE2Es3Xw2ty7MxN:tC/jdciayL10w+rzG2POXw2I7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128745, "uuid": "6ffeae0c-2627-4ffa-8562-946020e7ce4f", "value": 80552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128745, "uuid": "cdd72db1-0c34-468d-8f9e-4a4b106de44a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128745, "uuid": "c9edf09c-97e9-4d44-93e5-2e4f2dd5c588", "value": "KKveTTgaAAsecNNaaaa.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a1940c-40c4-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1777134632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134632, "uuid": "7d17ebd1-b0d7-46cc-85cc-18d98329f570", "comment": "Malware payload (a310Logger)", "value": "f596dcd97db3595c9e670bfab7e004e2", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134632, "uuid": "0e1ba848-f557-4076-9134-caf8446f139a", "comment": "Malware payload (a310Logger)", "value": "779e420d94b054162c161c5768226879d0734d80f35b327b43a8840dbc79e14a", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134632, "uuid": "3023a161-ece1-4a32-b58e-ccbc7135fc90", "comment": "Malware payload (a310Logger)", "value": "f15c15507d813ac1092cc13ee29bba3700a7cc50", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134632, "uuid": "97d104a7-a0ae-4b72-8a79-5a5384e3c59f", "comment": "Malware payload (a310Logger)", "value": "32020c622029f0601003cb114eb50621eaa0f16a1552cabad32479dd7c0ed4ddb5f7fe2ea16ac4a64e5b24e4e890de8a", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777134632, "uuid": "954e583a-dd10-46ef-8584-70fadabc7e67", "value": "T1C19533204FB57DBE1B6CA65C50BFA95E0FB20351486AA297307927C72BBF309C117D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777134632, "uuid": "a139759c-7c22-4fd2-98e4-9fbb8fb99b51", "value": "24576:389GQwXZ7oZqdOr/ooiho2qMFxzf10OAlz95bRyHidtg7CpdIoSY+oz+/PFO6rGX:kGTXZiMokZypH19tgeW3F1iHYHPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777134632, "uuid": "d3262c1a-88cd-4e1d-9123-72daf8a86e0b", "value": 2034192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777134632, "uuid": "c7759f63-a79e-444e-9cda-90987cc2316a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777134632, "uuid": "c87e4ef8-bf42-406c-afd3-21ec91579069", "value": "ps_h89DNHqSXlKt_1776697626287.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de36d5d4-40a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777120797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120797, "uuid": "b817d176-74d7-4a6b-8ff5-f1e52981aa25", "comment": "Malware payload", "value": "665d381b2f44a1fcafab27003980ff3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120797, "uuid": "f824bde5-5643-4773-ae0a-c2b4717f1c5e", "comment": "Malware payload", "value": "77ba2321d72d3be96b2d49651939c8f781cd3d75d97eae94bda7b024b4000486", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120797, "uuid": "d314897f-667d-418f-8880-8f6f78503947", "comment": "Malware payload", "value": "7f63c403c9b36183e654da67daf95a4296ef35d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120797, "uuid": "fc118886-f52f-4462-8d8b-7ae69c89c7fb", "comment": "Malware payload", "value": "fa3389b1f513047a9a84a11f38a40aade0aa9c8ef3064f9c043265ec3ff7db0a147fbb0574c7c67933634bbf4ebcc2f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120797, "uuid": "97400777-d98a-4164-81ac-e1e5a0dc96b0", "value": "T158E46B627711DFB1D354C67009F3C75146E521A20AE251CAB27CC7287A52A2E7E2FEF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120797, "uuid": "dc02aed3-3e62-40bb-b82a-1af31c90352f", "value": "12288:gkzt4D63sL86M5N6hjVLYaNa7CgdP2Ds0e/9IzWWhWWWJWWWRE8ptYLMZNI3aPjw:Lx4D63w8/5IhZLYaNMdPos0e/yWWhWWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777120797, "uuid": "d1ab881a-8fab-4bcb-99f4-4726d196a238", "value": 682956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777120797, "uuid": "dfcc6f37-27ea-4917-a362-f349d3d264a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120797, "uuid": "1caa70af-9659-489a-86c1-691003a4ff83", "value": "l_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf201a83-40e0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1777146971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777146971, "uuid": "851d9e32-532e-4356-8d6d-240e77d74d92", "comment": "Malware payload (Formbook)", "value": "fc38bd1117954c7329988d363bb967b4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777146971, "uuid": "0d607db1-1a01-4e4e-af5b-79e7b4352be3", "comment": "Malware payload (Formbook)", "value": "78c2800187465b3e924e70eda2f69b0e0e0c9a843acf6a2506795145e7cf5e8d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777146971, "uuid": "3c75bcab-0e62-46c1-85f4-6caa4fa8b8e6", "comment": "Malware payload (Formbook)", "value": "09ea9e22f17f6f2bc0950537cf7fb3f491f6b522", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777146971, "uuid": "0bba01d8-0cbb-464c-9810-77accfe6f3d4", "comment": "Malware payload (Formbook)", "value": "0941e74f50c3881c2a719e7e3cebe64aa534ea1d625a510661eaebd758e7e615cf38ba189142443d0f585dd9a6434437", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777146971, "uuid": "bdf4f534-b5d9-4159-b6c1-fecfe51bb846", "value": "T16F6533B19D853E3A67B8964974532E3D5BB24B73905ECC9B13921AEB053D382D3CB81C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777146971, "uuid": "c6a058ae-2510-4466-9919-5e41b6b5eee7", "value": "24576:EW/AQx6LYbCB+eRLLl/Xip2mrYg00lkA4iujTzG/P+hgKa+tppUs:NreRLZiqzqIg9+qs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777146971, "uuid": "1becc376-4d90-4660-8c1a-f294ad89458f", "value": 1535927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777146971, "uuid": "5a83670c-2a1c-429f-8606-12e0f54a1bc4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777146971, "uuid": "248fcba7-b7b8-44f9-ad66-6e4968ca03b6", "value": "HODJY09X.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a6e095f-4082-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777106430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777106430, "uuid": "bb42cf91-8313-4308-8366-13b939d16b6a", "comment": "Malware payload", "value": "6ce9ef7aad4c3aa1acf9099a6f2fc071", "object_relation": "md5", "Tag": [ { "name": "agentb", "colour": "#C3F1B0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777106430, "uuid": "81aa9588-3129-4330-a0b9-b3f9b62025e9", "comment": "Malware payload", "value": "7909971ce89b25afa8a4d52cfbdc216f96b028804784881ed98664d606b637be", "object_relation": "sha256", "Tag": [ { "name": "agentb", "colour": "#C3F1B0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777106430, "uuid": "c5375176-3785-4667-907e-b2d8f5485958", "comment": "Malware payload", "value": "7afa853c35db3851c36a9f195bb285958d5a54c5", "object_relation": "sha1", "Tag": [ { "name": "agentb", "colour": "#C3F1B0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777106430, "uuid": "b2618d87-63e1-4bdc-860a-5d5570506fdf", "comment": "Malware payload", "value": "f6dddb6249497ea54bc7c32d28113f8977c5ae5ec83038daa40f750077408392aa49bdee8ef9c339c08b7e8c940eb380", "object_relation": "sha3-384", "Tag": [ { "name": "agentb", "colour": "#C3F1B0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777106430, "uuid": "071dadb6-03e7-4c56-9bd7-14c73877bda7", "value": "T1E7B6C88FB674861388E263B5B2063973BE2BD435479983367CEDE435319F07E4A628D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777106430, "uuid": "84ee0097-4003-45bc-987f-c7d44ed542fa", "value": "5e8396e22fd6519d4a0cc04da5a8b346", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777106430, "uuid": "2378f456-6619-4c68-bd0c-936fda505da4", "value": "49152:iTuWG52y3kFP86EImAibAkE8oo/LVM4fi5JVti55iuhJz+asfyOCLlQ+2Iiu60mn:ialQfOYdnXYNI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777106430, "uuid": "1be80485-1552-4c61-a0c8-56ec31f70835", "value": 10997760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777106430, "uuid": "78796064-194c-485d-8f41-59104259b8d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777106430, "uuid": "57f1fccd-c1f2-4de1-bea5-ae5d33ed1ae0", "value": "version.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dda19b8-406b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777096503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777096503, "uuid": "64ce0710-391a-442e-a38e-814b3bc4bb7a", "comment": "Malware payload (Mirai)", "value": "4e9a2b912a77bc5882317ea8155c68c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777096503, "uuid": "8f542987-0964-4761-b089-082b91991ba9", "comment": "Malware payload (Mirai)", "value": "7952507b8a216c9aacb7e0df682693af067b3e215a593003d30d7d64380779c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777096503, "uuid": "19fa452d-4c32-4897-a622-e5734538bb6a", "comment": "Malware payload (Mirai)", "value": "8a5b6ed892d6fef53f5a46c4939591aac50c5c4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777096503, "uuid": "19a8d42b-d1af-4e6a-bc56-046e9b403794", "comment": "Malware payload (Mirai)", "value": "b7acaaea289965d216ade669803383b0a8f283407d111907059ebfc6af3fdf584f3ce56664376b6f132f1fdfaba4e541", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777096503, "uuid": "ef780fa6-dd86-498d-a885-3e9b52f5c42b", "value": "T10384A653D91688A5F0245CB312273241BC4697BB48E726E3EE6B1962FF3541F41BBEC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777096503, "uuid": "5b1067d4-11f3-473d-8292-75b15ab75036", "value": "3072:2TgUtjVDyrCgp4GBwFjyN3sENnn8egfXIcVKjbiJLyfQPyXp3yf3D8MrGBRqb:bUtEDEjyN8EG3fXIyLy2yXcfDG/qb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777096503, "uuid": "85ef1eb6-0ab1-4d19-9c9a-50d577741f02", "value": 390048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777096503, "uuid": "faec284a-a4c2-4a86-a29a-40e55f666891", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777096503, "uuid": "bdbf465a-3d21-4004-8918-290f671fa723", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e14f160-40e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777147238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147238, "uuid": "864e59a7-896d-4f53-8d30-2d8008c67582", "comment": "Malware payload (Gafgyt)", "value": "022c39fadee6a940776ef77dbb0691d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147238, "uuid": "f40ece92-9302-450f-8063-4dda150b4d4d", "comment": "Malware payload (Gafgyt)", "value": "797a7c7e8c643b93b512850bbb60703530adc058769ff4897e4c17ec04c7d9a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147238, "uuid": "3cfb5f19-37af-4537-923b-8d49d38e3e95", "comment": "Malware payload (Gafgyt)", "value": "13dbc95dbf2233c93e6350f33f46bb06a7cd40d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147238, "uuid": "1b061e0b-df3e-433c-8255-115ea66177a0", "comment": "Malware payload (Gafgyt)", "value": "b33c2c8a67b44a7ae9e495ede8d43709dda5a147064114c774e72f0d5c3a1ea1b0a25a418f868b074c0ec640084e5402", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147238, "uuid": "2853fea6-f401-40f9-83c8-6f5438577f1a", "value": "T19804392F358191F0F6411B746BCBD3976C390BBF51A9909F6B416329B6E0B7BA02C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147238, "uuid": "4d3d8c0d-dc81-4f3c-89f9-485ebc18fd9c", "value": "3072:7mPX5bl7RDfPIX5eG/L1AL0SFU66gOSNL9CnNgRdgJi55wJUXS:7eJpJUVD1A8n0YNgEJi5aqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147238, "uuid": "ccad012e-8de1-420b-ba66-6f5da51ab3d3", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147238, "uuid": "286da2ba-fc6c-42a5-8b73-343c15b2df95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147238, "uuid": "497770d5-12bc-400d-9270-e0ae8d6b7ebb", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72fff1c5-40c0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777133073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133073, "uuid": "d535a8bc-85c2-4875-9753-f879e119fe99", "comment": "Malware payload", "value": "e650678fc92fa63cfba3d9922484a102", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133073, "uuid": "098cb5d7-3153-40c7-bc54-f8f74c77be84", "comment": "Malware payload", "value": "7a64a0b0bdc4d814427eb3ecfdb6d1e1ddee0cbb62e2742b754b1c6b1527f52e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133073, "uuid": "8771c60a-ef31-4519-a4bc-47f649877282", "comment": "Malware payload", "value": "cba0d382df2a7a6c2283c26a95d6ce36b2eddf9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133073, "uuid": "69e1853e-4119-448a-96cb-7edd5dd4a341", "comment": "Malware payload", "value": "fdea82792ce247064e735572cc1d03e7204839b52e35f1c8d8979f59625d7ea471208a399236ccc58a001b2d96b56dcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777133073, "uuid": "bc0a6755-ddf5-4a6a-8394-0e0c58ccf9f6", "value": "T1D3762A87B8924952C4E43A37BCBE81C432630EB99BC7565B6D05EE383EBE1D90E35744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777133073, "uuid": "905af1c1-4fb5-41d9-aa08-a49af4d5af19", "value": "49152:PdZP7fboCPOIQ1EMwlgVinvPbF1mKOjpaUs5cO78g0UBW5Ed:7PXoLxCMwlgVinvPXcO78xUCEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777133073, "uuid": "cad83fc0-becc-4c8d-b91b-5e716d7aa606", "value": 7405752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777133073, "uuid": "68d4f678-4b27-4107-a2c3-da692e792143", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777133073, "uuid": "81b2221d-004d-4c51-9650-e5bf67cb6185", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c20cc1-40c0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777133077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133077, "uuid": "8c426d27-4db7-44a6-8a54-91b310360671", "comment": "Malware payload", "value": "58d12e59676a3e17b07347f26256d236", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133077, "uuid": "12a85428-a7f8-43fe-800b-adbbce041754", "comment": "Malware payload", "value": "7b4e88ec91b89c661bcf5e77465d9d4f1ca6399118d8947c6ff0da7456de1d5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133077, "uuid": "9fb70805-af30-413f-b935-c3c937fae82a", "comment": "Malware payload", "value": "ba26d2e0e649d064b862b4308373a2107b61c356", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133077, "uuid": "0feb9d2b-6f3c-48fc-b0e9-90a882014a9c", "comment": "Malware payload", "value": "50bd5471efadf2233cd613df5e60618a9c84ecc2a65552a8266169f3a3408eac93ff2331eb3d61ac60c5f22f1a7c8b75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777133077, "uuid": "7fac2431-4c50-4d39-ae30-60ab603c71b3", "value": "T1EA762A97B8924952C4E43A37BCBE81C432630EB98BC7165B6D15EE383EBE1D90E35744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777133077, "uuid": "463470fd-c69d-4d55-b108-eaa97ee9bcfc", "value": "49152:32FJs8JfputJ06zfShd92je+5qTx0+q5MuO/9S6P4GFsbmyWkdus5Ems:mputJ0yfed92je+5qZ4GFsKV+Eb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777133077, "uuid": "4eeff1d9-e91f-4a21-a41a-81dcd68528fc", "value": 7405752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777133077, "uuid": "5cde35e0-4c21-481e-8edc-5ca482815103", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777133077, "uuid": "8e88b486-fc59-4836-a193-f83c78d3c690", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49cefd75-4096-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777114965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777114965, "uuid": "b129b3f2-d955-428a-a828-dc2a32d95ae3", "comment": "Malware payload", "value": "2eff3685b268b4eef1a2a16c7210e7a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777114965, "uuid": "17a3a557-d85a-48ba-afb6-99e8756e0bbc", "comment": "Malware payload", "value": "7bf32620992726f5405d8692c66fa3d909f6513f8fb2784a14f8399f6b7e5530", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777114965, "uuid": "016098ef-93ff-4ac4-b421-8b2e27be7477", "comment": "Malware payload", "value": "eccbf8fe0285d4d2e4fe86c82fe988da42489a10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777114965, "uuid": "b66ac033-6774-479c-93a4-c5b5a7b2e2a8", "comment": "Malware payload", "value": "ab3526046cb34d7fad6aa24f18b7aaf0c9bfc3943c57734aac0e0ca98e3c7cc9ee4a7d502f3fc1cd8560ee264969d9e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777114965, "uuid": "94c0c37a-33f4-4c56-b122-221962bfda64", "value": "T190350126FA156F1BC8968278C59BC6382377F0858782B303B644E2397C5736D8F1E769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777114965, "uuid": "1eeb6117-fbeb-497c-9831-7065d1501753", "value": "24576:l0tqcI4qN/1sfElJokJ56nrGn+lANn7vP6e9GSbQ0XTjEdLk4cQUCkTasm:aiN9kiUyn+veYSbsDUCktm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777114965, "uuid": "6cd0e6e8-a291-4cc8-a2ea-a56079598661", "value": 1126900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777114965, "uuid": "309ac70d-bea8-42fd-b32d-8ff8225a3af5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777114965, "uuid": "e385ca7f-8cd5-4207-8ee7-0a6e37987c2e", "value": "bot.riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f752c282-40be-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1777132436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132436, "uuid": "bb5e49e0-e598-42cc-bfa3-9bce85736757", "comment": "Malware payload (SalatStealer)", "value": "779aa98b7efc68661978daa443eaf9ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132436, "uuid": "b85bec42-cb92-47ee-9485-67206c7a3b1e", "comment": "Malware payload (SalatStealer)", "value": "7cd79bb407c0009b5bd6a691fbaf51a71eecd3260aa421feec70c7e0c4cd8f4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132436, "uuid": "76348fbb-4571-45b9-8ad8-ee116f266552", "comment": "Malware payload (SalatStealer)", "value": "ca5266c70d13d87be56f8036ba9359facac912ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132436, "uuid": "24ae27c7-f592-4bca-8c60-1ae27bf97c10", "comment": "Malware payload (SalatStealer)", "value": "2508ca9460bdb2b9717f9c1b7a2cdee9c1de92735058166b6af53f410d8faaaa28aa27cf8e7f8a7d22b1dfb18dc8d38f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132436, "uuid": "5339484f-3ebb-4396-9a1b-1ea38b4db8f4", "value": "T106C66B11FADB95F5E903583101ABB37F23315D048B28CB9BEB547B2AF87B6A11C66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132436, "uuid": "b8a07bba-134e-4920-bacb-c2560c3a3c19", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132436, "uuid": "66c4ad5b-2da3-4bc6-9189-a437fa02337f", "value": "98304:di6DG+DrONCH7gnauC1rBL1J64KG2Z1OE7:lGZ07cq1rBBYnl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777132436, "uuid": "0ba74086-e3ab-4442-bf92-5e58cb3aa219", "value": 12574720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777132436, "uuid": "23f682c8-d2c2-45f8-83c4-37bb3135f833", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132436, "uuid": "283f2025-9e91-41a9-b5ae-66f2a39e3857", "value": "zapret.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e5a266d-40ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Vjw0rm)", "timestamp": 1777138997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777138997, "uuid": "5ae32e2e-4bb6-4289-9292-b84f147b7456", "comment": "Malware payload (Vjw0rm)", "value": "b3b56b57c17852757547593e016d8418", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777138997, "uuid": "3c4940e3-4af1-4906-a931-5e2669009c23", "comment": "Malware payload (Vjw0rm)", "value": "7ee0b5c946e5c01ab62c68fcdeab4c754aace2f4694f12f0a131a6e804658d0e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777138997, "uuid": "39a8a947-976a-4880-9881-2ae661d8466d", "comment": "Malware payload (Vjw0rm)", "value": "505ea00a8f805e5b0c75a2e9c8e65389dd84d33c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777138997, "uuid": "307d884e-3c07-4218-adbb-d34fb046ccb1", "comment": "Malware payload (Vjw0rm)", "value": "c7ab22d66390aa42c19cd183056999cf4c17e57ee9e5083f24ce482770be18127906118d04df60d72c2e943e87c73627", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777138997, "uuid": "46262a82-7dc3-401d-a2ac-23a53d7beb56", "value": "T19843363CEE7B1C9FB2759996A6D044837439B7DBB20E5F8905A6C3E506B370DA468C0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777138997, "uuid": "7d206ae5-a70d-4e6b-a0da-68af246d350d", "value": "1536:WFfccEQ91yfDo6REa48iecFIEoQ3CTvZhxMipKt4b:26RAWSixb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777138997, "uuid": "30022683-1ab2-4e20-a334-449beb5a6d7f", "value": 60454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777138997, "uuid": "49555227-3150-4c40-a944-8c4d8f225336", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777138997, "uuid": "2b8f3bbb-7cd7-4914-a42c-81c3293fad58", "value": "Script.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe82eb4e-40e6-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1777149628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777149628, "uuid": "dc7cf051-42db-4d17-8113-c97e68eaaf1b", "comment": "Malware payload (LummaStealer)", "value": "35f1a9e998e7ef6a52c1390be86084c3", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777149628, "uuid": "4bb8ca8a-86e9-413e-b1e1-30f7d1a3e95c", "comment": "Malware payload (LummaStealer)", "value": "7f626bf4cb03e3f03e27313d2701b70a8f533096d8b1f12e714ddc61fcaf7ee5", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777149628, "uuid": "ab0c81f2-fadb-478a-872f-7ca389f42ecc", "comment": "Malware payload (LummaStealer)", "value": "ae2b5799145a3a4bdea45979e408051b29121feb", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777149628, "uuid": "4a3f31ec-c3ed-408c-98dd-3a5e4c852810", "comment": "Malware payload (LummaStealer)", "value": "40ce5982aebb7eca72ba146bdab993e91d82e9ce534fa2ed24ef1cd51a11aacd87ba6c2d83be834fcc1ba8091aaf77f6", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777149628, "uuid": "13826d04-ef96-43a8-9d9b-4cb6c790f3ff", "value": "T12EB56B00EE87A4F1E8064B3559AB62FF27359D080B325B9BEE803E79BD777915832705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777149628, "uuid": "af945aeb-532a-4bef-9346-4b12fc1c32ce", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777149628, "uuid": "e33ec7a5-0c98-4216-b680-945746f06388", "value": "49152:Qhb4PExB4n5B28z4DWPHUG9ZTtBMobQ07g:ycPE34n5B0CMoxtBM308", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777149628, "uuid": "44f340f3-03d4-4058-8ae2-d894aeaadee1", "value": 2367192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777149628, "uuid": "c0436612-5fb3-4f0a-89cd-ab58de59ca0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777149628, "uuid": "e96e215c-7f0e-44e7-99e1-aa505d7f0f8b", "value": "mixnew22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f0151c0-40e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1777149709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777149709, "uuid": "56439925-7cfa-48e1-bcf4-369e8362dcef", "comment": "Malware payload (Smoke Loader)", "value": "f35d9b6adbd82b2276492a47218acc0f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777149709, "uuid": "87f30366-661c-4056-8cd9-9dabab45d195", "comment": "Malware payload (Smoke Loader)", "value": "805ac6b07eaf9dcdcd719a2a3ff07f1812a0812d3cd182d82f384bef8e950e89", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777149709, "uuid": "777dde09-3071-40b0-ab14-14e127c337dc", "comment": "Malware payload (Smoke Loader)", "value": "f5f537bcea65fa69f1d0fda13562de4a0f27587d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777149709, "uuid": "3013b1ff-86ef-4315-b779-e7bb34e23f2e", "comment": "Malware payload (Smoke Loader)", "value": "76d37d4c05f581133f9c5b60c56ebc4d50ea4db71ef88ab96ed5b57214fc7609de6ad51d6b5c543ac9fe2864509fb0fc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777149709, "uuid": "71b724a2-b43b-4f3f-b325-4267bfabdfde", "value": "T114655A4B7CD108BAD46A933288B6A6917B72F8190F3223D72F50B6783F76BD05935724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777149709, "uuid": "50615bcb-6d7d-4a81-93b2-dbda19d698c7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777149709, "uuid": "586e895b-9c9b-4b4e-b95e-00031fcec65c", "value": "24576:q71An7IzCObqcCgZhFZpd14kZ0UgHuDK/F7FmGiWPr/:q7e7IihFx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777149709, "uuid": "851b8c77-22b9-4345-aac1-e310fa06b19c", "value": 1465992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777149709, "uuid": "10a15709-7a1e-4a51-9836-04ec90931827", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777149709, "uuid": "894c9a18-352d-4956-abe9-b655dd965b35", "value": "t14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44dfa974-40bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777131277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131277, "uuid": "389dcb64-4648-4325-a409-56100396ffe7", "comment": "Malware payload (Mirai)", "value": "77ba1f3980cffba5a2f802ee5ca34ff5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131277, "uuid": "041fed1b-b5a7-4192-a562-c52b7ff48a65", "comment": "Malware payload (Mirai)", "value": "8118ce95ee4d771a757d5c3e7c6b50ac9bc3f275df8cb6177ea8c2e53ac20a79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131277, "uuid": "ec93e698-434a-443c-a6a8-12cdab6ad627", "comment": "Malware payload (Mirai)", "value": "dd3828423e4d90cbe202c58634ad75e97597480b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131277, "uuid": "2f98ea4c-86e5-4559-b828-4cfaac674cce", "comment": "Malware payload (Mirai)", "value": "14d0e7d7946e8e65243e5ec3e2ede3786fa1b5005ae607a0f3fa12f2631752e12b8cc22cac7f947cf94ef15279fce554", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131277, "uuid": "7f60b15f-59f3-4bf6-9472-d1c41b1de381", "value": "T15A561897B9D25942C4E43A77A8BE80C433630EBA9BD756565D04FE383EBE1D90E38314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131277, "uuid": "72b94ec7-9aee-47d0-96fc-cf9ab3ba7eb9", "value": "49152:6AcXw4EUx/CNBcOAoSyqwOwzE5fKizkhO/uWsb5EA:b4Tx/ycMSyqUz3+khUEEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777131277, "uuid": "db2b6cf1-6242-4e08-aea8-d4ecd143b28d", "value": 6029474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777131277, "uuid": "c6c2963a-d724-4485-bc51-fa2356859600", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131277, "uuid": "06c3b032-3175-4c9f-a0dc-4c0268d39bd6", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c1b2b7-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128761, "uuid": "b83c4678-8ad2-47bb-a8d0-23a6bbdef3d9", "comment": "Malware payload (Mirai)", "value": "865f5e521394f9139e2711c3313b668b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128761, "uuid": "81d70465-9476-43d9-a712-957f7e1ce06b", "comment": "Malware payload (Mirai)", "value": "811f769367d4e028dafcf6a72dc48e5e492203546cef1bca3a9f51305de0c776", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128761, "uuid": "12c8e83f-18e7-4f5e-a056-da221200eb2a", "comment": "Malware payload (Mirai)", "value": "d1e936c13c5e106a062a14c74a32eb16e090dbee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128761, "uuid": "0e1793ab-973a-44dc-9cbc-006686ba5717", "comment": "Malware payload (Mirai)", "value": "84e7b5536695cb137073c0cee61e1c7589b6179dee933e30b99c77bfe58ee862b2cba2ffa74cb3e70ef0352d685bebab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128761, "uuid": "73464932-a263-4906-b787-98add096fd2e", "value": "T18E937D65C2F49C84C1244EB8769C9F7D9703F90166632EF2D28AC6BE90479F8B6903F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128761, "uuid": "8fa0c6a5-38d9-4587-9643-d79f592f72bb", "value": "1536:ZZ+aHEYBx/KcgvcN+7OvHhlnbrMk5+RbD3A0NKHkpZ91GQcC7Qed1J:Zj3McNJbR+RDw0UHusQc4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128761, "uuid": "36543752-8071-4f12-b518-1f883d897f04", "value": 95424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128761, "uuid": "72e9cf65-a7bc-47ad-9cf1-09277d9b24ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128761, "uuid": "a18fd5a2-eec4-41ab-8be4-de6e5e6459bf", "value": "KKveTTgaAAsecNNaaaa.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f022c80-40c4-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777134623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134623, "uuid": "b352e04e-abee-4cfe-8ea7-95d1884ba41d", "comment": "Malware payload (AgentTesla)", "value": "c0d5bdc7114993ef7ad91a34ee7505c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134623, "uuid": "1867bc39-eb26-4e5d-bdf9-2b9aea752ceb", "comment": "Malware payload (AgentTesla)", "value": "83d1ba8f9fec5a008453b6075bd792e4a804529f1adc6bb71b676249f7b75c41", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134623, "uuid": "149dc1d4-4082-48e0-b870-b5b714312b39", "comment": "Malware payload (AgentTesla)", "value": "006c81d1e0cda4f11d38454146d3b39a9b9b79cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134623, "uuid": "91dd5a3a-1e8f-46ce-94b6-e4b1b3e8294a", "comment": "Malware payload (AgentTesla)", "value": "77aa1049eee2b9ec5dfc0943f1f9a4d01dd3bd02d01c4ac44b7cc4fab8b8bfb9310d3cac8185171fd5ce034a6f46b726", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777134623, "uuid": "52f64617-a41e-49f7-bd98-f87146eb8fd6", "value": "T12B353339DBC6FDAB03A5420DA677BA4DE79B0F420C64D0999BEC21C50A31FA19CDA117", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777134623, "uuid": "76762db4-d87e-497b-807c-cd65450c470a", "value": "24576:na6H94glW0LYGloyyzj3HG7I3RtuKzpfZAAtjbn5AfYeZrD2BI:t55lxaj3iUpRAq5WYeH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777134623, "uuid": "14f46954-8756-45a6-bd97-f492f29c7ea8", "value": 1106897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777134623, "uuid": "669d8d7b-9f5d-4030-849a-86550feae34f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777134623, "uuid": "ac180e24-fc74-441a-85d4-f43b0ecfefe3", "value": "ps_7U6PFN2pL6UV_1776435417693.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "155e4c21-404a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777082235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777082235, "uuid": "ad111dff-b21d-452c-8d87-740530bb0d05", "comment": "Malware payload", "value": "2c287d55361f12841990e42909ee554f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777082235, "uuid": "38de4ebc-2ffa-4073-9351-cb6fac9a5bf4", "comment": "Malware payload", "value": "83d254b42b6d447d93585819ac5e0165e729b247e63fb658c3d2e5c1c1acdd00", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777082235, "uuid": "9bb1088e-d748-49d3-9168-3630e0789ca2", "comment": "Malware payload", "value": "c6a51b8dcddf29a2bae435db3373257f5452a2f9", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777082235, "uuid": "7b5c8723-2ad8-4051-bf30-a9ed9ee48ced", "comment": "Malware payload", "value": "7e6a8c1344c62ab210c5c80fb99827bc28942fe22aee784b43780b068afff3647832ac25780d4a2898fcbadf036f6f5c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777082235, "uuid": "fa09545c-afdf-4005-a552-e28a0217a3ae", "value": "T1FEC63305F42D0C29E9F272BC3D49C30A38353C649B12C11BB6A1733DBEB7AD6A7595A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777082235, "uuid": "ed498ffb-710a-4844-911a-45a3bc523b24", "value": "196608:HuRzeRL7WqwC8mVrJxIMuJ1/UtDOy+0vrmueA2G4vy9GTsK90TNFqCG8Znvatg+8:HUz8iqJZuJ+tqTambA2rhTsK90zq+Ctq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777082235, "uuid": "4a23e5f5-a00d-454d-af54-225bc1ae60ab", "value": 12221331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777082235, "uuid": "7e77f3e1-9d5d-408c-b216-917eaeef3708", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777082235, "uuid": "9ed76bda-2db6-485b-b6f7-6133e465d127", "value": "signed.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e48111-40a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777119500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777119500, "uuid": "92aedf75-b2ac-4b71-aa29-3105b71f1e47", "comment": "Malware payload (Mirai)", "value": "4fb22948b2c2753e9fb133cbf5c13515", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777119500, "uuid": "2aa02ede-67a4-405d-a3cb-3fdc0f038cff", "comment": "Malware payload (Mirai)", "value": "83d48118c00aad4d9115e5db627cfae457a622a40dcafa4e923dd61fef88d04f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777119500, "uuid": "5fa17620-317a-4d0a-a732-297eaf4c1266", "comment": "Malware payload (Mirai)", "value": "5d140a5cc3fa58f68ffb054cba1fc7cdd532464c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777119500, "uuid": "c5e72453-965f-4883-8b88-2c1d14970c47", "comment": "Malware payload (Mirai)", "value": "0dcc14e99b6be2fc75e82588685cccd236c3e948cacf639a55d50d8b6982657a10ee7c0dc03b0cbeee56d363b2cb36ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777119500, "uuid": "b592f994-0207-46a9-8540-31a9ee37f915", "value": "T19E65E05BFEAE3C07C2D6E23D9B8AC3B1532BB191D32352527581432CD9C6AE8CFA1551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777119500, "uuid": "d5672d91-f722-4be5-a35f-e517ad8e969b", "value": "24576:dJ9uTMBCNwyCeThYVf+QcNeeAq37FXnW1H3Bth5K95qgOAQHbjEKn:tr+of+Z1xXWRr7iOdPES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777119500, "uuid": "00c3d9a8-30c2-44bc-8b31-a678e5dbc946", "value": 1425194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777119500, "uuid": "9c8fd1b1-b1da-4b33-bba9-975bd0c97f11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777119500, "uuid": "67479e3c-53a9-4c86-9730-96c400318b2a", "value": "bot.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "506a0281-40b1-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1777126572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777126572, "uuid": "b7dd824c-f48d-4e6f-a1e7-a3f7085e56a1", "comment": "Malware payload (LummaStealer)", "value": "47204e1f890fba6a8a443ed29a57ac48", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777126572, "uuid": "91a832ce-16c0-47ba-a5fc-d7a65dbb527b", "comment": "Malware payload (LummaStealer)", "value": "849e2b3eca78a698681398d83ef4789487ec00408c5f291cba2c59da15ab1bce", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777126572, "uuid": "25fc8718-17e9-42c0-b161-1aedf3305874", "comment": "Malware payload (LummaStealer)", "value": "b93892200d21fdb5f7ad1e1d13fbc218558258c2", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777126572, "uuid": "27631670-e745-4824-8f34-243c57c939d8", "comment": "Malware payload (LummaStealer)", "value": "a659ed73f95e25417fcda89e6397f834267c3d1f290406b22bab9652ccb24e91d34b850ab726678f675ac223a0138089", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777126572, "uuid": "dc7ddf17-0ed7-47fa-be31-2941fab15671", "value": "T127A57D90ADC318B2D5423235586772EF6731580D0F3EE697DEA17DB8AB3FA925823305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777126572, "uuid": "e51f5171-a7cc-4d46-995b-182ac492216c", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777126572, "uuid": "643102e6-cd00-424a-831c-6994c4676a84", "value": "49152:DO7gBEP9ab3HRR6VzJLQOZbooVvNJbsuWa:68BEP9ab3fiNQCbllNCuWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777126572, "uuid": "961bde04-a85a-4453-8375-9f8a8555f049", "value": 2137088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777126572, "uuid": "ac21b703-627f-41ab-bb27-0cea45a083ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777126572, "uuid": "76048650-d297-42ba-8181-23e04c1a3512", "value": "cx-programmer 9.1 free download full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "520aeded-40be-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1777132158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132158, "uuid": "972e709a-3b88-491b-a0cc-510ebb1f4869", "comment": "Malware payload (SnakeKeylogger)", "value": "64f036bddc9f8e294434b15ec1e0e7ef", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132158, "uuid": "4b3d2ac1-7f2f-4cdf-af2d-ca7b4412c83c", "comment": "Malware payload (SnakeKeylogger)", "value": "84ae4d3d39fa01c512659e6aaf5546f3b767d59a6dfe1fd7821c6da92c7743e9", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132158, "uuid": "70543fd3-0b16-4848-b72c-17c2b8e960d0", "comment": "Malware payload (SnakeKeylogger)", "value": "0df82903b43935515046d0df738ce6fdf695daf0", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132158, "uuid": "c75c1b41-5cb5-4495-80ab-8fc5b1a79f6a", "comment": "Malware payload (SnakeKeylogger)", "value": "fe697c235456c96476bd91373147784ff1ce0062f77742831b8d572e359169899acebc30116a600c76af5087053739a6", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132158, "uuid": "db28732a-1ad3-4323-8db7-71381c22ace5", "value": "T1BD07EE3DCEE8423EC2B7C929D9CA4A17F85A091B231CFD4A68D773A755271827CE211D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132158, "uuid": "770ca6c2-c297-49f2-99ee-f3d0eb9834f6", "value": "3072:4uFuTJuYiVWZu1l9qhpvIYFv4RziGRLU4ZqwvexvMPw2d+41YzXpMmsh7GrYZNPh:j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777132158, "uuid": "96677766-e6dd-4a5b-b17c-41b926f948e6", "value": 17364572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777132158, "uuid": "0fcaa06d-28ec-4fe6-88e9-233a23b690d6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132158, "uuid": "aff27588-d510-4f35-a873-e09e02d2e866", "value": "ltqai.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "502d3cff-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128719, "uuid": "a15c3c8a-bf51-499e-aa80-169b7e54b25c", "comment": "Malware payload (Mirai)", "value": "bdfd216b579c848849ab98a0c308d3b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128719, "uuid": "afab0cf4-8c08-4d2b-9490-225533109523", "comment": "Malware payload (Mirai)", "value": "84e086ce43c977c310727542442ade3f8742d66cd66aa0a4911fa2f893833bfb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128719, "uuid": "280acb59-6b2f-4444-843d-389554aab604", "comment": "Malware payload (Mirai)", "value": "c1f28c1ac55477fc9cdc86a9a183b351d57388c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128719, "uuid": "4c17b3a7-5768-4495-a3cf-3dd768abd73b", "comment": "Malware payload (Mirai)", "value": "3cd5431d9bc7e0647fc239a6a06438ccb8b05c35f3a8e048a2357df731c811011cc5ae85be08aa3077b5d12d8dde4a2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128719, "uuid": "37e18e4b-470a-423d-aeb6-0455d9e13065", "value": "T1D293F8705889F73CEAB91078E4021AE62A520A183FDDA5E37CC7643EFF753487568E19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128719, "uuid": "0718124c-798a-4471-b222-9c9182bc1427", "value": "1536:FhEIQl1O9WDwKZ4iobnVvy031b+Ge9JVBIVCCfy0K9XSS1:wIQ/O9WkI4io47uIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128719, "uuid": "5d530d21-cd73-45da-94b8-4aec353a4e46", "value": 91732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128719, "uuid": "92d663e7-e56b-4499-816c-5543013840ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128719, "uuid": "c49c29be-088e-4481-9821-d3a3fd05af00", "value": "KKveTTgaAAsecNNaaaa.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ceec1f-40ee-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1777152890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152890, "uuid": "f25844ec-4fb2-4965-bcc8-4b71250ef5e2", "comment": "Malware payload (QuasarRAT)", "value": "8f4506833a3bd89b4d839edef0f20d52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152890, "uuid": "7f29ab6b-8133-408d-9622-17e9f42df2eb", "comment": "Malware payload (QuasarRAT)", "value": "84e44959d7c5d545c17f4c874718296a4ed30436521690fd53c79ab662083445", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152890, "uuid": "999d855f-c04f-41ec-98f0-7c19ef8f6157", "comment": "Malware payload (QuasarRAT)", "value": "c52b9deed12023e3df8080e94db73c18d232c9d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152890, "uuid": "370fa727-124e-45fb-bf6d-5648154e45c2", "comment": "Malware payload (QuasarRAT)", "value": "f639e458f9bfa33ff4bdbaf921d424bc2d529f46ba4c441215520614820142637c438f0b57927524e506d0916705a554", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152890, "uuid": "36a3d40e-6f4f-4920-a9aa-5fa1f3c62a65", "value": "T146873392E32335EEC65BC1388636B6727D31F40C4231BF66E2A0A6723951F36E1BD615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152890, "uuid": "1012c82e-f6f5-437d-92b4-e377efe00762", "value": "4e09edf4d2c143776135d0d82a980620", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152890, "uuid": "051fbda3-407a-4099-aea5-38e00b0764f7", "value": "786432:Zd8HS2ImjexmMSqVYzo59lqyFQqYXEMTFKB+gXJOP2:QuKexlSoYz09lqyFQDKrsP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777152890, "uuid": "ddd2f77c-5da2-475e-8bcc-8ef54538e5f2", "value": 38110120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777152890, "uuid": "e06638a1-2aae-40e7-86a5-5f2789108531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152890, "uuid": "a1846f4a-9597-4c7d-bd0d-821ba2cfda0d", "value": "LetsVPN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eba2cd0-4072-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777099484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777099484, "uuid": "7ec08f89-0ec5-44fb-aded-c0b5d47cc245", "comment": "Malware payload (Mirai)", "value": "3b9ec739dc19930149319296ccc5ed7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777099484, "uuid": "902c3097-9561-4ddc-a1a1-791c7067bd2d", "comment": "Malware payload (Mirai)", "value": "85fd9f2f65e1adf5dbd70c0cbf1259ed05f0b972870abf73d65d76a607d2b759", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777099484, "uuid": "aa6e4e73-1c88-4d02-9958-c8216b2fab54", "comment": "Malware payload (Mirai)", "value": "b90bd01493ea35cc832c8ccb91b03ef793d72ea1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777099484, "uuid": "c218c7a7-f434-4658-9700-edfea00c2e24", "comment": "Malware payload (Mirai)", "value": "49a2134c2753f52eb274205971b9d850870ffcaa0f6932e70c26c3ca6b520b7fbdb87cc2ee8dd88a49d98480dac933b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777099484, "uuid": "933bc197-d3e9-49b6-ae00-21a94625e91a", "value": "T1E194A6179D228A68F1248CB213773241A94B53FB48E661D3EA6E8960BF3091F517FFD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777099484, "uuid": "5a3da5e5-af56-4d36-b574-9275bbd4bdb5", "value": "3072:xqlZWqlv+u9R1ZddqD13tmGpnUbjo5WfapZPGkUFFK+joCs6QUIE:MZWQ+u9R1Z3IijeDpskUjHjoL6QUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777099484, "uuid": "efd416df-cb10-44e5-ad28-41274cc6593c", "value": 419652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777099484, "uuid": "9dff59a9-a215-48eb-ac62-de907d9c9447", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777099484, "uuid": "263754be-0eed-4a59-9196-6376cc72be71", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5739b4ce-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128731, "uuid": "960f38ac-54b5-458d-9471-2be7cfd698c3", "comment": "Malware payload (Mirai)", "value": "8ddbbe6f88ccd841266f4db9faa4b873", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128731, "uuid": "c86f5c71-1a1e-490a-81b6-1d9945b4de08", "comment": "Malware payload (Mirai)", "value": "86c95567fe7a83ef1ccdb3198079c0e82f30af19f82b522261af3a969519d001", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128731, "uuid": "0f68fc6e-32de-48b1-bbc9-db352db4948b", "comment": "Malware payload (Mirai)", "value": "1455a91214041dc6627059dee1ec14f180edf625", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128731, "uuid": "e7ddbfac-75c9-41e0-ab9a-b159a0a5cc17", "comment": "Malware payload (Mirai)", "value": "22729fc141e8f47f5844502ea27951626e9a065a3528d6c5ccc24b44dc57929f3c5555cab323b3d406245e55f2440c0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128731, "uuid": "4d27502c-96aa-4f34-bde1-6aa0f1f22b41", "value": "T18214C70A3A228FEFF56D877147F34A30976976D627E29684E26CD5101F103CD681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128731, "uuid": "5d9b7a9a-0361-4d14-80cf-0712b959bd73", "value": "6144:4q6eQCbeoufx4ydf2dp06GtCqjYW8nY1j20WI:kely4ydfap06GtCqjYW8nY1j20WI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128731, "uuid": "25b371c6-ebb8-46a7-bf00-2d7bce9b866d", "value": 202077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128731, "uuid": "8e3cfb58-4374-4e90-b930-327802ccfd64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128731, "uuid": "72dba292-a281-4152-9a74-0663d94a99dd", "value": "iran.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0d351ca-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128855, "uuid": "c74fc1e7-c0b5-405c-9bf8-15594ef3f46d", "comment": "Malware payload (Mirai)", "value": "cee15b70869d1acf996aca2d4e87e6d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128855, "uuid": "954603ab-246a-4fb0-bfc3-41a74348d13e", "comment": "Malware payload (Mirai)", "value": "878000340e3e4b03c6b625db2a76636c10cc3298210c23dd84c79ca277dd6fbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128855, "uuid": "08649d43-d307-4030-a4f5-89756f9aebca", "comment": "Malware payload (Mirai)", "value": "807bcb547d084253f504ca2df86097675b7a32d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128855, "uuid": "24c13ef3-ad8d-4cea-b3d5-161182e7ef72", "comment": "Malware payload (Mirai)", "value": "277b85d74b0b7caa906451bb09b94da2ae586081becd8a5c6867a9564b9cab6c8b042f1d9c04ecc62bebad4ae22d4734", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128855, "uuid": "2b5f3cb3-6ddc-4ab5-8012-6c19c86dda71", "value": "T102C45B55A8409795C1D02BBBFF1DA34873132B38E2EFB1069D196F646BAFC1A0F7A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128855, "uuid": "950e8373-26ef-4275-bdbf-8246cf1c8bb3", "value": "12288:4CDBzxro4fwGECjV6XHCbLURLEeK9RUVZQQxJlpiMGSC4fpXLNj+wRY0g:lBzV7ECcXHCx8VZQWit4BNCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128855, "uuid": "e8e4fd84-558d-4411-8559-86ddb1459286", "value": 566708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128855, "uuid": "11de6ca3-28ae-4bb4-b508-c034183e8328", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128855, "uuid": "d91cabdb-2c7b-411d-8996-f338cfa42db2", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b688bac-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777128604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128604, "uuid": "ab550923-9382-48d6-8ce5-c0464244c39e", "comment": "Malware payload", "value": "5d14f7cddfd8aa363a60ecb0e6ef81a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128604, "uuid": "7c144ff8-0cb5-4a88-b54f-ea28e0caf03a", "comment": "Malware payload", "value": "88b0368cd20479afe1ddbf31f4e2a947b2095aa6a8ec1d44a2f32324ec0a2750", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128604, "uuid": "5b026016-99a3-4096-813c-4a1972170909", "comment": "Malware payload", "value": "bcf3b58c8c18eca8d0dcd33f3e6b5158e4bea727", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128604, "uuid": "8dd748a8-ae76-44b5-8ec1-9077bbcaf09b", "comment": "Malware payload", "value": "089ddaabc0863b24001957c90107e6b167fc4d906a16f8d69f3837cbfd30617766d9ffd9665742878ded438b58e94392", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128604, "uuid": "bae0808e-3da0-4f97-a598-29608f4e9169", "value": "T12B860805AD853BEAC42C5E7444FACA5522B06D140AF2463A26A4FFE9BC772757F078CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128604, "uuid": "749e93af-3d89-47f2-88d0-88b26c67e222", "value": "49152:YERao1iP5HJZcUlLe0CQpT9EBIFPCiIE17Il8Z6w2vY5EP:EILQpMGImD4w8qEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128604, "uuid": "a23e643d-e51a-4be7-97e0-e920e7dcc3e2", "value": 8126679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128604, "uuid": "b41a5909-640b-4fab-8eb3-6509dd5cd268", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128604, "uuid": "a5589792-c105-4600-845b-2b3a43041592", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de2b42a-4045-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777080156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080156, "uuid": "3d83c5a3-0f6e-48f5-9584-82c4d9778cc3", "comment": "Malware payload", "value": "a68a5b625e709aba6d02a3fca5194d6a", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080156, "uuid": "80d2f429-cd1a-4fec-bfcf-752952319211", "comment": "Malware payload", "value": "88b90c5f1a6fbd75c73b51fc2021d23ce4a6e0df10ee829a09080795aede2f82", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080156, "uuid": "ea9e78bf-95d4-4ea0-961e-7f30ce1338c6", "comment": "Malware payload", "value": "9875483b336387934252c390c78dc934b8fb9fc3", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080156, "uuid": "3c396e43-5981-4942-804d-3669aa4ef388", "comment": "Malware payload", "value": "f8db5003a56b6606d139e7ac61335da4575c69b3a0defdeae9953b9e313b8859c54c3b301b56aaea79d6d45776aa6fb7", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777080156, "uuid": "8dd9e78c-e508-4d2f-8289-56537bda2407", "value": "T10AE0AB00B9109679CAA2B56093C27FB0CA77C25C33291201336FCB0FF208A1F907D3AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777080156, "uuid": "47fcaa2b-4d63-4aec-ace0-bac5af8ee9ce", "value": "6:jt2cVeDuwZH1j5tjo54Gfrvny1R3KbQO0c+EkjAuBn2nK4sKm3ZX5d8ZX5SqG457:jZ0VVjWzngkbQpc++e2qZz8ZB77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777080156, "uuid": "f4262bc7-1d11-4143-94aa-4c640b624def", "value": 423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777080156, "uuid": "a26cd215-c5a2-4afa-b35e-56b49d49a581", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777080156, "uuid": "8720479b-acb0-4ba4-bae2-8cd82db8b72b", "value": "wsxdf.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ef99d0-40cb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777137997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777137997, "uuid": "6a7142da-0159-4d06-aa66-ac6b729e80f3", "comment": "Malware payload", "value": "0f5e545d9685358fae94293ae29399ad", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777137997, "uuid": "c6b3c18a-8132-40c2-957b-b7b73318af2f", "comment": "Malware payload", "value": "88d926377f6f8ea1500b4dbc2cfaed1d64f78206e9901e81a999acb81857d5ca", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777137997, "uuid": "f1ba0ac1-83ea-4dd5-811a-48a095863cbf", "comment": "Malware payload", "value": "903c9c0613ad430a7ed89949261993af31915df7", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777137997, "uuid": "fc79ffb5-6f51-4e59-b1bd-5d389c5a0c0e", "comment": "Malware payload", "value": "e6aab28002e958669fa10e826ecf2c54572df0573b93fd003b6ca70b28f0ca06153eaeafd7cb7e289995667d655133df", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777137997, "uuid": "13ce5a71-d873-4e39-bb67-0da3136fab42", "value": "T1E653EFDE60798F1E8B3F19023BEAD95A19493CB7F0E01E167CA8F4E06448A51273BDD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777137997, "uuid": "e0d98a83-eb88-43a6-b892-f27bd2b06d93", "value": "1536:g0prY6OPgCsfvNcFhugwtqDRyJ20c8v8FHc9t2Mnn:gkU4CsfCFHwgVqhv8thIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777137997, "uuid": "74b58094-6004-4961-82aa-954faffd9326", "value": 60725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777137997, "uuid": "ace947aa-0e44-489a-80da-4aa8fa5ec90b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777137997, "uuid": "a4438289-c0a5-4303-92db-61eabe7159b9", "value": "ds31087.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa05ec8-40ab-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777124147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777124147, "uuid": "ca126651-27e9-4ddc-a163-b293cdcbc0ba", "comment": "Malware payload (AgentTesla)", "value": "2d29fde2244d06705e3ca5a17cb0a5a4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777124147, "uuid": "1963da24-1baa-4fc6-b70e-94e38d7a1b44", "comment": "Malware payload (AgentTesla)", "value": "897f4bd1789b9bb43ddb0bdc06a84a7c62d77183740be173d211f74662f359d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777124147, "uuid": "ea69704d-3cd1-4465-92cf-739c61cef2ae", "comment": "Malware payload (AgentTesla)", "value": "16bab7a41f588f0d34908390d5cf81193181a234", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777124147, "uuid": "343389bd-e57a-4a32-aee1-07f06c700425", "comment": "Malware payload (AgentTesla)", "value": "2930cec8c33d416601e5957b838bbcc9132b61a6bff45a4096be6e5f8c0573abaf4e993fc4d0209d207b9879ff2d1097", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777124147, "uuid": "9c8a794c-01bd-40ea-9869-49f11a18222c", "value": "T1913533A27F15A8658794F3249229DF253B940362854F34F33CA4EA9F15A8F13F897D2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777124147, "uuid": "c4eeb2f7-431b-4087-9b46-38eb9a674adc", "value": "24576:BpaUHERxeMUqYuz3qcpAyHnx7X5QxbE5B7XlRJx:lHQeM49ABBpabE5BpRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777124147, "uuid": "cd621299-ff27-44b9-b44b-cb6d0cd7cdd9", "value": 1060402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777124147, "uuid": "c0384ab2-ddd2-47ed-b45f-0fa8b34811c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777124147, "uuid": "ef7db6ef-8a83-4455-a4d8-2203efead630", "value": "ps_1fUPQeZHvgJV_1775783797692.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a194d3-40c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777134614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134614, "uuid": "66730b84-e17a-4d01-bd69-94bac575a961", "comment": "Malware payload", "value": "79c39230c4c54476833b07a5fbcb563a", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134614, "uuid": "cf46a408-46b6-4555-9f81-e4bb96c408a3", "comment": "Malware payload", "value": "8a7b32e453bc3d5dd393a66d9e8be6e662e9038c8eb744d23280e4c922ce71e8", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134614, "uuid": "fcb8fd5a-07bb-4aa0-982b-2558ee6033ce", "comment": "Malware payload", "value": "679df4a7721c5d2cdb78635dca8c670d0f18970e", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134614, "uuid": "0eee6896-ea77-4429-98e6-2fe33f60b971", "comment": "Malware payload", "value": "314c9c17efbd443d313f2dd3db1bfddc1f41c8541d1308032c1b44ed009403a6df44fd18aad371317c8fcf77cd18bc02", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777134614, "uuid": "7717f8ef-654d-4b57-afb9-b9da18a946d5", "value": "T15B1166092BA80329F6B38736959F5330A93FBD57EA724E04018002C81CB4F40ECA2F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777134614, "uuid": "ec21bb0e-df3c-4669-a079-7b9809aed695", "value": "24:8AtJ/ByUl1+fB5xIki2fa168k1iMkALkAmkA5wkj95/Kqp:8GCvIkY16NkAwA7AHjDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777134614, "uuid": "763ad59c-6fd4-4947-9e34-b45d872c1ae6", "value": 1058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777134614, "uuid": "7c49fe7b-9803-4e20-a278-ad174103dfdf", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777134614, "uuid": "19e33da8-7527-4fae-8a24-6335a8e927b8", "value": "Pian.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d952db6f-4097-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777115635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777115635, "uuid": "2eea2271-d100-4266-b250-bde24ca1e79b", "comment": "Malware payload", "value": "fed4a252776c90b4c06996b667fedf1e", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777115635, "uuid": "d674b6ec-e86e-484a-a709-a4d090c3e280", "comment": "Malware payload", "value": "8b2a7bc04e4bda6465d04cc154da8a04a94fd1554676b981001cef91a6d742c2", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777115635, "uuid": "b7eb6587-dd8d-4707-b837-23ab15c3e551", "comment": "Malware payload", "value": "34c7030ccfc920c296efb5d8b0748e71176c6747", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777115635, "uuid": "45ad4f3f-fdc3-4527-b18f-7838bb088aad", "comment": "Malware payload", "value": "94999010fbbc5807721071e90ff35f465c0d7edc8346338d25769ea1c6e2f97d7c1b76a62b4eb5935b933abc8d677b62", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777115635, "uuid": "d0348d9f-65ef-4b8b-9bad-702f81dd5c56", "value": "T10C85AE0DD67AE126FFD810F2479765956DB84B4CC080A7A0EA47ED7C318E15E60CCAEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777115635, "uuid": "b9a1e3b9-1093-47f5-970d-54326a46ffb5", "value": "59cf6205f0d55e08de66f73ba4498e82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777115635, "uuid": "e900cabe-3218-4789-95cf-eff0a43b8ba0", "value": "24576:ICQ04U3Th7OX6PDkMfI3NF5JXrSNWYIWp3OmwKlDxWDEyKW85pOHrCH11MRqKDKH:l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777115635, "uuid": "cd661bfc-9524-4fb5-af41-d49b33c0268f", "value": 1801468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777115635, "uuid": "533af974-3886-4b78-8c5d-0b3f074ed3b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777115635, "uuid": "ebb8c43e-457d-4b72-9063-700249da2f78", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b458bd-40e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777147113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147113, "uuid": "7dc6ee67-a826-41bb-80b0-68c303431aca", "comment": "Malware payload", "value": "db15bc0d98dc3b6b67fc28e49abd0d13", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147113, "uuid": "773895f6-fd77-4901-a65d-60e810707b91", "comment": "Malware payload", "value": "8b586abbdba8138d16b96ed703b3d87254d31fc724441ac5822a529790ab6e28", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147113, "uuid": "b9e1f255-4b73-4414-a460-df58c21f2a6b", "comment": "Malware payload", "value": "6437f0b778a8d5d588eba0e9a032daad68711392", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147113, "uuid": "389e86fe-7db3-4788-bd70-b4b06c7fbfa8", "comment": "Malware payload", "value": "c83a4e8c9e4bbeac6e64db6c880bb47f682aac51e072b7872ad5b3117fd9188a161122619a9449605df6c0e687e635cc", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147113, "uuid": "a61c2b16-7f75-4610-a399-aca788ed605b", "value": "T10A6533113F9E1CFE4338B208A59F694867E34B74F05AD9D66AD801E706DE7CA442392F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147113, "uuid": "00117818-16f5-4c9d-a26d-a1813e3ed287", "value": "24576:LTgSBVYOiZE5kr5PUzhGZsb8iSLSk15GKUfqIuSYY6ks2l:HnUV5ZsbLSLWyF/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147113, "uuid": "6dd40883-e08f-4d56-aaca-a7933b3dc175", "value": 1534552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147113, "uuid": "df695e91-56f6-463b-ade6-92204275abc3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147113, "uuid": "7135f7dc-8903-4a9f-96f9-949eb0543f1b", "value": "ps_zeQX7QY1HoYs_1776434477992.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "569cb54f-40be-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777132166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132166, "uuid": "5e313fd2-860e-40a2-bbf3-265ec1157d4f", "comment": "Malware payload", "value": "0a9d28334acab7ded0cb0026ae5996a2", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132166, "uuid": "d647c0b2-458a-49fa-9341-b7ea4dcc8555", "comment": "Malware payload", "value": "8caa1ff4a9908068277ac9c333f4019114529bc2828b5f11efe54763d1b81d70", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132166, "uuid": "278bc37f-7560-4883-b3e3-eaa12982e6d0", "comment": "Malware payload", "value": "ae4cbb7d74e5ea5f09ba5c437effdf7bf6695b73", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132166, "uuid": "05ad3106-73d4-4ad3-9173-34c7b4befebe", "comment": "Malware payload", "value": "868ead29c6b4eb7bfa3735b4a8719e918d6f5d7d66b5c4617c21541c64a6f8be89623f8086149d1939a3b414f1050a73", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132166, "uuid": "8ca115d9-a0e5-4dd8-88fe-ec9cc70da975", "value": "T13531695056F59608B2B36E44AAFFA4525D3BB7BE9E35CA0D0050C14E17A1A44CC7BF32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132166, "uuid": "e6198091-6a0c-4238-9378-4e9b097c878f", "value": "48:pAlbx5Qi4QaAAzQzGJRskRimSkdM4OggzAM5M2dzQw:pQbfQ5QadzKGFVvM4mzE2kw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777132166, "uuid": "11c6a448-cd01-4db8-a616-874a0a7a1f7d", "value": 1650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777132166, "uuid": "91e9952c-39bd-4b9f-9bc0-ff4d409ce7ae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132166, "uuid": "3e15b530-7cbe-4558-8bb2-d2cea0850373", "value": "pklty_01.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50ac66de-40b4-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1777127861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127861, "uuid": "d71befc7-f437-49c2-abf0-42af39f7e806", "comment": "Malware payload (SantaStealer)", "value": "cb31d0ce471402e35fe8e732d2df38ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127861, "uuid": "be11eb70-bb87-45c6-a7e1-4877b309ff87", "comment": "Malware payload (SantaStealer)", "value": "8db399ea30e11aa90ee544d3af4c4982abd0f673dc6a3c0f2ffc3c16716769e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127861, "uuid": "95c9c41b-dce6-4d14-803a-11c9940dff77", "comment": "Malware payload (SantaStealer)", "value": "e773fd117a828ab1e77ec7c795a23fb0f101ca5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127861, "uuid": "fc41f7cf-d977-477a-83d7-6589ef63fbfa", "comment": "Malware payload (SantaStealer)", "value": "84b7addf509714e92dcd334814701c9d2a03de7b4fc80eb281bf0956f23751fdd67d0b16a213d1392bec73d81d252631", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777127861, "uuid": "de1683bb-bb78-4594-a455-1523dd7904e8", "value": "T1A3666B657152B87FDAC392382A861A712131F105933ECCBB44E4CB35ADB6A5016CF9BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777127861, "uuid": "f428969e-b423-45cc-b1d6-a4769849a0d3", "value": "1b2c375005cebe113c1ac0fffbec7821", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777127861, "uuid": "539dc4e1-6c41-4b43-8966-4ef408a33192", "value": "98304:80HcTeCeJQE+1rk/u9lg+GsxilH7Z2KQF5yCc7qo0bReMqGId:gblhBxCG5b0oGGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777127861, "uuid": "5b2a372d-804e-44ec-9579-8b770817f925", "value": 7059968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777127861, "uuid": "fce86e8b-0299-471a-b1c3-bfc4595931ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777127861, "uuid": "674eab08-9c79-4b4f-9d4a-65175d5a427c", "value": "WindowsCodecs.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4109cc5e-40bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777131271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131271, "uuid": "d523eb00-3ec1-4dc6-a731-973b2b88e76f", "comment": "Malware payload (Mirai)", "value": "3c59cb9178268b2f41de5bb7a16b9b2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131271, "uuid": "05d606e8-c5ab-44b0-a44b-b822b81dcf71", "comment": "Malware payload (Mirai)", "value": "8e5321f0c4394248bc194e13a5cc62512d57e55aef73964abb92bfd5a79ce1b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131271, "uuid": "b577bbd1-48a3-4535-977d-50ca6eadf2e9", "comment": "Malware payload (Mirai)", "value": "415e4eece4abe290988eff775f72096f0216fef7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131271, "uuid": "bea2a290-572a-4a0e-8554-9f60603222bf", "comment": "Malware payload (Mirai)", "value": "ae3b1fffcf1698cd25456559ac317f1649eb3c120fdc2708b1e629e893dc2241f3f1ad7eecf2a2beb618f33d9c15c791", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131271, "uuid": "1d1ab0b3-3c6a-4772-b6ef-28e0be13d2a9", "value": "T10B563811FECB14F6E5031E3100BBA26F67315D058B24EBD7EB507F2AEA7B6911836219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131271, "uuid": "6eac5740-b4e1-4027-8c4e-0c6521f7f6e2", "value": "49152:PPDbru884Fpgfy6Vs/GfkF6xU7RUuld8yyA76qNDc1P3BUhhX7d0e75E1:PPjuKFOIGfkDUCd8yp78P2ttE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777131271, "uuid": "135d1705-679f-4cb4-95aa-ce4210954a31", "value": 5914786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777131271, "uuid": "cce17549-9a03-498a-90cb-c4424624ca2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131271, "uuid": "22efbca7-007f-465f-bb7b-7f475be3c018", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f869b7-40a4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777120864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120864, "uuid": "e386ddb0-b29c-40c8-85ad-cf58c6ac5bdc", "comment": "Malware payload", "value": "d573d2f52f747a16ff790d1c6941efc4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120864, "uuid": "9fc53176-6ec1-4bab-ba25-8010135cf0ae", "comment": "Malware payload", "value": "8ed623e9880f5b915863fed0088f4602ff91a9c7dda0fef0952a6a51ece350da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120864, "uuid": "3a8ef14d-9202-4adb-8c9f-8eb116050c77", "comment": "Malware payload", "value": "b922a3bfbe9a02aebd7a7db6a0c1ea559cc1fa10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120864, "uuid": "9ae3fc8f-72cc-45a0-a70b-86d9fbf7d0e2", "comment": "Malware payload", "value": "8f2b9d106a2511b7f37923c0cca003e9b6eced32340d5f5ccf7a3878e567da2186cc7213c916d522ffa7718e8e78875c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120864, "uuid": "30503d1b-fd71-4a9c-bd9d-3356fdff7be1", "value": "T1DF559D127B05CFE5D2B4E37109F3836557A112930B92154B6638E338BE9276CBD1FAE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120864, "uuid": "44f215dd-fd9a-4d66-a99d-305e86305027", "value": "24576:u2G+kV4JI9eU2yl71EQzopomjWQZScDFhzpOnZyFq6BTI6TQKL97BxRxzewfHvhC:rG+G4YFlHzopomjWQZScDF3aZyFq96T4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777120864, "uuid": "db10b9db-72c7-41e8-9d27-4f5396c9eed6", "value": 1286432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777120864, "uuid": "8b49f9cd-18fd-4e86-814c-f549e574cc6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120864, "uuid": "49d24024-e320-4f67-90d0-014658d4aa6e", "value": "ntpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a52c1ed9-409c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777117695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777117695, "uuid": "4244d486-3721-44dd-9ca3-a459b436ca2b", "comment": "Malware payload (Mirai)", "value": "821bd4213e8f2b45b98da809ead42267", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777117695, "uuid": "d66bcf0e-076a-450e-9ca7-753a2a83dfa5", "comment": "Malware payload (Mirai)", "value": "8f090222817a44fa0e854382a358b5d44c75b215f5c652efa84d9e72e89d87fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777117695, "uuid": "3afbb4fa-7772-49c2-9ee2-96d012e9654d", "comment": "Malware payload (Mirai)", "value": "ec32cf38a1a2b9cd3f93357d9e90c4000135bc03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777117695, "uuid": "94414639-d493-495f-9a55-8025f1c37370", "comment": "Malware payload (Mirai)", "value": "6385d839ec58b7365b40fce7b44cbdec0b9f156600c99fc04c3e71a2f8f2cb8bfad0b9c921927bb21863998f81a0a102", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777117695, "uuid": "7c461c5e-1845-4168-90f9-7cfada32ed91", "value": "T13655CE06F8808F62C5D125B6F66F836873174779D7EB62069A189B343BD792F0F3A241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777117695, "uuid": "f9149f3d-ebe0-4fd4-9c45-347352a4f5a6", "value": "24576:6z/qLvfxB+6qHxWiOeiJnaGYTAlTMWVoFaCHRUxvRU8ABEY0X+PsmI7Cjtj:6kfxB+bxWitGYGhVoHYxbX+Psh7Cjp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777117695, "uuid": "e76d10a4-8acc-4686-af77-e7040dca729f", "value": 1303127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777117695, "uuid": "7afa0958-f01e-40a7-9465-fdd45908d117", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777117695, "uuid": "5b02f02b-7377-471f-a464-f0321f7aede6", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be56c2a0-403b-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777076076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076076, "uuid": "7c4c0031-5b2f-40a1-ad43-2308f67cd8ab", "comment": "Malware payload (RustyStealer)", "value": "a29494524c622c4c97300113ab31dee4", "object_relation": "md5", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076076, "uuid": "70f65359-fb2c-4041-b0f0-70443b250fdf", "comment": "Malware payload (RustyStealer)", "value": "8f57c3a06934c8b90273d7be0b406ae062eb05b2404a6ac2ecd33689b496c17c", "object_relation": "sha256", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076076, "uuid": "390c6ebb-156b-4c37-aa93-c531c67eeb39", "comment": "Malware payload (RustyStealer)", "value": "e065acc7683ceff3f36e599aef98aff2568ff0f3", "object_relation": "sha1", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076076, "uuid": "dbecd324-b924-4062-ba45-9e41e43e51ae", "comment": "Malware payload (RustyStealer)", "value": "a8ad09182d739f9cd339f3b3d861194f44917c6d14f952b4ce5b3670c3e98a32d1784346152e828affc5343a15b4c7cb", "object_relation": "sha3-384", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076076, "uuid": "796f6d4e-238d-4413-980e-4ea302c54d22", "value": "T116061206FA5351F8C42BC07541DA9B76D631784A0322DEFF47940A287F6FBA12E3A725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076076, "uuid": "0b0249a2-9ab6-4bd2-879f-d180cd3360ea", "value": "089257d5aba2999f70ed9bf226315388", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076076, "uuid": "14f05bb3-41c8-44e2-a1e4-a54926ae5e2f", "value": "98304:cZe6k5NxBy7MtzrOeG6e6k5NxBy7MtzrO5iQr:cQ6kfxB9lrg6kfxB9lral", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777076076, "uuid": "5ddd446f-3f8c-4e28-94ef-e05d321f2539", "value": 3785976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777076076, "uuid": "a70833eb-1c14-4740-acc8-22eaa4106c87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076076, "uuid": "3b23ff65-eac6-4fc0-bed1-eb78e568ade9", "value": "log4net.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "222a68d0-40e4-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1777148399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777148399, "uuid": "ef63eb41-b518-4482-9ab4-57eb82c8d2f8", "comment": "Malware payload (Smoke Loader)", "value": "096b3526c47ce5225b93bd729c4528bb", "object_relation": "md5", "Tag": [ { "name": "144-31-191-28", "colour": "#2438D8", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777148399, "uuid": "42e31b1d-a19e-4bfb-b558-05f90365750c", "comment": "Malware payload (Smoke Loader)", "value": "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2", "object_relation": "sha256", "Tag": [ { "name": "144-31-191-28", "colour": "#2438D8", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777148399, "uuid": "af14346e-e481-4b3d-a6a8-5dd38095e899", "comment": "Malware payload (Smoke Loader)", "value": "6657243070c566228521129720d02d94f1f9822a", "object_relation": "sha1", "Tag": [ { "name": "144-31-191-28", "colour": "#2438D8", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777148399, "uuid": "d43d0089-4dcd-47bb-bc80-5820f4f14bd5", "comment": "Malware payload (Smoke Loader)", "value": "4dee8a4a62f09df135f1310a300f04688afe571630fe6bf3df8e0ab7b026994421433c850bd9528775dc6b77fcea8ac0", "object_relation": "sha3-384", "Tag": [ { "name": "144-31-191-28", "colour": "#2438D8", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777148399, "uuid": "7ec69fd4-ceb6-4178-b796-326f7c1deb96", "value": "T174953B01789105FDC099773248F23681BB75B8090B3637D32E96AA783E77BE05D7A74A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777148399, "uuid": "01d2efa6-c12d-46c1-beb4-4843a93953e2", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777148399, "uuid": "cb35c156-1a37-4b14-a2e3-84f08b9e58ef", "value": "24576:BYWKkVfKzw5X6/DVJpzaofq2lAOpaoqRMCY+0aIEdKu4nhele5nK23U1hOMo:BYWzVyzw54DVJtfq2OOpaVMbhaIEod5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777148399, "uuid": "dca88554-427d-4b9e-a4ea-35e490832b7d", "value": 2048176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777148399, "uuid": "27d2f246-48e9-4636-8c9f-a0f9eba2a2a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777148399, "uuid": "a75948bd-9c62-4903-80e9-d462d03eccf7", "value": "WW29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56f6ad5c-4087-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777108544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777108544, "uuid": "b1933326-1467-4c6e-b7ac-b50fc78e9037", "comment": "Malware payload (NanoCore)", "value": "83bea0f0e38b68c60905c8338a377856", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777108544, "uuid": "251c3217-c5f3-40d2-83c6-9bb078f00c1a", "comment": "Malware payload (NanoCore)", "value": "91d880890f6e481edcbe0c5a1a26e8b343d2abeaf4d8c62de04bc75aea6aa7d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777108544, "uuid": "78aabb91-784a-49fa-92b7-af59965bb2f5", "comment": "Malware payload (NanoCore)", "value": "66da5c57f3d1dc0949b7408d7fe2c6458bed9f0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777108544, "uuid": "ba8b05d9-9ce0-4daf-b32a-983bd8c75d40", "comment": "Malware payload (NanoCore)", "value": "09f8759335170cb2a4dc486968617051d7846fe0b2ed019788aaa77656a0ed3bce5d73ec8e33dd89e632050154be137c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777108544, "uuid": "feb2f143-ddcb-45ef-802d-dbc15bc2cd9c", "value": "T11E14CF5537A84A3FE29E86B9212212139379C2E3A9C3F3EE1CD465B35F563E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777108544, "uuid": "ecb7f0ae-6656-4d5d-bc1a-51b38b92aa6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777108544, "uuid": "66743f56-0d62-4a9c-8f9e-45cd88aae0c0", "value": "6144:4LV6Bta6dtJmakIM5fKMlO/0hdzxdBQkJy:4LV6BtpmkcKMPzN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777108544, "uuid": "c6b9c9f4-2bbf-487a-a9b1-44bba9a0a78d", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777108544, "uuid": "074fe59f-86e7-4cf3-82ca-196a6100b967", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777108544, "uuid": "fd1c5e53-495c-49b7-9592-b2c54e656fd0", "value": "bbcnews.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56599e4a-406b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777096517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777096517, "uuid": "1c8257d7-823d-43e2-9b32-92889e4b2b2b", "comment": "Malware payload (Mirai)", "value": "bcfb56d03e2723826f2598a923b286f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777096517, "uuid": "34997f22-b13c-48b0-a053-b0cd0a54c4d9", "comment": "Malware payload (Mirai)", "value": "921fc56dfa4efce35f97ce0bf4b58f398d2901371a634087da07c498e2c0f03f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777096517, "uuid": "65a571d5-bc26-46a6-a87e-6b9622402e07", "comment": "Malware payload (Mirai)", "value": "66cb1ba34e7c6ea86687dd68a202fb069bd02ef8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777096517, "uuid": "d6419c8e-1224-478f-84ab-153a487918dd", "comment": "Malware payload (Mirai)", "value": "92c1296b492fd84d7172484e6e5f47a07e120a54bb0112c6f3cc9e3a9e0b418aacdcbf4e84b8e63a6b60e62621792fd6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777096517, "uuid": "1c3064b8-7176-4126-8fef-512a6ffb3da5", "value": "T19A645513D9164895E5258CF222673385AC4B83BB8CE722E3ED5A49A1FF3145F41BEEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777096517, "uuid": "be34ce65-e4cc-4140-9d83-20f7d32f9a15", "value": "3072:2x9OP4mj0N/XgFAhEs2UTT6LgB+joCOq3esy:2EG1hEiTajoFqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777096517, "uuid": "a73cd45e-29ab-476f-b286-6296c3725f23", "value": 336748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777096517, "uuid": "a022fc10-ec0a-4dba-b689-e369844770bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777096517, "uuid": "ec71e988-bf12-4cdb-8840-040e3806c72c", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "271da55c-4072-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777099445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777099445, "uuid": "5038e9f2-ab5a-49af-960a-f80573a8c576", "comment": "Malware payload (Mirai)", "value": "0860724d4e40c437a3faea776d2cad29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777099445, "uuid": "3909d660-38ea-4305-b839-71a582277481", "comment": "Malware payload (Mirai)", "value": "92a3f3f5933f84480c2e2e8acba9d44f2d559b953f412ad46f5c921e3067ad43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777099445, "uuid": "60257349-981e-4328-9b70-c1d77162a8d8", "comment": "Malware payload (Mirai)", "value": "4c91e2fec7d1e2f0349fe9d965fcdb906c1dfa3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777099445, "uuid": "e17be09c-30ac-4070-b315-16ff6c6b4e87", "comment": "Malware payload (Mirai)", "value": "734441ecd80eb9b106ec0ae41ae65df6014af56962d3aa8674dab4515f110007396d8d6a2d2efc84515e0e591210eb9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777099445, "uuid": "63d361d7-a928-499b-9098-c76c73aae39e", "value": "T1C313E15D23A55D34A1B26D389466CF0B9B2D6F38F5B63D8B1E205314C84AE1A37E72C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777099445, "uuid": "5fbab4df-acb2-472d-b96b-b2da81490494", "value": "768:rpZqOgAG3083+jT3x1vMgWy+0titQSwzDemQu7P5AykU+2m+djV0s3UoDe:nqfAcbk3v9NRk29zyK7eykX2TdjVRDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777099445, "uuid": "4513db4b-ef6f-45b4-8fd7-6e058261e37b", "value": 43456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777099445, "uuid": "3c9d0f6a-f65a-44d8-bab5-3298620e3d9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777099445, "uuid": "5e77fc37-0052-4791-a03b-3897132b4a35", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dfe36c8-40e2-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1777147748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147748, "uuid": "d527e6db-8df2-432a-9d0b-5aa8587f6cb2", "comment": "Malware payload (LummaStealer)", "value": "4db00b89de7e7c5721c59c50531b5d38", "object_relation": "md5", "Tag": [ { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147748, "uuid": "1c54a3e6-10e2-4bdd-a96c-6f287b68601b", "comment": "Malware payload (LummaStealer)", "value": "94189e4d1e03f3afac858be576cc0c1b0ab000dbccb8dcf988fb58059b5a12ff", "object_relation": "sha256", "Tag": [ { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147748, "uuid": "0ae5b4ff-9b89-411e-b9f1-80eba9929319", "comment": "Malware payload (LummaStealer)", "value": "e799cc0768b8a355084871eb4b4aaf840c26667d", "object_relation": "sha1", "Tag": [ { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147748, "uuid": "f2a52b4b-6dfb-4f20-bbcf-eedb9941da16", "comment": "Malware payload (LummaStealer)", "value": "6d32bcc763b0cca90d4909f78230f7bc4f86a9e2efa8a19f0d1439bbb94674e2ffb63e679fa4e5652c1139fe358f64ae", "object_relation": "sha3-384", "Tag": [ { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147748, "uuid": "66ad0320-863b-4af3-a334-6995eaafcfd8", "value": "T18C747B86E7BB54B0D58B0938259FB33BDF3416294328CEC7DBF0DA4439672E25536A02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147748, "uuid": "ea1f8b15-16d5-421e-baf6-5abaec7944d1", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147748, "uuid": "cfec3333-636f-45e3-aa5f-070ed41de424", "value": "6144:XvgEeOcmwvEL7fF1jTA659HSC8AVtZ5XlOHaoIhEFydyt:/8OcZ07bf0OtDlOHaoIndyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147748, "uuid": "e2b5a4e0-3025-407d-8289-496a9e441786", "value": 345600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147748, "uuid": "92811f53-1d85-4a43-991b-b88f1eed8d10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147748, "uuid": "9940ad7a-a562-4737-b157-6926a52fd743", "value": "Build(3).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "febdca10-40c3-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777134596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134596, "uuid": "533977a1-3ce9-4ac9-9822-caaac1c853f1", "comment": "Malware payload (AgentTesla)", "value": "48208810a26d1e8a154afdede153b2e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134596, "uuid": "629ea92c-1b7b-4ace-bff8-4f0cf0aca34b", "comment": "Malware payload (AgentTesla)", "value": "94237dd134a81d183cfa4e8e16f488e19fa72df685422fb87f7e41a26d31d710", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134596, "uuid": "e69ed356-6df4-4a7d-b898-5b79c846ddf0", "comment": "Malware payload (AgentTesla)", "value": "4c55f6027387a80ecafd11e76091cc43729edb00", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134596, "uuid": "c7d37261-6e3c-4013-a169-043ce4070567", "comment": "Malware payload (AgentTesla)", "value": "f5e12fc5a36ea878b78fcdb829b77fb4c24555a203c4993452337a7ce9056a1dc28a91384637beaef5ef4d7e0dc8ce0f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777134596, "uuid": "bd355a48-b46b-4f09-beee-74370792afb3", "value": "T1A7352394EBB86FA9DBE4D118331D3B9644E009A1C0A9359230FC665F1FDDFC6E1AB910", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777134596, "uuid": "7610df09-b5bd-4d01-8702-8373b96b0e92", "value": "24576:C8oNLzl+wfV8vq6H+dBiZ2V9kFapocLyml69wbyGO:f0UkmedBr9Z6cX6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777134596, "uuid": "2eadf197-61f0-40c0-9d47-14e0ea377242", "value": 1075387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777134596, "uuid": "3d1ce6b9-93a7-432e-b11c-f9696e16f747", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777134596, "uuid": "049f2a4b-4552-459b-8a5d-b6844a25637e", "value": "5BG29F67.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f9cf35f-40bd-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyVilleRAT)", "timestamp": 1777131644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131644, "uuid": "b61792b2-fc18-49ac-82dc-de427b3b464b", "comment": "Malware payload (SpyVilleRAT)", "value": "fe0db16c84b38bb61e2a96c61f98507a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SpyVilleRAT", "colour": "#2414CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131644, "uuid": "b707ce93-0944-4c72-827b-1ec46fe642ca", "comment": "Malware payload (SpyVilleRAT)", "value": "954aad190ab8bc68a2ca18aaf7d12f492c2dcc4b0406d10da0d672ffc82fe3c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SpyVilleRAT", "colour": "#2414CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131644, "uuid": "12e21f46-9760-4a96-8d13-105ae7b0d5a2", "comment": "Malware payload (SpyVilleRAT)", "value": "656cbad81b726baa1956a470dcae1a0df3620aee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SpyVilleRAT", "colour": "#2414CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131644, "uuid": "f919d9e8-6198-433a-9cd5-268ca9b7af19", "comment": "Malware payload (SpyVilleRAT)", "value": "e8f3a9d41769bb4efce61877f0beadaf554c508dda944834978b33027a1540296446099ab0732cd4fe127807a282748d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SpyVilleRAT", "colour": "#2414CB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131644, "uuid": "5a4ff56c-4bb3-4223-a490-ad493c720859", "value": "T1C2657C22B2818437D0B35E7CDC6BB7A994697E501E38984B7BF44E4C5F3A7813D29287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131644, "uuid": "70377fe1-54df-4c49-a0fd-8de2379bf0be", "value": "76fc53af74fc49e129720db4f945898b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131644, "uuid": "37966e70-09bc-44ca-af68-29bd46c38b9b", "value": "24576:2mEyjnMMkVMOAueE5fgjgmCnYPeaKxcZS80NtrgEpW79j:2aoJAYf6g7EeaEcB79j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777131644, "uuid": "2e137dc2-4799-4d64-a8ef-cde224b7fd76", "value": 1502397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777131644, "uuid": "506dfaf1-c467-47d1-b443-9c84025500de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131644, "uuid": "b0d108ca-7561-4638-824c-a1e3ef8a3574", "value": "yxovtb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "151c69e2-408b-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1777110152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110152, "uuid": "c1b37735-35f5-4248-a263-4cb8553a8cfe", "comment": "Malware payload (NetSupport)", "value": "9e69d2b92877973e684e21cc57575123", "object_relation": "md5", "Tag": [ { "name": "jameeeswt-com", "colour": "#9D0039", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110152, "uuid": "75ae7e7b-e8ab-4c7f-9a7f-e8b585d1305c", "comment": "Malware payload (NetSupport)", "value": "969fa1cca8aaba236711e89da1ac779041c165454683e098ebb1e5dab6305b5b", "object_relation": "sha256", "Tag": [ { "name": "jameeeswt-com", "colour": "#9D0039", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110152, "uuid": "14703b98-88ba-444c-9c0d-9c0fd5afc5d0", "comment": "Malware payload (NetSupport)", "value": "ef0724e8f44908cea3d419b2830a08a5c5368ca2", "object_relation": "sha1", "Tag": [ { "name": "jameeeswt-com", "colour": "#9D0039", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110152, "uuid": "43ae4da9-207f-44a4-841f-74f9b696d6bb", "comment": "Malware payload (NetSupport)", "value": "94deca1d55cc1c8a87129a3338b214aa176255d9f51db1a71c4ef0f1971b175c1252d71c108cdadbcab0cd22cca72574", "object_relation": "sha3-384", "Tag": [ { "name": "jameeeswt-com", "colour": "#9D0039", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110152, "uuid": "2b7bfe9f-60d6-4997-b8dd-2ede2a3f98a6", "value": "T1C7C53307E582CBF5E8E60638AA5DF5F61A5EFE7CA32451347041FAEA4CB6C2580587C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110152, "uuid": "6ea754f4-3b89-4d8a-a7d6-acefc9e08c07", "value": "49152:TK3wvSFm6lyHBa8uDCbHHosgIK6Vcq/hwxQTRMEbXWCB45Yz8a/jvRL/4eO:Tqw6Fmta8uDCjosLqq/WQ9MEC5LarJFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777110152, "uuid": "5656a6b5-1700-477d-98e3-347198cdd436", "value": 2560000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777110152, "uuid": "071a0757-1d59-4149-9867-e675b5587ec3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110152, "uuid": "d891736d-afb2-41cc-a9bd-bec9a7dff5f6", "value": "installer.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0555b58-40be-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1777132370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132370, "uuid": "b3679cde-84c0-4e72-b0aa-b9adc05679e5", "comment": "Malware payload (SalatStealer)", "value": "74924dc293f625c54dfcc2d46ee6eda9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132370, "uuid": "c1e3a58c-4dc3-4f2a-ac6b-c5ac25fe9981", "comment": "Malware payload (SalatStealer)", "value": "97fd78bc83c79dddeae4fd303e014b4db63c49fc2b507ef7a2f57066cbe9ca10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132370, "uuid": "9736ba2b-92f2-4488-b931-046f1784da19", "comment": "Malware payload (SalatStealer)", "value": "335867a1ac19b798e91c0a2c3a16fed76b765fdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132370, "uuid": "1d61b5fd-7ccb-4fe6-9429-80246613ce24", "comment": "Malware payload (SalatStealer)", "value": "7547be260cfdaffd504b2031f64b71395b729ebb4f7694ef7116373652018f4452e77071d8e96d0af108ae76cf8411f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132370, "uuid": "101af76f-a6f7-4ee8-ab59-479b8f0ca98a", "value": "T130F533BEAB37EC43FB8C1CBC1934B5433A931775544D826ABAB623A366960747DD7200", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132370, "uuid": "fa53918f-cff5-48e1-8ddf-a154e95afce7", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132370, "uuid": "933a980d-5181-4bc7-8c19-6fb6e42ec988", "value": "98304:Sm/+4CLC31NauMnAuDZ73txPVkhMv5QmzpPtaYaW3ak:b/5Cu31sdjxPiyzxwY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777132370, "uuid": "190f1e04-f41c-4001-9871-5aa56b5688b8", "value": 3595264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777132370, "uuid": "bee2153b-a2b8-4b73-816e-83d6a3baca5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132370, "uuid": "6681d637-5e03-4797-869b-707a752d08bd", "value": "zapret.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a468d05-40ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777139044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777139044, "uuid": "da97ebc3-adec-47eb-a892-7cf269049298", "comment": "Malware payload", "value": "22cc778d4e318eb24ff3c374b3ecfc3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777139044, "uuid": "73ae460e-8668-4e4b-823b-c13f17593894", "comment": "Malware payload", "value": "9830b7741dc316e552222a6e10e2e56eda85d36d688c5d0bf7eba8f5cf8bb953", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777139044, "uuid": "909c5426-b3b6-4a49-918e-b48a97a9d1e5", "comment": "Malware payload", "value": "68ac965e73a9131b98352be14e79ae4b77451c72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777139044, "uuid": "c41d06bd-b92c-4ac7-8eb7-737a375c62b4", "comment": "Malware payload", "value": "17f7c82b6579c2b449f88a4e525bd56645a55506abb0ba4fc97bf2fc35bea0e3209bb447996e521ac9b3a2856bfe4d24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777139044, "uuid": "ab9b7c20-cc0a-4e0d-8c5b-be790878d5c0", "value": "T1F7564907EC9514E9C0AE953089679253BB71BC881B3123D72B50F6387FB6BE0ADB9750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777139044, "uuid": "44285fcc-f57e-4eb5-8eb0-d78839a3aa61", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777139044, "uuid": "835f6bb6-eaf1-4545-95ed-a9f66824daa8", "value": "49152:Sp+PUSy2fGnwPvCt8r4ERMDZO25kOKt2NDNJGhayrYXscsiADmCMGnGKQK1K6h7m:SpldojCrTJpgiADhDhoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777139044, "uuid": "d1261e07-57b2-4778-b510-a0c011473d3d", "value": 6252544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777139044, "uuid": "6c82d69f-374b-43cc-bf53-2590171b26ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777139044, "uuid": "e59240f2-c8ce-4a51-8b1a-a7cc7d012b3d", "value": "SecuriteInfo.com.Generic.Gorat.H.EAF0C69F.92478361", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80719056-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128800, "uuid": "be909e4d-537e-4ed2-9932-6620d99ae00a", "comment": "Malware payload (Mirai)", "value": "7b3a486e469f8f723c949ceb3952d49c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128800, "uuid": "a25af47d-8b4f-4b17-8a73-9eda9dcc93e2", "comment": "Malware payload (Mirai)", "value": "9881dd8edd0797329d9526f55c45b86602cdb70f471e978c74d4f42ab5a9b684", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128800, "uuid": "0169368b-c549-4bc3-b61f-b5de452e695c", "comment": "Malware payload (Mirai)", "value": "9b037ee7a032fc6d3d9519e1f2cd6a201538a0be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128800, "uuid": "2c916ccd-1863-4d26-802b-62e650fb8b80", "comment": "Malware payload (Mirai)", "value": "c877ebe4a24fb2ebe25ff14e880b80d5e0c7b6682ce4208a006cac6d8c768e043635c2f4fa6d7df0287ab8e743d7e21a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128800, "uuid": "c390a49c-31f5-4672-8250-4ddbd878b19c", "value": "T1F36131070BD02F77D896CE3717575B112BCEB42B506157126328E8A4BE2F285BED3E94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128800, "uuid": "ace38ec3-74a0-41aa-b84c-98ee16a59862", "value": "48:5t24ruDu2si6df9ouS8TLGPkuTLLUUUG1w04FtybZq:5t5ruShf9xSYLGLTPqt0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128800, "uuid": "68228322-6ba9-46cc-995a-ee04d78a697a", "value": 3330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128800, "uuid": "66d0ab33-b55e-405c-a78a-202f7e1c115d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128800, "uuid": "2f71f5cc-6536-402d-9a04-e6807d8fc82a", "value": "dlr.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ff94d2-40ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777130346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130346, "uuid": "76c62e48-bdf8-4a7d-9f81-e04f1613f3b3", "comment": "Malware payload (Mirai)", "value": "d561b80294690532aa8d47e9ce05f942", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130346, "uuid": "7d7512f0-6b3e-4ee8-bee7-2cdfa95c6e77", "comment": "Malware payload (Mirai)", "value": "9888cc5d368448594fcee8a8f915560d5d7b61ac80163e22308a2115d76a8ea0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130346, "uuid": "77b515ad-6f19-4331-a8b0-fc05c741033e", "comment": "Malware payload (Mirai)", "value": "60f438f092e43b07d38fb714f2680b96e1e42dfe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130346, "uuid": "01c5a7dc-cb35-44c0-aa32-fa7113d3f166", "comment": "Malware payload (Mirai)", "value": "990fdf89da802d2a052f8b02eb3c77241c7800426d3a42396b304394ac7effc017e111530408ae0dc6914a68652a8b31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130346, "uuid": "17aa1f62-b2bb-480d-9bb8-0a1fe8ee6b4d", "value": "T13DE34A416646D6F3C8C30FF602A7576A0633E8295F2B9E49F32DBCB44F0659CF219668", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130346, "uuid": "3f4b1935-fedb-4b6f-bd0b-0511c4ec9a33", "value": "3072:chYhMMAOi2/GOLwx/UaW3sZDMdBmyanDdrh350BXDfwhc:chTsaWcZDMdBmyanDdrh350BXDfwhc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777130346, "uuid": "af8cab59-b7a0-4199-8313-71ec549f38d6", "value": 149528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777130346, "uuid": "d037ac47-85df-4f5c-9a59-01ecdf7e0151", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130346, "uuid": "aafabb40-0776-4632-8d29-04474dc124ea", "value": "bot.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ff6a59-40a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777120804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120804, "uuid": "a61edd49-aab5-4a2e-b250-17d698fae871", "comment": "Malware payload", "value": "751521cb9f8c5dd9fb67dbb1921adbd5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120804, "uuid": "c455f2ae-a9c5-4d61-b3a3-91e6ff860d28", "comment": "Malware payload", "value": "9896eca467401ba28c8c41d185300ff29052f26f1a8526353937383a41d5208a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120804, "uuid": "6bf8c8cf-88a1-47cd-b166-7071da186d16", "comment": "Malware payload", "value": "e211c7954298d12e0c95de05fd7ba8d3cb9e137e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120804, "uuid": "d548855f-ccfa-40ee-a461-752bb767aec7", "comment": "Malware payload", "value": "dcc20d5bdc1720f6f6066338390fbabadfc86f0e0c05debe1aacff842d5d7d7b3934c5426fc6fc1c485be2ba86282003", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120804, "uuid": "d1ff612a-037c-463d-8e6b-10929bb835c7", "value": "T17375E19173469663CEA88B7106E2C370E7F5352252F3865EE31623280F725AD6D1EDEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120804, "uuid": "225d0524-d2bb-4170-9768-947f947b8145", "value": "24576:TD1HGqhZd4FILjPYubEn206uIOtD4DuJ+6dpEYWe1agdynaIHYZzXpEdIcn:PZYILjP/Eh6JqJ+QfKnaVZTpxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777120804, "uuid": "d52b828e-498e-4eee-9aef-ab8aac965651", "value": 1641095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777120804, "uuid": "6d788667-4d7d-4516-bb14-2aeb3a68fffa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120804, "uuid": "69ab6ed7-9a46-4631-b6bf-e6e58587ff59", "value": "bot.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0372cf-408c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777110860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110860, "uuid": "3be1965a-c3a2-4772-8772-34ee3c56c41a", "comment": "Malware payload", "value": "c820aa8c46de9478e93e739ebbf89cea", "object_relation": "md5", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110860, "uuid": "b8f4cdf8-9314-4edf-a8dd-f186bebbb5be", "comment": "Malware payload", "value": "99dd9d56c570ca846292db1d51f93d5316fe0e7a3712fc2e53d198712ac797fb", "object_relation": "sha256", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110860, "uuid": "fed31068-d389-4acd-8948-3559c604d1cd", "comment": "Malware payload", "value": "e809a64c45da88170ad3f3828ebc28f8e3908966", "object_relation": "sha1", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110860, "uuid": "5d24ac19-4100-4fa9-85a1-ba91e069f018", "comment": "Malware payload", "value": "37dc6afe6b4b4781d22d25542fce2fc46425689afa8d50f4404ba7aea06c09aabab5f4d6ffc81abd44f99777f2355174", "object_relation": "sha3-384", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110860, "uuid": "0210bbe3-fc77-4d68-a044-47ea4da8885f", "value": "T166675B2FB2A482A9E15EC23EC157CF40D97371715B77C6E716E206289E568C98F3B720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110860, "uuid": "83590aa1-30ed-416c-a077-8bba19fbffa2", "value": "dc855ba4ed17d8feca28bead7f574dff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110860, "uuid": "780ae9ec-7e38-4adf-8b10-554355fea71a", "value": "49152:qnnPBCIliDhznHoAh2SoR/U1WpJ9v1GSmzDcJX:YBlWoLGSmzgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777110860, "uuid": "247622cc-c1b3-4968-83bc-d31d78261338", "value": 31552584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777110860, "uuid": "ec2e7735-1a62-4242-82ed-687a5d3a1695", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110860, "uuid": "6ebca584-0931-43dd-9ddf-031be0d70007", "value": "99dd9d56c570ca846292db1d51f93d5316fe0e7a3712fc2e53d198712ac797fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8920140d-40d1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777140411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777140411, "uuid": "a29f03bb-954a-433c-b623-d73d9d596229", "comment": "Malware payload", "value": "640bfc7b341126b3f9106246222ce3db", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777140411, "uuid": "38789068-2c33-4c4e-857f-9c7e24fd6ea2", "comment": "Malware payload", "value": "9b628baf151ec88e1c8a16e1dafc9419e47cc59e9bd81924a8a4dab8ec4f15a3", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777140411, "uuid": "8678083e-4e14-4e2b-bc0f-68f139a1f40c", "comment": "Malware payload", "value": "f0524408bc0c2e16fb5ec604725882a8a351b763", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777140411, "uuid": "11b82bf7-4fe0-476d-a2a9-983d04d1e05e", "comment": "Malware payload", "value": "201e725776738481947a1404def3cab12941dd3c6f247067ea3b2367f4cfbdd8b048c501be47d2196654761278ef8707", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777140411, "uuid": "7a967e8a-b5e1-4800-a66b-8d33678d0ff0", "value": "T17116335408DE769AC3DF78F4C4672E9826CC5545203AC58387B2B8D971BDA3CEB897B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777140411, "uuid": "24e965f2-2676-4ec8-925d-f7045d07b20f", "value": "98304:tts77hKtPOWbmnwiF8JZfaIKEHJJIMmGOw5IKNXE4WkBLPLQ9NYze7MadR:tts77Qhi9F8JYwH0MmGB5IpkBLBze7VT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777140411, "uuid": "016b2d46-2baf-40f5-9352-d0837999d2d5", "value": 4212443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777140411, "uuid": "6ebe13ce-c91f-4deb-b00f-83050f03b6a6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777140411, "uuid": "84ab8c30-eecc-4ba0-aeba-209412effdff", "value": "Fixit.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b5a7e8-403c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777076357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076357, "uuid": "eee00bba-ce33-4378-9014-d2dc8915b42a", "comment": "Malware payload (Mirai)", "value": "6c83afb00a88044f7d7753975a5ba9a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076357, "uuid": "e1db24db-860d-4c2b-88a4-398121aa52b1", "comment": "Malware payload (Mirai)", "value": "9b83781344156ae1fd75a20de83f741bec1cf331581b61e9ebab50fd316dc765", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076357, "uuid": "684b8ed7-4e43-4d5a-9f0d-f096633bd547", "comment": "Malware payload (Mirai)", "value": "9069893dc853d0986b2f8fd76c18339e4efe4df0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076357, "uuid": "60135707-e6ac-4492-bb0f-80fac5ab5fff", "comment": "Malware payload (Mirai)", "value": "f8d45dadf9e314e6cd5aaa78b88169157273d27cbf393688296f2306c076f056fbc37319574db4723a99944b3d2679ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076357, "uuid": "da76ec43-49f7-4dfe-897c-902459601d6e", "value": "T1B7D2D0C3447BFAF1C02BA1F64AA992E1F5587C279E41437B29CE31BF9C62C943A25740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076357, "uuid": "700cffec-fdd8-443a-86d1-f7b6a9c59a00", "value": "768:v8hzpUjpJn0JemDEHfMvHdUlELinNx021:vT3nSebH0eqs51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777076357, "uuid": "6f06ba8f-0623-4bcb-bde5-c2ee9977ddec", "value": 29140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777076357, "uuid": "89110aa2-6ba8-478f-aa71-8d7173c52261", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076357, "uuid": "d2f303d5-4269-4b99-9029-f8f39e54a934", "value": "sora.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c53a6d0-408a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777109842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777109842, "uuid": "7d0619ab-5d40-4125-87f7-3ac100d595ca", "comment": "Malware payload", "value": "8ee993a134e86a9a324d845b4143f0f7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777109842, "uuid": "bb84994e-8582-4ace-be5a-61a8d4a29999", "comment": "Malware payload", "value": "9c471c5103fc7c600a3e3d58d51034b5a4d3286f92e706c507bfd9fd6836df8c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777109842, "uuid": "6e4c584d-bc1b-49c6-a495-600ed6af80f7", "comment": "Malware payload", "value": "2007b0d2da9d96ca15de1ae6f69147f75b6291f6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777109842, "uuid": "86de60fa-9dc3-49a4-b12f-0515b68fa45d", "comment": "Malware payload", "value": "64fb139d343b18b71f48fd65bc69edd381116665a6d1e64f8721df62e00e2efbe98732d4b1ff4f25b65e447349612089", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777109842, "uuid": "f6332737-cd3a-4e64-951a-0cae72827ae3", "value": "T10E01488261A22AB2E59BD07C235430C7EC6745F3C10AFD25F0506F9D4EAB4456D47D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777109842, "uuid": "23673078-bdad-4790-bf96-742712089f1f", "value": "24:tRN25OdOuzzpqezVzgdTjDQTcBGmQxDhasPX:tbnOuzzpqGVzOTPvGmgDhlPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777109842, "uuid": "0c1ad20a-5d4a-43b4-b6c8-a927e30d93ae", "value": 838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777109842, "uuid": "8eb2246b-5a39-4904-90ff-fdb15f5b7c2a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777109842, "uuid": "8957a0bc-76c2-4027-9e0c-5e0e0397f672", "value": "9c471c5103fc7c600a3e3d58d51034b5a4d3286f92e706c507bfd9fd6836df8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6685647b-40fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777159251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777159251, "uuid": "1931246c-5133-463e-961b-6b52b52e5b93", "comment": "Malware payload (Mirai)", "value": "380c1a0da340b8c2aa6002616fcf7310", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777159251, "uuid": "d180a843-1f2c-4d0c-9252-edf6a77318a4", "comment": "Malware payload (Mirai)", "value": "9ed3618c4052bc9ef98e120e2da6e98e941089e4eaaa11a3575c3a6381d6e83e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777159251, "uuid": "e6a3bb29-09d3-4d66-ad9a-5bd27ef2dc5a", "comment": "Malware payload (Mirai)", "value": "3482c063116d2739939060b163dbe506f9af635c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777159251, "uuid": "94eed274-0277-4508-9cde-8cc523b148d6", "comment": "Malware payload (Mirai)", "value": "5e400c4f33b3c9fa3cc3bd7e398fdcee73fc64726f4b6f75a9fc927c35d8c8f2e2fd894b8b6e14aafa941dad5cdcb9e0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777159251, "uuid": "07b6e17d-8ae7-4181-b67d-5c41bef63bcd", "value": "T19EB2B03C6F040AEDC94BC17906A947203A711B716583EC4B7266EE972F5F46CB8C36D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777159251, "uuid": "b764ce97-4b4a-4799-98d5-e4de75928ae7", "value": "384:oeD8ZSH2LLZUYyGZbsOiTnZ7/2DJIvOQd97Pg04yVWLRz3md9JgGlzDpH7uNj1JE:oeD8ZSWvZHZbs1ZYIvOyVgCeR3i9JgGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777159251, "uuid": "fec3514a-0f36-4612-a191-8f272a97c8f8", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777159251, "uuid": "017b4d19-a705-4de7-bccd-6d45453345be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777159251, "uuid": "b8cebb3b-a9c7-4c4d-87a7-edeb9826ba19", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5edc8cde-40a8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777122731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777122731, "uuid": "2f9d72fa-3e64-4cca-a972-03920622f8b6", "comment": "Malware payload", "value": "c02a74961a6fd119d495ef1fb3cb00ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777122731, "uuid": "e1ad88b6-f82f-4e18-bada-14e4f737e6cc", "comment": "Malware payload", "value": "9f892306ebe85654e7cccbbc5b7bcd11be8553576001251e0d3fd32b86c3bc4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777122731, "uuid": "64fc3bef-f3c6-4b52-8ad8-b55b559edb87", "comment": "Malware payload", "value": "62f2f00a254f47d29a0359ade3b5e6486ffa6980", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777122731, "uuid": "3a6671b5-e885-4c69-93ac-36c237c3ff30", "comment": "Malware payload", "value": "db716b10c7319fdfcfe28bb1151d061ab8b81a65368fb3d39d2c56cb2014272945e5c957fccd1f4b855d91abf455adeb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777122731, "uuid": "b855ae61-74fc-4b57-9f4e-f9f21c578dd8", "value": "T1A5A68CB3905324D8E1A989B4D11416527DBC3C8B5738A3C7BAC471F65BBABE48E39730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777122731, "uuid": "bb435085-500c-4e06-b4fe-5b5b91b270cc", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQv:cqYUQuVDt0TZEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777122731, "uuid": "a4ae1fdf-dbaf-4327-a629-532fe34f9e9c", "value": 10125312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777122731, "uuid": "192ce6f9-de02-42f1-8483-63b608a93cfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777122731, "uuid": "579878a0-795e-4e35-a357-4e40d19d6f18", "value": "9f892306ebe85654e7cccbbc5b7bcd11be8553576001251e0d3fd32b86c3bc4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18727f36-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128626, "uuid": "c3b38260-bce5-4106-a879-4e8a23abc3fe", "comment": "Malware payload (Mirai)", "value": "2482266cbfe7eb424f542aa70a27724d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128626, "uuid": "010a770e-3b89-423d-b896-d3c657b45c9b", "comment": "Malware payload (Mirai)", "value": "9f9cc736b4e4264d09359ccd295aca560391b9a2f352e6f5b4e4bdb691e9ab55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128626, "uuid": "20171a4a-05f2-45fc-ac2f-9583d0ba63e9", "comment": "Malware payload (Mirai)", "value": "5f04a872398df35f67793e51a42fabf9b2af8ad0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128626, "uuid": "577a8ab0-0a09-446c-b2ad-09cc359f897b", "comment": "Malware payload (Mirai)", "value": "2a9d73c89c7ebf08c97e4d684d4c8dd996c16190ec13db18ee3686f4e2f07ff2bf39d1fe9e974db3053f84c8a1116c97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128626, "uuid": "fa49b678-b3aa-40ad-9e5f-0838e501fc68", "value": "T15D5122565BEB0E2BCCE2023B99AB4754AB06FD9340D5FB1BA31454950E3B28A7F31154", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128626, "uuid": "752d6cea-69f2-441c-906c-6bc58bad18d0", "value": "48:JO/DFqDPtFrkFSsCzLq5I7UUUGN8ZpbSl:JOLFw3kFVCz+VbSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128626, "uuid": "ef7e6654-b859-4566-a34d-57d5a288f4ee", "value": 2681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128626, "uuid": "c55f84f7-a799-4e4a-83ae-b2acd9e6f878", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128626, "uuid": "49963428-92a3-43d6-8939-e2e8cb577fc6", "value": "dlr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "526f0a10-40b3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777127435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127435, "uuid": "4e043df1-bae1-45c3-a50b-a8c72767e7f9", "comment": "Malware payload", "value": "dae920ad0b40ef04c4b032d8d3d17702", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127435, "uuid": "b8950b07-5044-4405-a92d-052b677089e5", "comment": "Malware payload", "value": "9fed8bc8014c99a43ded9ca4d9add37971fa64ea567366ec0cbe95e8eee0ca9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127435, "uuid": "a5a4df4d-23d2-4b84-9459-abddea85b3a8", "comment": "Malware payload", "value": "eff310070479e5a735d0a0050fdb1e81381c74d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127435, "uuid": "0d66970e-f97d-42bd-a8ff-5d9ebd55559c", "comment": "Malware payload", "value": "9587db04fe4ffad4913c96b51695b2cc108956b002df35df2dd14141af968466cb72e042c16a74ca7a81c1682fe976a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777127435, "uuid": "73f3d017-042f-48fc-a6fe-56e54139db61", "value": "T17AD623D9519463E4D8E30280B38643DE70D065AD85ED4C293ADA7D423F12CBF664BEBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777127435, "uuid": "804e164a-89eb-4825-90e6-5c8fcf6e67b4", "value": "f08790b45eec1b97a5bd4af00587485f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777127435, "uuid": "dc548762-c9af-4866-9be3-2bd509c4144e", "value": "196608:2n1fUpDPzkhH0LHQbyLHco2z6xTm/JeOtaUMrEZj3zyWbNiBOBPpOEhp//:4uxzaH0LHx8oQ6TwU2TZDzxJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777127435, "uuid": "177d6f31-ada8-4b19-84db-d7f4f3321495", "value": 13262808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777127435, "uuid": "17d192c5-d148-4326-85d8-dd6595193164", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777127435, "uuid": "9c59f959-feae-4c3b-b5ea-636a3e778674", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64d9d328-408f-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1777112004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777112004, "uuid": "1b7b177c-c766-40d2-a4f8-1c21bffe59a4", "comment": "Malware payload (CoinMiner)", "value": "7c4b1176622f41dcd459b72ead30bede", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777112004, "uuid": "bafc6793-dc18-4ac7-ac5f-1faca83e0dd9", "comment": "Malware payload (CoinMiner)", "value": "a04fca73e95829e469518d670a84e46ca0271749a6f8cd3dc7c8a3812d6e5ea9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777112004, "uuid": "12f33ab3-0bf8-4336-b6e7-d4c466a49f84", "comment": "Malware payload (CoinMiner)", "value": "e62820344249569051bba4e5455124854afa2599", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777112004, "uuid": "55c4a15e-3f68-4289-a9bb-604d230268bb", "comment": "Malware payload (CoinMiner)", "value": "a7468d04e224420d149aaff4b8bf5398164e8d9843657bbf18760785fc9494cc0a73e0d69c6cc57f33db77fe75138e96", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777112004, "uuid": "a32ca375-12f9-4035-9e15-5ccd50f60eee", "value": "T12232092D7E4A0331D3A149F81875824B563D6223E797E3EFF373965E4AA62448840E7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777112004, "uuid": "b853766a-8209-4632-bab3-87ff0b5cd7f9", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777112004, "uuid": "3b6e0a1d-a9a4-4739-b543-a60722f4a343", "value": "192:494so2W/qDBKx+ePfh/KPFJxTEZmFhS2cyRpE:4RoFqkwNPFwZQpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777112004, "uuid": "a49e7c83-ff3d-411d-b997-a7bcb72d50ab", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777112004, "uuid": "86d1b66a-04f1-46e6-9d8f-4468935f81ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777112004, "uuid": "f6514c69-2a47-4b55-9a42-74c0f6240d43", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ed80d9-40ed-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777152615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152615, "uuid": "7f774446-a002-4fab-af1e-489ea3dd9beb", "comment": "Malware payload", "value": "01ac0348a623c7f4c3bed2834d528b8b", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152615, "uuid": "28253935-1056-42db-8dd2-d48e9e82506a", "comment": "Malware payload", "value": "a10ef9151e0dd03800f4ccff964a1b8d2583a2d10a82a1b6a537eaf0459f612f", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152615, "uuid": "f1a9e6f9-cdb7-412e-ba4b-9586e340c164", "comment": "Malware payload", "value": "f7c00dac9182648f683bde97db550af365837dbe", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152615, "uuid": "93be41c7-0ec2-45fb-a183-24efc6c63266", "comment": "Malware payload", "value": "0b1de634cb40c6181e99e6cac6c7d2baaf877819138a023355cd0d3362889ecea85b0a073dcc99682abca1b0b2592c57", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152615, "uuid": "6a996ed4-da5e-46d6-8c82-df1c41a34591", "value": "T1CA319C506BF69608B2B35E05A5FF65924C3B7A7E6E79CA0D0054C14E1BB1A48CC77F32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152615, "uuid": "58ad9e8b-fec3-48e2-9d55-9a1de35bcee7", "value": "48:pAlbYyQgQaAAzccJRLRzSkdK4Oggz4J5MLLzQw:pQbYyQgQadzccDFvK4mzjLLkw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777152615, "uuid": "21f49e30-3ada-4b42-ac55-1564b8b849f1", "value": 1676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777152615, "uuid": "55b15222-7b10-4694-beb1-b8c9d67a9882", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152615, "uuid": "50dca442-9c39-45ce-8fb1-a3d0e65851c1", "value": "klkpr_01.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a3cb93-40c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1777134606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134606, "uuid": "ba4e0c4a-609e-4be9-8e16-4f0a0a7e3a82", "comment": "Malware payload (Formbook)", "value": "3566e8cb6dea9c600ba16d38fa328904", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134606, "uuid": "fcec7e19-68e5-47ec-9b24-3b929ee5f0b8", "comment": "Malware payload (Formbook)", "value": "a16cf8abee1b10cf62f189da1d2bc9624776a31e756fb4030662b05cbe43cb03", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134606, "uuid": "2d61d9f2-bda4-4a97-a001-a12f17796fa1", "comment": "Malware payload (Formbook)", "value": "e28ab194c3b603ad6174672f1522c3e959b1faa1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134606, "uuid": "a11acc9e-711f-4afe-a05c-a2d07a9b900f", "comment": "Malware payload (Formbook)", "value": "311bdc2683bff516559445594ff6deeb0f084305391e37647f92394597ae3e99def4ed0cad0ffd7678257066d8742644", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777134606, "uuid": "93701359-4957-48a1-ab49-746e86332a83", "value": "T1966533EB62EC3D3C590D554BFC7E9F0976F04A4BC4B9B1DA91B570A3061E2A1C35E80A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777134606, "uuid": "e7eef362-1b7d-475a-a292-6d5a7fc21d0a", "value": "24576:nG8Nn4oFBZMFK+cPvSzuurcCoP8DKTT8nZ4uNb8O7ZZDzJdQgVGvVkjFY0Ld:G8R44ZrkTkEDKHPuNBFZWud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777134606, "uuid": "992e107b-69a8-4eae-ac70-ff4a3a5172cb", "value": 1427442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777134606, "uuid": "b6519d2a-2f4e-4f93-85ba-0a4873e39a50", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777134606, "uuid": "a3ab53dc-d584-4ac1-ab22-21f51b04a238", "value": "DJH2HES0.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a47557-4069-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777095741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777095741, "uuid": "6a1240d7-7844-4850-a0e9-13d66a879b2c", "comment": "Malware payload (AgentTesla)", "value": "2bcc47d6225fb1a7c717dea8f42a4852", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777095741, "uuid": "a0e9b16e-1ada-4b0b-adf1-4f43d2ef44c2", "comment": "Malware payload (AgentTesla)", "value": "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777095741, "uuid": "c8e75875-f486-42ae-bde3-9d8ac1c86947", "comment": "Malware payload (AgentTesla)", "value": "86602025d6ccf0e1592068a506b84b3e342c2470", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777095741, "uuid": "f50fc086-db93-4643-ae5b-403140354185", "comment": "Malware payload (AgentTesla)", "value": "c8ea497d5672f3c9325866e43b41dfba36fd9dd58f583cb11438a2061ca066231e21a025c05c9ade2bdffa552184a74d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777095741, "uuid": "47d01c43-1e95-40c2-9861-0e195ce63a27", "value": "T16125AE16A3E416B4E63BC278CBA64233E6B6B8451770ADCF0255D6152F33ED06B3B325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777095741, "uuid": "1e891ac4-eca1-4d43-abde-8125f865386b", "value": "7d315419a8bf8d007177384cc586ea3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777095741, "uuid": "3ec2a424-a78d-4cae-af9f-599542fb5a30", "value": "24576:DmaUsUEwGxU+xvVC2+KucckBgf/D4jkWffzMPOzucuhU:DmacEJxUeucckBasjn/CcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777095741, "uuid": "8eae3e6d-c654-46f8-9ef4-0399c3a0b26a", "value": 1014420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777095741, "uuid": "6b41bd58-ca29-4386-9c8d-7ebe6ca511dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777095741, "uuid": "4e05f6f3-a348-43a4-b2fb-9ef2ec98883c", "value": "Vessel_full_Main_Particulars_Q88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d82f2f-40ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777137579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777137579, "uuid": "3b3e4658-4eff-4c73-aa42-80b366ba9f35", "comment": "Malware payload", "value": "7937f23e5537ba422821c40a5f194d9b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777137579, "uuid": "d2a5e87d-f8a2-4907-b8ba-5904db63f42f", "comment": "Malware payload", "value": "a29257f550252aec349a9219b1e4bcda1a67d1cdb2376f306131d3ad39c9cebf", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777137579, "uuid": "8998f7aa-a411-48fd-bcb5-647f65179556", "comment": "Malware payload", "value": "cb1c142a16593c92c777f799f627b03ff2a110aa", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777137579, "uuid": "1a7aae44-9794-491b-9970-ba6a273fab37", "comment": "Malware payload", "value": "541c96f75772039930fd4248c89bc3468b39f50a87a095d737269d4aacb1ec22b04665e6f3bdb752660a8df9d8a45602", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777137579, "uuid": "2f75318e-b445-435e-9f2f-5e31054e6cf8", "value": "T116183321B99AC532E67F91769A74EF6B65BA3EF20B7244CB23D83D6A4D704C14170E03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777137579, "uuid": "03702ce0-4d58-4767-81d9-81c5f030c4aa", "value": "1572864:Ph7Ezzqog/Kpq/wykPbcIoEaSZJL0VswAqZlCI693spEPRFVEAPPku3j5MY:+AZ/wykaEDcOwAoCzqAPP95MY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777137579, "uuid": "a3321272-6444-4f06-8250-fd56f192efe3", "value": 88146432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777137579, "uuid": "9a4c1c8d-91f9-40b9-a2f5-d125eb3686c8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777137579, "uuid": "c63fea47-f77b-42bc-93af-cb27f458510b", "value": "app-update.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e6cbd9-409d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777118044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777118044, "uuid": "dd21566d-d6f1-4155-afd0-f0d66aae4c88", "comment": "Malware payload", "value": "49d99616eeff0d941feda95aa24fc598", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777118044, "uuid": "59e72d6d-cb8e-4c82-9a33-2bb170b0af2a", "comment": "Malware payload", "value": "a2f827bcb3acc7ccfc45f202a0e8adae2cd6439ae46d0d4d401a418846761a2e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777118044, "uuid": "c74c86ae-f892-4330-ac46-9937fecf823e", "comment": "Malware payload", "value": "25efeac1991deb6310e9b2601e70ca7e04fcd6f1", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777118044, "uuid": "74d9c2ff-a19d-44db-9cdb-a4f9414f005b", "comment": "Malware payload", "value": "2bae4dffb17ab693eb813bca15f546b45f3cbdcb4a146e941228b52340d2c52897dc6b26f7af9c546be75666b8b4dcfe", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777118044, "uuid": "0b1a715a-447a-45a7-aaf6-974440b2cded", "value": "T1CF7601AFFAE94B2ED435803249875139255B8D287602D6062758B7F83833EE44F47BDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777118044, "uuid": "aca74dfc-2b4a-42e8-8107-0a3b70905f42", "value": "196608:WiXcL1cZwekhMiFAVOZV8Zqr+MbTCUv97U1:t6swMiFqE2dS/12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777118044, "uuid": "17fed0e7-9887-458c-bada-f2f7932fbed8", "value": 7127338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777118044, "uuid": "d552f020-bc66-4b30-be2a-a8120701a341", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777118044, "uuid": "1be4777e-38d2-4b38-b074-bc6af3530ad3", "value": "1111.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b3f0cce-4099-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777116229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777116229, "uuid": "96591294-d434-49ae-8f51-545ceeac8b86", "comment": "Malware payload", "value": "c39c702faf2bebdb7f8d79913e5aa4ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777116229, "uuid": "24aab615-d385-4a41-addb-afd836b32099", "comment": "Malware payload", "value": "a2f88acc3bd4d3d6b90de9736b89795e238e577f48f2d36fe86852f0ce6b14ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777116229, "uuid": "8143c328-a615-45a6-98c0-7b50fc7267d7", "comment": "Malware payload", "value": "a4403f04049808c58a36a63ef5753a211c567fb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777116229, "uuid": "6475ff57-afe2-4170-830d-fe6df6d23ec2", "comment": "Malware payload", "value": "322fcbd876c7ca9bd51af6fd9987cf09801c18d6ac250f14d5b28fd7fc25bc8f7cbf12ed976482114821043ddfd71574", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777116229, "uuid": "eec0bf7c-37d7-4a2c-8edc-6c586bc5316b", "value": "T10B65E0633711DFA1D314C67009B3C7555AF524A20BE2548AB278C7287A11A2EAE5FFFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777116229, "uuid": "fe2792f9-5c57-40db-825f-66eaeb81d0ba", "value": "24576:t4CTgOHoJHSTQFzx+J8nVZkpDZmFhJeyxBimoZnytCu964HP8/OX91DXk3WooQZO:t4CqoQFzxLVZknkzboZnytCi+OXbD0Xq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777116229, "uuid": "c7adf590-680a-41c9-b9a7-191b1b9a3010", "value": 1488674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777116229, "uuid": "40241a7e-d018-4139-baed-1914759c81d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777116229, "uuid": "e7247d37-4482-4e8b-a2c6-a22e63396226", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e18d668-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128823, "uuid": "f86ce718-cd6e-4ccf-bd8e-f7e5e7113933", "comment": "Malware payload (Mirai)", "value": "c3d81873460d44bfa3a346833eecbb14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128823, "uuid": "e5f22e32-0aec-4d1a-9437-09725c2e901f", "comment": "Malware payload (Mirai)", "value": "a3b2902feee9e5b31f8d180f25795bcecbe9ca4eb15eb9eb585247a1d3196f6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128823, "uuid": "56aff4ab-9705-4340-8dff-c6ba3eb68646", "comment": "Malware payload (Mirai)", "value": "679863163eb656a258b0f317e3e4a4319d7fc47a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128823, "uuid": "a94fabd9-6c35-43fb-bd82-9db689094fc3", "comment": "Malware payload (Mirai)", "value": "0ebd53ee7a6ce07900000f3bef0fb7f7a3af07f10ff636483a51fe84d16ad4de161057cfa42161a91e14c4dcaf2be4c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128823, "uuid": "cd8771b7-9562-4237-94ca-63f2dbfcc7cd", "value": "T1EED3930ABFA02EF7E8AFDD3746E92B45208C651B21987F75B934D414F24A64F24D38B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128823, "uuid": "341a2995-4a02-4902-8aa0-834d2b56c1d3", "value": "1536:lAwUOWrTlvge18s1PGR76breXZJBHJD9h5kuHlpLBizcbBHCAMv3:WOwvl18s1PesrCZR9h7Bizn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128823, "uuid": "09660c79-59f9-4a1b-8d96-631f26563888", "value": 137880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128823, "uuid": "2eaa0899-e84d-407f-84ba-89afacdc9877", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128823, "uuid": "72f3d951-91f6-4485-bef2-6a3283887703", "value": "KKveTTgaAAsecNNaaaa.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "391ef69b-40bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777131258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131258, "uuid": "6caf0b6e-f111-4d3e-b09b-ecb1e18eef40", "comment": "Malware payload (Mirai)", "value": "55ba9bfff420e5f297f65fab0d82860c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131258, "uuid": "e342f4db-10d7-4285-a4f3-77698e3bfe27", "comment": "Malware payload (Mirai)", "value": "a3ed3052c75b93adec2f9051a3a96e94baa165f17c88d926bc9d6328c3fbba68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131258, "uuid": "5975bf74-ba0e-40e3-9b75-8fd058b83b54", "comment": "Malware payload (Mirai)", "value": "69c2ac344e9a77dda2b3ac6c661147ad72c79d15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131258, "uuid": "42a06c1e-83b6-4872-8836-b84d82f4104f", "comment": "Malware payload (Mirai)", "value": "0bd880e548a591eb33b68e62808ee68416eed4fd1303e78cf2e52fc23993ac6e2c54ddc6aea8f80d97967ed574b5fb8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131258, "uuid": "171c081f-86e8-4a10-9893-fe530b4b6a9b", "value": "T1C7662A13AA2CDB0EE11432344CF2DA986B291C8541DAE927B791F718E9F306C5D6EDF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131258, "uuid": "c7ae7e8e-0084-4686-ba67-87d33ef8d671", "value": "49152:3/l7fRyilgRSyuWmlAVESawmRSoyBL/pdBr9RlflPacFgK2TLxcB9GmNg+1/MbHn:/ooQPZkIQn4jEu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777131258, "uuid": "d34d2030-8fdb-4d20-9343-b4a711f67c3f", "value": 6750401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777131258, "uuid": "3cd28460-b044-43ac-81f3-809d0fd46883", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131258, "uuid": "1fea33aa-df67-4122-8ea0-c89525aa5ce0", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c42177-4088-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1777108970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777108970, "uuid": "5074f696-b546-4e3c-b194-37b224810648", "comment": "Malware payload (NetSupport)", "value": "e13a8ebecc35ea106004d283f288f9ed", "object_relation": "md5", "Tag": [ { "name": "185-107-74-215", "colour": "#13E1AE", "exportable": true, "hide_tag": false }, { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "bksju-com", "colour": "#DDD9E4", "exportable": true, "hide_tag": false }, { "name": "bksnb-com", "colour": "#0FE618", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777108970, "uuid": "b5fbb7d3-e581-477e-8232-f5e9632bb492", "comment": "Malware payload (NetSupport)", "value": "a481da0c832714ff5f1ca24224bed1694830fcb9aff4e57cc48f9bd34c672565", "object_relation": "sha256", "Tag": [ { "name": "185-107-74-215", "colour": "#13E1AE", "exportable": true, "hide_tag": false }, { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "bksju-com", "colour": "#DDD9E4", "exportable": true, "hide_tag": false }, { "name": "bksnb-com", "colour": "#0FE618", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777108970, "uuid": "05100760-6d35-45c8-ac1e-4e2f5aafa817", "comment": "Malware payload (NetSupport)", "value": "472fba0ddc510e6b30bc3ce38815ffe59125bbc9", "object_relation": "sha1", "Tag": [ { "name": "185-107-74-215", "colour": "#13E1AE", "exportable": true, "hide_tag": false }, { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "bksju-com", "colour": "#DDD9E4", "exportable": true, "hide_tag": false }, { "name": "bksnb-com", "colour": "#0FE618", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777108970, "uuid": "2b1584ec-9a1e-4a5f-9aca-e5fb6a57cf4d", "comment": "Malware payload (NetSupport)", "value": "f8d4d5338f66357ba1dad5ba9008aa3b9b5624517762fc8f3b232e442034beba4793036db2962f1940817c6795c53aeb", "object_relation": "sha3-384", "Tag": [ { "name": "185-107-74-215", "colour": "#13E1AE", "exportable": true, "hide_tag": false }, { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "bksju-com", "colour": "#DDD9E4", "exportable": true, "hide_tag": false }, { "name": "bksnb-com", "colour": "#0FE618", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777108970, "uuid": "80cc8b92-0f05-42a0-b1af-2e7b27258568", "value": "T144A5339A9A0D89DFC95B4F78C00B5E1AD33E3A40F1AD7081F6724252CC89B9F57B8719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777108970, "uuid": "7068d939-6696-4d00-9abf-85d78b41c1f0", "value": "49152:itWKcquabYrp7jnKVnJTmm3F+WVcBdj3b2+3bw/0JBAThAn/1N9a:i4queSXK/VYj3b2+30/wB1Va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777108970, "uuid": "ee703eea-7e39-4b87-a2ae-a716cb743ca3", "value": 2201632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777108970, "uuid": "ac2151de-c25c-4479-9af6-bd9298671bee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777108970, "uuid": "1022c823-465e-4ce8-b00a-4e873d1c9b63", "value": "altera.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "542b5257-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128726, "uuid": "dda04da5-4aae-481f-a561-cc1def947aec", "comment": "Malware payload (Mirai)", "value": "cbf51c9960459f060784e8f3809c42d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128726, "uuid": "74f538bd-0fc7-4074-b2e1-6e016390002e", "comment": "Malware payload (Mirai)", "value": "a4b48a0498e3e507c61a484723be0738d7306efefe2f9e194290bbe2aa5338e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128726, "uuid": "508ad2af-8e8d-4bdb-9721-b60f96d4c5f8", "comment": "Malware payload (Mirai)", "value": "80877a312880156d3c1b222c684536c44d1aeb8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128726, "uuid": "a38d4f81-a26e-400b-8d7a-33016e386f97", "comment": "Malware payload (Mirai)", "value": "64ea7ddd1a07857f082b45935182e11945839c4ac06a2f481a0323610ea7b26c7186e50bdd006ba524a9474b45c13765", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128726, "uuid": "a06cc5ee-b146-4e49-9106-5da8d5bab25a", "value": "T14B03E001D43F4364F94B643642F66AA34668FC4521AE4C1DF0E4F97BECAED366C29B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128726, "uuid": "5622bc97-1204-4487-aa37-10abe239e3be", "value": "768:R1uCqvbT+l+veAgIHhX9IVQOvA3S3XglfGEn3K7nUDypqZVeynbcuyD7UHQRj+:R1dQH1fhSHCSgsL6eynouy8Hyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128726, "uuid": "05f4e6f2-e897-4081-a156-29a33c305750", "value": 40387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128726, "uuid": "39bccd03-1bfd-462b-a834-9351e9510670", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128726, "uuid": "8d8ff194-546b-4eb0-867d-eb544e4f7944", "value": "b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e452d856-4076-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777101480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777101480, "uuid": "ff2e0d0e-9f25-43d4-92c8-c5b82feb8922", "comment": "Malware payload", "value": "0bead176b97797b21c6e2dddcce9fef0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777101480, "uuid": "9503613e-a0fc-46c0-a4e5-e05b4ea735dd", "comment": "Malware payload", "value": "a4d68ce9f96c57cdd7031b43219e281ee8a918bcf43358d9f79c738810d207bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777101480, "uuid": "c708f751-587d-418f-8a9e-da92f3ad31f7", "comment": "Malware payload", "value": "622e0faa96269c52d9d89f662cff7b0eb4f0e761", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777101480, "uuid": "cb2baeb5-dbe0-45ea-bb2f-ff8cddbbae4d", "comment": "Malware payload", "value": "62bd75edebff999fee2b5f97f52cd795d493ae2f65c9272a62c2c16c8a048becf1347ee54a929c4d5b2d984a7ed78c95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777101480, "uuid": "a52de524-364b-4106-b080-f5b03404859a", "value": "T1CEE73391E8E105CBF791A676B1B0D191DF5874AE8736C87B842013D301D36E93FB6B68", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777101480, "uuid": "207c8d49-048d-45ff-9eef-f7015f720c5d", "value": "a6cec5b1a631d592d80900ab7e1de8df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777101480, "uuid": "048d4ac5-59d7-44d0-84c2-07a356b4a974", "value": "1572864:oXGMK4XRhbxSCU/+Oy45SSDSPsXTZsmUBGTLUzJ92x4Akvi4R941yr1W/XIEoEDH:ogYRHSC++Oy4G7UTAFOnKRu1yr1OOED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777101480, "uuid": "175b4de8-c2eb-4e9b-8ef8-99e8d1175bf5", "value": 68798423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777101480, "uuid": "c4d8b8df-2373-41a4-b091-384fa1079818", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777101480, "uuid": "cfce86c8-167a-4a27-b3c0-f769ecd327bc", "value": "wechat_gui.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a9d08c-404d-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777083761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777083761, "uuid": "f324d0c6-e7b2-4321-8f3d-a40ad1ba5252", "comment": "Malware payload (AgentTesla)", "value": "63c4d9ee26dbb73faffb70c4e9465470", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777083761, "uuid": "4cb7ed28-480c-473b-8d9a-7c30faa8ed6b", "comment": "Malware payload (AgentTesla)", "value": "a4e6ca7ea084e28449235ef58fa0f8d30f04d8af542fdc2a4c9fa243e10762ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777083761, "uuid": "4fead43d-3083-4d73-86b1-ae321268ab6f", "comment": "Malware payload (AgentTesla)", "value": "35fddf7676aaa263ce88f2a3c1daba2a69956f37", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777083761, "uuid": "7771dc30-4f19-4d81-8a96-57202c0faecb", "comment": "Malware payload (AgentTesla)", "value": "38c24f3a233f28cd9ea08c01c17efa24cde4ca487953072aacf9858700f574ec6632229a07017896f3b4a8131ecfd284", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777083761, "uuid": "29e0b307-de26-483f-b6e7-ea73d7321e69", "value": "T1312533A49F8A7AB18F3592AE35E39F5AE7F80E511F08B1D7110733B2810FB66091BD54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777083761, "uuid": "5e94d50f-b8c5-44fd-b0f4-84ee5252feea", "value": "12288:jz+wzyU+JJYw6RxgaU+ox24/omjkHdFCiyAz4JF8RMWiVIbwMzH7rD:ty57cOR22oP9qAIF8jwAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777083761, "uuid": "67a7097d-fcde-4af8-b0ce-7eb60f5c9365", "value": 967132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777083761, "uuid": "a42aab26-2009-4dde-8b08-6cd6669ffadb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777083761, "uuid": "2a2d77fb-05e0-4778-a090-9d9c15856d80", "value": "ps_NzSiQwfwWT8b_1776697587450.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b90ac8-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128697, "uuid": "815efe0f-6e07-46af-b254-7365402d31a0", "comment": "Malware payload (Mirai)", "value": "be4bb7324951c68c57879daa5213e972", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128697, "uuid": "b5abd3b4-c843-42aa-a2fa-cef837e212bf", "comment": "Malware payload (Mirai)", "value": "a5524e225c68e0cc0a1a18332c2ba49007d240efd4337b115b55cd9cdf8e0b8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128697, "uuid": "cdc8fcd1-f82e-458d-a586-5c908eaaecb2", "comment": "Malware payload (Mirai)", "value": "06eb38df8b6271e668749b569174a62821a02ee1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128697, "uuid": "425c020f-7a4d-42df-bfc3-2e360d1b2da6", "comment": "Malware payload (Mirai)", "value": "8ad56e9401f315f5c8394fe3cbeba5a3643888a4d5ab86d68cd781c7491001228d6b371dc9188fb0d1bb6b16a0d23fe7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128697, "uuid": "98153d85-a6ca-4ebb-8bae-936621cab5cf", "value": "T19EC30956F8819B11D5C151BAFF0E124E77131B3CE2DE7312AD24AB307B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128697, "uuid": "a74a832d-5fcf-48bd-9b17-9131ecad8888", "value": "3072:fjD7YhjFMX+maR8TcDeRqQV3tNQYciYTG1L:fjD76aX9aKTcRQVnoiYq1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128697, "uuid": "9cfaa609-dbcb-44c1-a435-115677397a51", "value": 129244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128697, "uuid": "7758626c-b651-44ea-80b0-0fd9f3e4f030", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128697, "uuid": "3d6e9564-5e85-41a1-abfa-557a7216cdd4", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af95d3e-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128711, "uuid": "bda72f1b-3071-4246-87fe-85fc1d3d8db5", "comment": "Malware payload (Mirai)", "value": "b1c2229ab4afdb0fc6e38d9e3a59b725", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128711, "uuid": "9b4d1a8f-5ceb-45f8-b9f0-4409814c6329", "comment": "Malware payload (Mirai)", "value": "a553301ea8d2349854b2cc8aace9542db481fcfe642d0863141146e0a58722c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128711, "uuid": "51605bd0-efa5-4d22-bef8-0168c8abb2b2", "comment": "Malware payload (Mirai)", "value": "f005475825f9e48e6b464697bd40794265745814", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128711, "uuid": "faf4166a-3ffc-42f7-81a1-12ea8be38d3d", "comment": "Malware payload (Mirai)", "value": "3bfe2117894e146ad0e2345d6af0a976a548303038f586156a64f26aaa59b2fd79d415b374c90ac7e34b44b7e0e6b9a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128711, "uuid": "ccfe968b-02d1-4d73-a677-592ec4e5bb4b", "value": "T1BEC32A05B30C0D47E1633EF43B3B27E193DFDA8121E4E640655FAA8A91B2D32558ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128711, "uuid": "b3a8d8ba-a42b-428f-b89e-d4b73926e86b", "value": "1536:6/B72AZ4ex10JrZqQ7UrZb6wI0vAnjiLVRuzae8Dhq6N2te5f3dyJ:6dB4exMF7oZKJnCNYakJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128711, "uuid": "0408dab1-dd72-4a70-9f9d-f23a168b06ac", "value": 121508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128711, "uuid": "18c0cb9b-7a4c-416c-bb44-7d8ed2e02690", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128711, "uuid": "db9bbc57-0c3e-4d97-8a5d-666ebaa6eccb", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad2f724c-403b-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777076047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076047, "uuid": "e9b2b18b-983e-43a8-9d78-3e1a730c1c13", "comment": "Malware payload (RustyStealer)", "value": "80d75d0c4f1663e4e74e5fb5387f8a28", "object_relation": "md5", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076047, "uuid": "0b39d561-6493-44e5-a379-85ca0a5bc2d2", "comment": "Malware payload (RustyStealer)", "value": "a6a8317b113c7f1b4826b24fc983a924b664f1dd6844cc4ce4c0e553cd39f948", "object_relation": "sha256", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076047, "uuid": "55164ea7-c698-4f30-b5fa-5a1a2b72b2e0", "comment": "Malware payload (RustyStealer)", "value": "78c3b0c7ba91c5ac51093d8373709454f24d16c4", "object_relation": "sha1", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076047, "uuid": "ab13768f-f016-4b3a-8708-1bf8680bd7ed", "comment": "Malware payload (RustyStealer)", "value": "4af652e46643863b268bc4df78ceafdaae68928d61f9d02c8496cb2c2c52094f54b668251e869d5bdf8c4ec05a31b46d", "object_relation": "sha3-384", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076047, "uuid": "36bf4eab-7eca-45d9-ba0e-3c53c4a0a09d", "value": "T17B4733277285A53FD06E3B350673A11058FB6AAEE456BE1627F4C58DCF220C11E3E729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076047, "uuid": "6f7ad176-def7-43f3-bccd-a8f172ed2318", "value": "eb5bc6ff6263b364dfbfb78bdb48ed59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076047, "uuid": "37cc3db1-7917-49df-824a-7d4a7804c8a9", "value": "393216:wF+f8rkYcuXWsPUbf5x2HrIX76RKDZJjB+n30BTJShxHX50BbyqC99c31PTTYJ:v8K7OUbf5VXuRKzB+nCdS3ybXCbup8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777076047, "uuid": "25229805-ab4c-4566-855c-3ec17cd48bad", "value": 26597095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777076047, "uuid": "99f41f8b-a595-4662-b97e-ce85b4e8f3a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076047, "uuid": "5dba4537-50d9-4ece-89d4-15085dfda67e", "value": "letsgo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f1e10ed-4097-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777115376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777115376, "uuid": "b962c0de-71b2-430e-8f49-42fba7c7b546", "comment": "Malware payload (RustyStealer)", "value": "31dd115894ebf92e87f497dcdd062015", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777115376, "uuid": "3b0b1f40-769e-4f82-90eb-526cf68e59cb", "comment": "Malware payload (RustyStealer)", "value": "a745e693ca041c5e7975fe383d0c9806a08c8ff1242157a0e2b30d0a691096bd", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777115376, "uuid": "52636172-798b-42dc-9118-005ce6eb9984", "comment": "Malware payload (RustyStealer)", "value": "e465946a68f7c0d1fb374e182468a0c23d41078b", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777115376, "uuid": "510a77f5-6c8b-4eb4-8399-78720f2402c1", "comment": "Malware payload (RustyStealer)", "value": "403a012c91aa63c7d45bc8b77f583297921ae4927628b5c10dc3503f99b0d789560b9a55babb7433c7d9aedd816a85e0", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777115376, "uuid": "adf8ec5d-a2fe-4e14-9c57-8d737c67819b", "value": "T10B6777F8E749742FE9E4138C46C0FC593EA2D1DF464F5BA742B28B00626E9D459BF890", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777115376, "uuid": "2b031706-1e22-49c1-90b3-fde8973e428e", "value": "d7c01c97eda266768b15868f98d29ba7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777115376, "uuid": "4aa63c67-a2c8-445c-b723-336c6865e01f", "value": "786432:GZhi9mrkAyxzwcsC2UiqYR2pwe3xm5f3h:Gn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777115376, "uuid": "c34cd24f-e0e5-4508-b594-aca52007134b", "value": 31679478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777115376, "uuid": "4efc11f2-050a-48e1-a8db-a8af1895482d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777115376, "uuid": "905c9a87-5f3a-4540-9d90-79548473bd14", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f4ebb1-40c2-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1777133821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133821, "uuid": "a2b603ee-34e8-4134-bc41-28bfaf7bb745", "comment": "Malware payload (SalatStealer)", "value": "8dcf6de09b400dc6774a261980f99106", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133821, "uuid": "213c1896-97fd-4b13-bc85-c6c688804401", "comment": "Malware payload (SalatStealer)", "value": "a76cf99fe5c8398cbbc692870ba48931b1cb220b05bec9c224523e1be6a73db3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133821, "uuid": "6cd81e49-5b21-458a-9c5a-c0f4756fc578", "comment": "Malware payload (SalatStealer)", "value": "bf1056fb2c0d0d786adb4cc5fc65b704b071a5a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133821, "uuid": "443c692f-70b5-4f74-83e4-0333579bb561", "comment": "Malware payload (SalatStealer)", "value": "88c3d788c3842dd9be91034b2815de5cdfdd49f8514af5b429d872d9524e011b84ede13b6e6305fb5c9a67ffe2b0fe8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777133821, "uuid": "9ae4a885-6c5d-4a30-9b75-b545ea2dab05", "value": "T1ADF533DA99214383E61C3373E84A3D42C27B11CCA7DA569C8514598396FBD92C2DFEF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777133821, "uuid": "b1270adf-608a-4fd4-ab2a-83916d73aa17", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777133821, "uuid": "16e50237-05bd-4334-ad0e-2b226a773dad", "value": "98304:49ajJTNSquSgNtw0Sj4opY2DguQtnkxKsA:5RpuDwNpZDguQtnkxKsA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777133821, "uuid": "ddbe04ba-bde3-43a4-8860-71339ea61353", "value": 3592704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777133821, "uuid": "2b5c64a9-537d-48df-bec4-58cd45b4987d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777133821, "uuid": "8e7738ca-7809-4ecd-ae0d-d8b7530497a6", "value": "TelegramFix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32538a8b-4055-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777087008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777087008, "uuid": "a56553bd-3972-42b9-9006-098abfac368c", "comment": "Malware payload", "value": "3ae87954638e049b7fd05d67f8275985", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777087008, "uuid": "56c27076-af53-4a40-86a1-eff178aa5e18", "comment": "Malware payload", "value": "a7d41bec2105fc387e3e013960637d0b64b201d872e58d0f80a8d8abfc9de8f6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777087008, "uuid": "346c47c0-f332-4404-a167-5e5768acfcff", "comment": "Malware payload", "value": "8bf24282a7e2515e912a838f337cca5253b791f6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777087008, "uuid": "3c5a5a4a-bad3-4d62-a27e-58217072b168", "comment": "Malware payload", "value": "fe44a31fa2d198188a5aedbb6cb46649e23bfd3524c40810974b10077533a53db43e35cc2f83fb4f59b5522e9179a1ca", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777087008, "uuid": "2c963f65-bf74-416a-b300-a6510f1aa99a", "value": "T1DD136C6566853C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777087008, "uuid": "b75a3778-1c20-4e38-89a3-703cfbdb2570", "value": "768:bwXRWNGxVA9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bklx/cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777087008, "uuid": "db7a4e0e-c648-4295-91e0-c90349009c80", "value": 45519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777087008, "uuid": "a0e53083-7f90-42e5-aacc-02731dc1ee80", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777087008, "uuid": "23a35fee-7d67-498b-aee5-b35bdb77f981", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9b6ff1-40fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777159313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777159313, "uuid": "6e59638d-fe4b-487d-b8c0-4f8ea2ee097b", "comment": "Malware payload (Mirai)", "value": "b7326cdea380dc2dd214d5cbbe74e8b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777159313, "uuid": "92cabef8-ea22-4d1f-be20-c2fab7432a74", "comment": "Malware payload (Mirai)", "value": "a8fab0686b5304a29bd808f5d88fe7f38f1a2c1e074704ca7ae85968bf9ee2f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777159313, "uuid": "4d2b6676-fc78-41b0-bc63-928cf6854c37", "comment": "Malware payload (Mirai)", "value": "9069bb75fe2cc8f4eb2ea0acd595e6ce7d8210d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777159313, "uuid": "2aa5295f-bca9-4a5a-90d8-207d9b68ea10", "comment": "Malware payload (Mirai)", "value": "80349ca1ef41f99cd32b4c526bf8258ff9ad559581f3d74808096e82014d1ef45079c95548b5c49f1c88d6c5c72cac47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777159313, "uuid": "f26dc676-fe8c-44be-89c3-d675aecb1ca3", "value": "T1FE63951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777159313, "uuid": "7a1e6f09-11e7-47d8-8557-ace7464386e3", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAz:UnN4ZH2SyOyuIq8LMVIUq+cvtpvXzbL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777159313, "uuid": "6f19fa50-ba72-42c2-b576-f916a4b27900", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777159313, "uuid": "831e819a-bad2-4448-a01b-d990e5f7d8d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777159313, "uuid": "502f11ec-0908-40b6-811d-9602b6c100b8", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76eea80e-40e2-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1777147682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147682, "uuid": "648922df-59aa-49df-95b2-5a1f71ab0db3", "comment": "Malware payload (LummaStealer)", "value": "279780ddd4170ee927f49e62269667ea", "object_relation": "md5", "Tag": [ { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147682, "uuid": "c48ae4eb-5977-4658-b07e-4045212fc171", "comment": "Malware payload (LummaStealer)", "value": "a9091aba78af2e7fc794e8d0c9d17ed34347259fcf79395485135162989f6d83", "object_relation": "sha256", "Tag": [ { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147682, "uuid": "329d6337-508f-40d3-a4eb-414aae09e651", "comment": "Malware payload (LummaStealer)", "value": "1ca5e6a1c34fe806f6938086bf3de38b41af98ad", "object_relation": "sha1", "Tag": [ { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147682, "uuid": "b897ba72-d4b4-4c25-8f45-c8d0a8df761c", "comment": "Malware payload (LummaStealer)", "value": "a021f45a190180fedd33e4c8f5d40073a6d8c09d2067a4a7278e4d8199ff391a255a7ad4ca4a6523f864c65e1c830e13", "object_relation": "sha3-384", "Tag": [ { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147682, "uuid": "09185e17-760c-4567-896c-19c694577f2c", "value": "T1BA747B8AE7BB54B0D58B0938259FB33BDF3416294328CEC7DBF0DA4475672E21536A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147682, "uuid": "d1a32d3d-4630-4830-9cc5-18edae59176c", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147682, "uuid": "14d4984b-7c3b-4beb-96b6-611b8cfc184e", "value": "6144:XvgEeOcmwvEL7fF1jTA659HSC8AVtZ5XlOHaoIhEFydlt:/8OcZ07bf0OtDlOHaoIndlt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147682, "uuid": "7dd158a1-0a89-4c00-b317-6987a5e5f314", "value": 345600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147682, "uuid": "f2d72fd5-eba9-4c49-8e80-57fdef2d042a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147682, "uuid": "13d629ae-9087-499d-9c66-9ec0b127298a", "value": "Build(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f47c36-408c-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777110554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110554, "uuid": "a9ecb0ad-4fb0-474a-85d9-dd19f878971c", "comment": "Malware payload (RustyStealer)", "value": "16ec4a1c3f46a7bf2352e6c241b92246", "object_relation": "md5", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110554, "uuid": "e82a49b9-ea41-4c9f-8134-9ec6664e2557", "comment": "Malware payload (RustyStealer)", "value": "a9856d45a9f6f9be5316a7389af4d5739dd44a95784185725908fba67038bb94", "object_relation": "sha256", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110554, "uuid": "7f73897c-2c17-4f48-b2bc-b78368fbae71", "comment": "Malware payload (RustyStealer)", "value": "da1037c9f256ab4933775f2f268db60c1e948da3", "object_relation": "sha1", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110554, "uuid": "c628063b-4b22-4491-933d-fb459f80ec79", "comment": "Malware payload (RustyStealer)", "value": "440dccb4dfc83499627b577eb4268ab59281f6607b22463570177a966279f74405641f1b69675662963ce2a198326ff0", "object_relation": "sha3-384", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110554, "uuid": "30adea9a-e4f8-4978-a005-e15dca47ddc8", "value": "T1432602F7FCC608F0C25EC93288795A399212213399672A05802CFE5467172BA9FDF9D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110554, "uuid": "bffecaf3-15a0-42d7-bcdf-ac412d5be82b", "value": "2c791dee7254ff7134a5989d9588fa5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110554, "uuid": "c2e855af-a8fe-40c8-8f1c-d24ba07a0eac", "value": "98304:pfX9HGVG4oWGp24LwevlSWYSCrPtwaoOWCDe6N9y2foIjrA92a:pf9HP4oWGc4LfNbYSCrPtvoOWWYl92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777110554, "uuid": "02fb7271-a80c-45e3-8895-3cf756e4103d", "value": 4850176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777110554, "uuid": "4069a186-f4a3-47b6-8ec5-111e945a87a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110554, "uuid": "80c0c3a9-e8e4-4e2f-8532-ddfaaccbeb0f", "value": "a9856d45a9f6f9be5316a7389af4d5739dd44a95784185725908fba67038bb94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4667dd93-40be-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1777132139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132139, "uuid": "885ed4f6-9ff0-494c-a79b-013115f86533", "comment": "Malware payload (VIPKeylogger)", "value": "281d60e209718cabef64ed2f9f89d67d", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132139, "uuid": "6a2d9837-1349-41b5-99a8-eefb31b6df35", "comment": "Malware payload (VIPKeylogger)", "value": "aa0d6d1c51b3021de9ed7c8090cd12647997c4f71238fe4cb89ba7d24060509c", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132139, "uuid": "1473d84e-022b-4e69-9fea-712accdab357", "comment": "Malware payload (VIPKeylogger)", "value": "183dd76cefa2ff3933feb1c5a48bfe617cd72f1c", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132139, "uuid": "41906d0f-5dfc-4781-a1f4-0d962fb6e040", "comment": "Malware payload (VIPKeylogger)", "value": "779360edc5c7f62130ccde45d1ff3b401bf65f36663acec854393603023f8402f25d3f8acded283cccb7ec224d03dca9", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132139, "uuid": "c61fc539-7474-4340-8dea-2a25c0de67e3", "value": "T1E207EE3DCEE8423EC2B7C929D9CA4A17F85A091B231CFD4A68D773A755271827CE211D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132139, "uuid": "b586ccc4-073b-4a95-8258-00ec52aa3949", "value": "3072:BuFuTJuYiVWZu1l9qhpvIYFv4RziGRLU4ZqwvexvMPw2d+41YzXpMmsh7GrYZNPs:9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777132139, "uuid": "100f5fdc-d022-41e4-a48f-bdf8d1ee01b3", "value": 17365194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777132139, "uuid": "0137eb42-0bb3-4b80-8424-82e6c880a4c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132139, "uuid": "4dc3c5aa-80d4-414e-87c6-127cd3b53676", "value": "gcvzm.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca1439e6-40e2-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1777147822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147822, "uuid": "059efb6a-ea9b-4cd9-89e8-38ad2fbbacc8", "comment": "Malware payload (LummaStealer)", "value": "52a4fd8b839a44f7fa527e53327ed1ad", "object_relation": "md5", "Tag": [ { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147822, "uuid": "bfcf361f-2093-4d37-9843-cfd4902af679", "comment": "Malware payload (LummaStealer)", "value": "aa95b0b984dce56dcf8d9e9fabaa6a251b4a80cd7e344b3740d5934596f2e0fa", "object_relation": "sha256", "Tag": [ { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147822, "uuid": "949ba225-fa1c-4e3d-969e-aa0bda8e52b4", "comment": "Malware payload (LummaStealer)", "value": "f4e122124068d7d0f32957ff62a28fc75570919c", "object_relation": "sha1", "Tag": [ { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147822, "uuid": "798f12c7-1cf7-4592-a4fd-c5eba9abec38", "comment": "Malware payload (LummaStealer)", "value": "8add105ad9eb5768a5c3ecade8c06efc0179a8db2f9373f6e030525733521ef4519f0ffcb0243779147ea30295327665", "object_relation": "sha3-384", "Tag": [ { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147822, "uuid": "ea569b82-207b-4202-936e-b8083096a330", "value": "T1CB747B86E7BB54B0D58B0938259FB33BDF3416294328CEC7DBF0DA4479672E21536A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147822, "uuid": "c653dd6c-5342-44ad-b6ab-146d202ab0b4", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147822, "uuid": "54d4c395-46bc-4d51-9848-1c10aa73741a", "value": "6144:XvgEeOcmwvEL7fF1jTA659HSC8AVtZ5XlOHaoIhEFydskut:/8OcZ07bf0OtDlOHaoInds9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147822, "uuid": "1687653f-c8f5-47da-b3e9-8b4d80c88124", "value": 345600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147822, "uuid": "541e3283-c29f-42dc-99df-1a8ae9fd64fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147822, "uuid": "c887cd3b-42c3-45a4-90c2-3ca7e58c52ea", "value": "Build.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11897572-40ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777159968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777159968, "uuid": "4ff7936d-6b9a-4e59-8a7b-7ebba1e0d762", "comment": "Malware payload", "value": "570e21a1c4999945b0afce0ec07e642c", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777159968, "uuid": "bf968d2a-a671-4442-90d6-fe9616114570", "comment": "Malware payload", "value": "abfecbbc24a5d6e95c917392e9b659e3ab3f5642ba5459bf1653f9979cc8b148", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777159968, "uuid": "f3eff8b4-e7c6-49d7-9a69-0a7675792ee2", "comment": "Malware payload", "value": "e05df2c31fe3ec9bc9944c62c993e6db2e62b10f", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777159968, "uuid": "fc585e3d-5b2b-4c02-9c49-a099d4328727", "comment": "Malware payload", "value": "8f8d0f782f89591df7a06f2c7168b956958a095b4012203b5a367f6b332fe7a4f5757d434cf3b052d84fdb65365c3a56", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777159968, "uuid": "3ea3f1d2-1f85-4ad6-9b98-42ed20bc7abd", "value": "T16BC1153EC5A6FCC043AF71D0856A3F06109C2B23F6B66B6CF5C60CA92924685EF7915C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777159968, "uuid": "c8c7d85f-ee4c-40c8-89a1-9c8e03f963b8", "value": "96:eEa0fGBqJn0qd7xBTWDhNxBPgxn95KEnpL/G/GhvK:q0+gxr6DhtPgxnT1pL/G/GhvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777159968, "uuid": "f8fbf917-8622-44c5-8a86-6967bbab0f19", "value": 6016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777159968, "uuid": "75d3eec2-e4c7-4c28-b000-e2a69bea5001", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777159968, "uuid": "fd4a6d3c-5c5e-4773-abf2-1fde46ae06b3", "value": "PI4i2AW4V2LP6CWpZQ4y.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a46e5eab-408c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777110822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110822, "uuid": "e7a780c6-983e-455b-bd1f-88857b415d30", "comment": "Malware payload", "value": "ded0a1b35e3d08fa9e3206d32d8624fd", "object_relation": "md5", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110822, "uuid": "9dffd48a-f2d7-43b7-9ab9-44252610bd3a", "comment": "Malware payload", "value": "adc03ad8e41b62548a2c5e14f6b5fe8b29456f3e9bec4301d9849ec7d6cdde49", "object_relation": "sha256", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110822, "uuid": "f985c64e-7412-46c4-8c2d-8df9a2b59bcd", "comment": "Malware payload", "value": "ff23361d5448269ad69a87033b0394c809d612f4", "object_relation": "sha1", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110822, "uuid": "615e8d82-2079-4bcf-9cbf-d55efcb1514c", "comment": "Malware payload", "value": "eb4ed2d0d14c603c04ddaf9c31349df19e8e8883b00f94dae489b0c8faf4f554bb6fe7f535abccdbaad564f17cc8fd51", "object_relation": "sha3-384", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110822, "uuid": "6e859629-08b5-41ea-81ed-c1c2d0ee6e2b", "value": "T111775B2FB2A482A8E15EC23EC157CF40D97371715B77C6E716E206289E568C98F7B720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110822, "uuid": "46c68d4c-84b0-468f-bf6f-863812de4ed2", "value": "dc855ba4ed17d8feca28bead7f574dff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110822, "uuid": "6b0a967f-9c57-4edc-a1d4-121c0acdb68c", "value": "49152:qnnPBCIliDhznHoAh2SoR/U1WpJ9v1GSmzDcJ0:YBlWoLGSmzg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777110822, "uuid": "fef09d56-1fac-489a-95f8-7e9d4a6b6bd2", "value": 35770524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777110822, "uuid": "db60b84a-a9f1-47df-8f45-5c0363737ebd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110822, "uuid": "aca122cc-13d7-4ea6-b2c5-c8ffd031d0d2", "value": "adc03ad8e41b62548a2c5e14f6b5fe8b29456f3e9bec4301d9849ec7d6cdde49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f65f2d-4075-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777100830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777100830, "uuid": "0806e057-5006-4411-93fe-950bbe592f33", "comment": "Malware payload", "value": "756d61d044c17df38f238e4f869e8ad5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777100830, "uuid": "92caf485-f0b9-4197-84ac-f9d0b04ba9e9", "comment": "Malware payload", "value": "ade2d8f2c123ff20e17c9b6490a0c8bd53abeebd8c034a84a8383ed8b3becb80", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777100830, "uuid": "3b6e627a-6c2a-4cb0-96da-eddc32b0f5bd", "comment": "Malware payload", "value": "4fc056f9c633b1254a6d224e085cea0eb8160f51", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777100830, "uuid": "940ab67a-7a51-47ab-aadf-464e33af822e", "comment": "Malware payload", "value": "8b19a11c2f0dba54d6c0bfa68369b4998ca1cebc53265e88b1a1f372a15a47c6aaa1001feeb36c22cd45abdbfd3b6c4f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777100830, "uuid": "708772c0-6f0c-4330-915e-dfb6dcb1f055", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777100830, "uuid": "ce15e00d-28e7-48dc-9607-6dd7d4dd303d", "value": "3:KxyIok6Cdi3on:Kx7zn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777100830, "uuid": "78c08ae2-a916-4785-be89-f2a9aebcb391", "value": 27, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777100830, "uuid": "9fe32ce7-7002-421a-968b-1b83d6776a7a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777100830, "uuid": "7f506dce-f991-424a-8f88-a9c9bb6960ed", "value": "ade2d8f2c123ff20e17c9b6490a0c8bd53abeebd8c034a84a8383ed8b3becb80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "142f2510-40be-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777132055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132055, "uuid": "8ce07572-9653-4745-bd79-53ded1035d77", "comment": "Malware payload", "value": "bb1b958c2c83727565ade4afc99bb1bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132055, "uuid": "99cef71f-b707-4d02-bb62-dfb0c755bfbd", "comment": "Malware payload", "value": "afe2a7cd428d9b4f693126cfcf5965d8333264c5aed97ff745f678ab4df88167", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132055, "uuid": "68c398b1-4f46-4edf-9b1b-515130aea5bd", "comment": "Malware payload", "value": "38e509bba673a80b00adc2e3d6f173d3d5b00ab5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132055, "uuid": "4e7b12d7-cda7-4aca-86ed-cc8c5ca2a9b4", "comment": "Malware payload", "value": "4d43780c5181fc039868961a4dc6a41d86639bc2d108f6727cf7636b6851bbb30b1fe7dcec921524e45773d6c1570179", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132055, "uuid": "209acbcd-8fad-467e-a586-d91a098a2f79", "value": "T1CBD622EA809412E4D8E30A80328E13CE35D0651D95FD4D2D79DA2D42DF22DAF764EE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132055, "uuid": "216c5c3a-aaf3-43bc-8ff2-0f0fb05673c4", "value": "c189ffc6419b2cf933e77ba446b9929a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132055, "uuid": "706b5770-5791-418b-ae63-ae94fcc5687c", "value": "196608:v4cXskg7c94EQKXvytUPR6q5quKMAhc3OG9NQRZa6qmK570QfPvNhDBA04CPt3hJ:whkjGEVIG4qYuKpu3OGN6Y0yPv6XCnPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777132055, "uuid": "4fb4ebf0-dcbb-4581-b623-d7a1c437c526", "value": 13680040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777132055, "uuid": "78047bc2-b87a-4b77-938b-b39d1fb629e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132055, "uuid": "c4f4154f-f42f-4cd6-a66f-48bf750f03e3", "value": "Pixel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83bd7316-40e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777147274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147274, "uuid": "d52c2d3b-13b3-434c-928c-b6000e847da3", "comment": "Malware payload (Gafgyt)", "value": "db1e9628f0427bbe0df00f0d60088564", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147274, "uuid": "b73d7d45-1a3d-421e-848a-c9b3f4fb4594", "comment": "Malware payload (Gafgyt)", "value": "b03141a53cfa7c91ee6cf8d9b9241d0659ceb7867a00ea28de61352babff4e99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147274, "uuid": "3e2cce3f-e4bb-454f-9146-270d12e8dd3f", "comment": "Malware payload (Gafgyt)", "value": "8e179e814b5f6c5657766775ad9524888df9d5e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147274, "uuid": "6068e46e-962f-4d96-903b-0a7e4d945041", "comment": "Malware payload (Gafgyt)", "value": "a7759db6994fd1091d1619edf4dabfc5381424f0a7372187a9a8a545584f0b3d0b673596c1cc4d76246f1959838d12f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147274, "uuid": "580e2434-6c0f-452c-b563-09aec83d244b", "value": "T1DAB3AF87B2907ABEF0A45E3FC4135E26A6259F705583273D71FDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147274, "uuid": "51790af9-a131-49cf-bc80-4a864f709c40", "value": "1536:tdNSXAeuUGWnKYUqwaJ1Xq/3A5hcB57laZeCNjHWBOdiyWT15Ov6fHzP8rSR:t3SrlGWnKTU83AQB5A5Liy36frUSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147274, "uuid": "712177df-6e4e-4f3f-b973-4ea08fd05011", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147274, "uuid": "c193fd57-8bc7-431d-bb56-de05975e6d45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147274, "uuid": "8ac50eb6-01d8-412b-815f-cf6c1b86707e", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea6d950-40c6-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777135508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777135508, "uuid": "cbc29d53-d26e-4be0-b958-f89de3b0344b", "comment": "Malware payload (AsyncRAT)", "value": "9ed0bed633e939ee071e6f24ec95c68f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777135508, "uuid": "b088e920-3378-4b5a-9f8f-a4275caca63b", "comment": "Malware payload (AsyncRAT)", "value": "b0338437cfa0fede611a1f48bc7601482031ffcc4aad597e7aa6d3e44abdf2a0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777135508, "uuid": "2fb5ecbc-89fb-4633-8c19-80dad00b7176", "comment": "Malware payload (AsyncRAT)", "value": "a6ea79762d54ebd85aca3fd3a340a5f064b3d6c5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777135508, "uuid": "2b17e1c0-cdb0-4408-9795-0ffb806618fa", "comment": "Malware payload (AsyncRAT)", "value": "09a1be84928bed7968553d3a767f4ee249e69a261473ca4c080cf45ea5cb28da5b06c6f484291e86d7ce6027bb675bb7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777135508, "uuid": "ecf5970d-5f5b-4fba-a29c-a72c8b20059d", "value": "T1BB84238681C026EBA44920FFC61D306B2E6FCD3D678872672612E9EC4C66D235F6DD35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777135508, "uuid": "783f0fb6-c26d-4e88-88c2-00e6f4b17962", "value": "6144:D27LLAdaTo38S+ggUzmm+5kBv6e2yA/uu/rhHEIE2W9i6s4BKo7lkQ7e2kxh:KTAIA8S+gNmR5key0DhHWdBK9Q7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777135508, "uuid": "d8cda301-7b8f-4ef0-9af5-de32655ad78f", "value": 383832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777135508, "uuid": "ba0b9689-95a4-4ba4-8b2b-0976e3d65cec", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777135508, "uuid": "a9e9e7af-1610-4208-a2b7-b4fbbeebc681", "value": "e-dekont_html.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b112502-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128684, "uuid": "1f56d20f-0d05-43be-baaf-d300f0f039f2", "comment": "Malware payload (Mirai)", "value": "4e6b4fbb022797e4a9e7cd50cafb1dc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128684, "uuid": "989c286d-37ee-4d0e-be0a-78e9fc96dc0c", "comment": "Malware payload (Mirai)", "value": "b0a1576deb02ae9b844eb18985aebb3cc64577b8302c897687d258b663b33967", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128684, "uuid": "183a0299-1947-4a67-8530-a9993433770a", "comment": "Malware payload (Mirai)", "value": "37dd5cefad5fcc18a23ad640c709caa705f48746", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128684, "uuid": "4c2a7a1c-e86a-48c9-ad37-5e22119e9170", "comment": "Malware payload (Mirai)", "value": "2bc7a7afde5b50b09fa2af6fe65fcb8b3781d8bbbc4d8a9dab46e364a1768828ccaac0c78f913bedd90596bb7c9cc97b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128684, "uuid": "12881046-ee23-430b-8d03-4a5937033fb8", "value": "T126A33A5AB800DD7CFC5BDA7745230A0AF93162504E920B667363FCA3BD571F98817E89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128684, "uuid": "7857c7df-76d1-4dc8-8a43-9b8599866d4b", "value": "1536:uj8TtMGGcGuPC5tekVYmSZMCvim8rzQoz8US4zBTlLUFGu2j3VJXlMtk:ac9PC5tvumCvij3QoesLaGldWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128684, "uuid": "13358179-d5c4-4f40-90ac-e4f63e891009", "value": 100556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128684, "uuid": "7dfcb45c-9d5c-4ed8-a59b-2cdf969ba35a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128684, "uuid": "3713a5c0-c065-4e3c-8463-3103c0d3f1f9", "value": "KKveTTgaAAsecNNaaaa.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08133eb-40b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777130277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130277, "uuid": "45930bdb-7f69-4e9f-a548-26724735f6b6", "comment": "Malware payload (Gafgyt)", "value": "29a47f2b042f8da682c6e53a007c8fd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130277, "uuid": "42c68125-76c9-4a02-924b-c6b0f4e2c4ab", "comment": "Malware payload (Gafgyt)", "value": "b13e9abd4501209056fa1cc229e28e4d8cd9a0415d2ff02ceea26b427a3dd2ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130277, "uuid": "e99cf833-b20e-4890-b015-6ea5c117855e", "comment": "Malware payload (Gafgyt)", "value": "75b356236eaf274b8d43d0e68ce9705f4777403e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130277, "uuid": "5faad0e1-2c38-4b2f-9e17-f32f137f8224", "comment": "Malware payload (Gafgyt)", "value": "6b951e8072f9f16b1b249d1e28c049ba252042e8293b3579ec4a55e285bd7ed9c5424a35d8545e1cea932ebfbf19fda1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130277, "uuid": "9862f1c3-b1f7-40c9-8fba-f5242b233a23", "value": "T14D041803759185FBC4D68FB41BEB95528933F8391B32620AB398FDA91F0DED86E1D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130277, "uuid": "0506e319-920f-4617-92ad-0e20651a530e", "value": "3072:W8dZDIEKXlRvGGzbJU4lpqppZV4A0KkLxRmuan+wshqo0ENbfhhi:W85ED+hIdmuan+wshqo0ENbfhhi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777130277, "uuid": "aed9fae3-d8dd-4dc9-b0a3-91f028bbe068", "value": 182678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777130277, "uuid": "7a8f9596-4d9a-478c-bd0e-be0b1bee930a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130277, "uuid": "613777ca-ba1a-4f01-9553-387df59fb577", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a7ed432-40be-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777132173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132173, "uuid": "19907aad-baa6-4f40-950d-c5c53455b4d4", "comment": "Malware payload", "value": "4ce41887e9ab39148a38daa142486b91", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132173, "uuid": "dc6404b5-e02d-4d31-88ea-0559fe00a41c", "comment": "Malware payload", "value": "b18c9f23c532dea5deda70b03b8441beba067907dc09864310a8b8d2449bc388", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132173, "uuid": "47c2cd42-cf29-448a-8cda-a19dbc3a7863", "comment": "Malware payload", "value": "b39000d5d7a3afaf2ef8ebb4f58b42d1b099f62a", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777132173, "uuid": "a795f0b4-5e05-4f0f-ac39-56e9c2c474ed", "comment": "Malware payload", "value": "6c8e9ada34773d7321e8e102fec7c0f353495a4013d4303cb9944c68859d1cc40744901452f146e05caad437437a8c37", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132173, "uuid": "6fc2b41a-5973-462d-8ac5-3a336b43d1b0", "value": "T1FEC1261057F95A08B6B36F05AABFA551497BBA6D9E3ACB4C0048C04E17F2A00CC67F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132173, "uuid": "f0ee8566-1a7d-4131-94ce-f083b037a267", "value": "96:YyEBs5sZ5YBfOOFjTFwpODvhsZ5SAHAdiFoEllyckiKeKRSOH9inEHArpADYQZQi:Yye2fjqpcSoE/yPzSJ3peYUjlI5dR5qR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777132173, "uuid": "3383b2c3-4e16-4a32-9796-68c9e200b212", "value": 6008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777132173, "uuid": "52038daa-ef2a-4b55-bb34-85cc1dd57e9d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777132173, "uuid": "623e5153-b881-44af-83c3-b233b1741264", "value": "sxjbv.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d19aa141-40a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777120776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120776, "uuid": "c18c5874-4eb9-411c-a072-2230879e2593", "comment": "Malware payload (Mirai)", "value": "f72da4219ae3a4f65957a1031b1a1161", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120776, "uuid": "a4c20325-c6c8-4049-99e9-77c0608ce0ed", "comment": "Malware payload (Mirai)", "value": "b5b6917b97d1a6ff6ce363afb5f0a74f8333ff72e56fe395606b8dd8954db0a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120776, "uuid": "762a24ac-0ae3-4b69-8af7-8304eb5f8f8b", "comment": "Malware payload (Mirai)", "value": "ee5742166831a4ac3062c01d3b3ce2b1922dd432", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120776, "uuid": "b09ebf46-1aa4-459f-8e35-8854c07ff30d", "comment": "Malware payload (Mirai)", "value": "6e245ba7df7e51a4fb01299369c89e9456e0653eb6b81054fcb5cc5bb660cf9d296fd5f2b31f0a70655ea205ce53225a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120776, "uuid": "b8188882-9d9e-453b-980c-38ff269286b5", "value": "T182B3E709EF611EF7E8AFCD370AF9270124CD592A22A97F757530D818B24A28F15E3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120776, "uuid": "815df120-7b13-4073-bac5-dd062ff60d23", "value": "3072:Ddub7djS5HEC7gBjmbhRhFczcmVRh865xo:Ddo7djS5ECBbozcmVRbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777120776, "uuid": "a7cca064-cea9-4b32-a83d-0b67ac9949c3", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777120776, "uuid": "a2909272-e2ae-456e-a7ce-09f61b271272", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120776, "uuid": "4cc90e05-c3a5-46f7-a1bb-aff694769c7c", "value": "luxzz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc45733-4082-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777106277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777106277, "uuid": "5c8b45e6-b0f8-4eea-b349-1020eb85b588", "comment": "Malware payload", "value": "f0aa22570d6fa75302c105afefccdb47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777106277, "uuid": "f4ac0a95-526a-4813-a956-0fbbe0f21699", "comment": "Malware payload", "value": "b5f7a7fb62eb4ca14e353ffa4e42cbc8b5db4b91f13d6815abe997d9ce15b410", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777106277, "uuid": "bcabd677-5687-4b29-b9e9-9e8a41e9c6a0", "comment": "Malware payload", "value": "e92c696b8c248b2b0174aecc819fa73530a094ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777106277, "uuid": "d690d5d2-c0fc-423e-9b4c-04915ad2c478", "comment": "Malware payload", "value": "4779b415516f4c22bd9a13ccd11f30423070e4085e47452c9d25b3513e22b4fb1aa317826d91d8e0c4560f498cd93f16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777106277, "uuid": "de788a9b-3f4c-408e-a5c0-d3ecef992f64", "value": "T136D623E988E163E4C0E38740728B53D970D1662D81FD4D1A3ED62D422B11DAF664EEFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777106277, "uuid": "b96c9c3f-6027-41eb-b043-32699b048c3c", "value": "3670dceda9462b86b603dce9ba79923c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777106277, "uuid": "c14b6beb-feb1-463f-8c40-9d825d049b48", "value": "196608:NUUctnBC9DENmBDkoyOCNDa+61nGDwpCY2msH0wm37qhkqB01Fbrd9li:NUttnc4NmBD5M+H8DwjQ0xuJeL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777106277, "uuid": "b78120f6-3648-4737-af59-7388f0eb782d", "value": 13146552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777106277, "uuid": "b46fc8e7-2de1-4978-8d6d-7ae287570537", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777106277, "uuid": "b528e637-305b-42c8-81e1-fc213329b3d1", "value": "nap.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c67b8f63-4044-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1777079955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777079955, "uuid": "64e1425a-8b08-4d6d-99cb-31c8ef605f06", "comment": "Malware payload (LummaStealer)", "value": "fa0f3c85d447ab23166e9c5e90d68198", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777079955, "uuid": "d1ce62ff-d870-4d44-a679-814ee0f71291", "comment": "Malware payload (LummaStealer)", "value": "b73edda46a91349b37f219d3056dff65a545ba458f4c4a93eddd6fae3b99c38b", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777079955, "uuid": "27196cb9-04b1-487e-b0c4-d0de57c94ce5", "comment": "Malware payload (LummaStealer)", "value": "68557b82599b50f25040e2d6aa8fd54699920e43", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777079955, "uuid": "4bbcd263-b3d0-4028-99cc-6a34df5d258b", "comment": "Malware payload (LummaStealer)", "value": "8488bd55f0223d4eaccd5c9e0a7bf151419b1db3b38677dba86f4a7dd90156d6b5d3eefc56b8ec2a6b8f743ecf2468c8", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777079955, "uuid": "e058ef6a-2b9b-4780-aefb-167a1c47f161", "value": "T1B5A57D90ADC318B2D5423235586772EF6731580D0F3EE697DEA16DB8AB3FAD25823305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777079955, "uuid": "d917164a-a21c-4a87-901f-48a484888c5f", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777079955, "uuid": "7b2d2edb-01e3-4213-bff9-d2bc5b7fa140", "value": "49152:zO7gBEP9ab3HRR6VzJLQOZbooVvNJbsuWaY:K8BEP9ab3fiNQCbllNCuWaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777079955, "uuid": "951eebf3-ec8d-42ed-ac01-dcf539bfb86c", "value": 2124976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777079955, "uuid": "4f76860a-2658-4ea3-a640-e365c9e7e50c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777079955, "uuid": "075c47ad-0961-4b65-ae8d-1e9e1a1557cd", "value": "oAjtOHvn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d44adbd-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128795, "uuid": "785810a2-2051-4d69-9ca6-e3a96e13015e", "comment": "Malware payload (Mirai)", "value": "c069f3bd6fb07f9829f2d4d96b33638b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128795, "uuid": "d6bbb885-22c2-4f2f-ae1c-bd65cc797e4e", "comment": "Malware payload (Mirai)", "value": "b77eeb4a9fbf9a7724647d7474615ea59c27efcdc3bf2e1896b5ca66ffa155a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128795, "uuid": "696c14eb-9111-4e88-8484-7dc01b132568", "comment": "Malware payload (Mirai)", "value": "45c3f391143f0d34fcd5ba4e800067cd1b812293", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128795, "uuid": "0afc1c2a-7e0a-48f2-ac46-3ad92bc89fdf", "comment": "Malware payload (Mirai)", "value": "28f10a69ff1dde42bf4eaf3d93aaaf35d6dc640f8661b76249c0a4e4829b7103a1622ac5aec377f0ea6a608e4aa2368f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128795, "uuid": "e460f64a-b38c-42b1-941c-27a04af3fb14", "value": "T129A35B8BF415ED7DF80ED77B40670A06B670A3A10A830F366267B957EC361D81926FC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128795, "uuid": "dde78a33-1f84-4834-8635-25c41cf5425c", "value": "1536:xYp+qJ3a+sJZrgn17Z5gt7TsMZGWgKrh8IxAkOsPX5r69KJz2f6FzUH6OH8BWT:x/+sJZ61dANZZgKroyrUKZ6H6OHmWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128795, "uuid": "9906cedd-27e6-4e06-a01f-f3e048c178a1", "value": 103299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128795, "uuid": "fd2883a0-e4be-4f7d-94c1-d905bc1a3cdc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128795, "uuid": "daa1066c-4b78-403e-bc4a-ccd0eb2b8823", "value": "k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da8dfbc-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128715, "uuid": "402efc22-e146-479f-82ac-ebd30dda24f9", "comment": "Malware payload (Mirai)", "value": "77473806a8eb95272cc828dc581b2c2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128715, "uuid": "51a6f1c7-7dcb-43cc-8545-3a319eccf260", "comment": "Malware payload (Mirai)", "value": "b7fa474f4a086a67027dede987632bc8bd97e4076158833dc0ebff0a9b205111", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128715, "uuid": "7586f69c-207a-4f4b-8788-e482a8cf14c6", "comment": "Malware payload (Mirai)", "value": "78aa8ecb710874f89f8ee360c7d18cea1232c8ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128715, "uuid": "76d37947-5e7a-438f-9cbb-d96cfdb33306", "comment": "Malware payload (Mirai)", "value": "83430446d2e56d4776bfba7791cd4e28f7a06ed764061d4c49b88384b80680c41c2382cb14e733816d3e5cc51f3decc2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128715, "uuid": "e5c7d18b-4f16-43b3-ad8b-ea52060586a7", "value": "T17EA34C46EB87E8F0CD4505B8215BAB75DD35AC733020EF97EBD8FD26AD59603A00661C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128715, "uuid": "cf737fad-081b-4e71-b53d-48ce08db83ed", "value": "1536:gcdhIxsW8rEMUN5VIYyebl0YojObbHwFNMIU531UN2Vz3Vr:gcduMkmYyebl4j49V+N4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128715, "uuid": "0484822e-8129-4111-98ca-e1e2541b138c", "value": 103048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128715, "uuid": "1e5cbec2-4380-4484-8af9-347110c9fbfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128715, "uuid": "b1322b05-40bd-48f6-b63e-9d20a8657704", "value": "KKveTTgaAAsecNNaaaa.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7ea8c3-40bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777131240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131240, "uuid": "32338a48-3e32-488e-8793-c6ba2cb997b2", "comment": "Malware payload (Mirai)", "value": "ac08e4ea9030143004fb756bfd10a6e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131240, "uuid": "a7b82176-73fe-4732-880a-82ed85a7e4a5", "comment": "Malware payload (Mirai)", "value": "b871b50c2d749a0d06c7436c897bd45c56f1099fada77272f579d447206746e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131240, "uuid": "e3979ef2-8a0f-4a9c-a45b-b06959f56048", "comment": "Malware payload (Mirai)", "value": "80b1f62455bf51a556f1f667a8a7feeb0c0da5f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131240, "uuid": "739a1b6c-4c11-46fb-93de-2d56f259bdf1", "comment": "Malware payload (Mirai)", "value": "ac5861b358c41290091e6b897239397238dfc39519683913bfb19a30b1b584538713accb894856607f6db7343b027ed7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131240, "uuid": "601353d0-da9b-405c-8ca5-e23ddf473de4", "value": "T17A561997B9D24943C4E43A7BA8BD81C533630EB98BC752565D04FE383ABE1D90E39358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131240, "uuid": "e1b52550-9853-488f-aa6f-eb310fb0f4e2", "value": "49152:emn2BIPExxyN/LqMtXNlWsMM23SFHPcOlAHOJaMaFT5EG:ZVsxxytqwXNlWsMMcSkHeaMsEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777131240, "uuid": "aec7c073-e7c2-4eb7-99d7-13484ad6d415", "value": 5963938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777131240, "uuid": "e757a682-fb22-4a30-a758-7b7e140782f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131240, "uuid": "bf6f85d1-0912-42df-896b-95ff79bf0efe", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7841a1b0-409a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777116761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777116761, "uuid": "bc61c541-faaf-4f49-97e9-1e69372bacfa", "comment": "Malware payload", "value": "e388fe9065b892644866ae8cf5b16c55", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777116761, "uuid": "b98cfa8c-72c4-4b7c-9ca1-76bc300569f9", "comment": "Malware payload", "value": "b9138426bc333d83bd52dabc12dec9ab66e9106ee1daa0f0a639d185b4186bb1", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777116761, "uuid": "5b197d20-d6d3-40f5-9cde-9549a267139e", "comment": "Malware payload", "value": "79343d9ce2314378dfc8fcc752e15f0fe5d77807", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777116761, "uuid": "a1a1a806-0a68-4437-bb29-10db23719760", "comment": "Malware payload", "value": "b85e3eb49a6a3b9913eb357e293be633dd65fb2a03136f678088a85b3cab1fde3cc9b34756bd62fd6d62b36dfd2144bb", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777116761, "uuid": "2b050c7f-53a2-4513-b50b-7a3c130a0c3b", "value": "T172D3F04934EB087906B36927411704539FF2972E3F05C6F9326DDBA16F0C9E089DEBA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777116761, "uuid": "2b0ed105-a93e-402d-8af8-cf642a5e1d59", "value": "1536:R0ocfEvmQs1fIEeKiQnGQXocdYvTIvvapSam2f+5COF/aDT+BIAxXg+jTQVxGQEo:WNJU2BIHyQrGQEbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777116761, "uuid": "b75ede3b-f863-4fc6-aba7-cd24642bed19", "value": 137894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777116761, "uuid": "dacd3057-b386-4d2c-a6e4-8be66d990c92", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777116761, "uuid": "8efa0f44-c1f5-47c4-be8d-35472051bbc1", "value": "Client_Audio_New_5125.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce6b852-40ab-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777124177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777124177, "uuid": "96f7fa1b-d442-443d-9ac0-ffd6a9a00292", "comment": "Malware payload (AgentTesla)", "value": "0f54c6f8a494b4b32a67baa22e92e8c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777124177, "uuid": "712cb4c0-17f2-43a8-be34-a702dcc7c314", "comment": "Malware payload (AgentTesla)", "value": "b9a454aaf448517556c4bca9cd128cf2bdbc674aac5c18fda1c14b97d883b963", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777124177, "uuid": "08483d04-29a4-463e-ae21-0b59c7f50ba9", "comment": "Malware payload (AgentTesla)", "value": "4370d10a1eae5d8750dc6acdd1af357484bf701b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777124177, "uuid": "f6296904-a7bd-43bb-aee7-434c633af1e5", "comment": "Malware payload (AgentTesla)", "value": "61043c0d0ab005e844e0dd0d7834fd5f22d9a650b2703cfaf9f9ec8c804594769a8d57efc857c5bf4e5365749e023579", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777124177, "uuid": "eb51b8dd-e5da-41d5-92e7-1608538c31af", "value": "T1DC3533218E9E3DDE824C053D11BF56CC9BB61B13494626D3A6A8B3C727BF320A05F857", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777124177, "uuid": "6a04bc53-0869-4ac9-a78a-8a76d07e3fb4", "value": "24576:3s/a+OuruTweIpyM2SqV3WLKUKYiBslv7i88fc1NIu9RCYBhx9J47:3GIUVtw3xpXBslCfcY4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777124177, "uuid": "1774ab2c-b1b4-4f93-ae26-69efdb5a0792", "value": 1059167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777124177, "uuid": "a796685e-35d9-40fd-a804-edbab8b18f2c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777124177, "uuid": "8f4eda37-8d79-4557-83f9-9be5a5f6e09d", "value": "ps_KkWI5mkDdSKn_1776931546663.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad55647a-403c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777076477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076477, "uuid": "22ab8971-844d-4d23-8eeb-3bda26ca6bae", "comment": "Malware payload (Mirai)", "value": "8598f5064fa6fef8c269b5539a07ac61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076477, "uuid": "04c7f636-08ea-4158-a508-cd75e6e66180", "comment": "Malware payload (Mirai)", "value": "ba2dd36b57689fa2cec45ed3360c44adb03c2595dcba3c4619cfea1720aa3a82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076477, "uuid": "a0acdbf0-fb02-4c96-af41-583cb6d06b63", "comment": "Malware payload (Mirai)", "value": "727f4afd447c61e74209f85c88aa5e0154daeb3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076477, "uuid": "f022877d-a755-41be-a53e-59dada404005", "comment": "Malware payload (Mirai)", "value": "c63f3dba22440dd7af3ab33231e5ce2f74f49040324d93ebc05a91eaba65ee0fe56217a4db4dd119610fd0c102a406d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076477, "uuid": "9032f551-74a3-4783-a5a6-0350bda576e8", "value": "T1A3630903B94141FDC0CAC5742A6FB93ADC23B1FD133EB6A237D5AF166949E611E1DA08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076477, "uuid": "b0c8d166-ce73-46e2-90a8-f46cee620f3e", "value": "1536:GTSxNJnuqMStnZGqsCsxszDNjlGtZHJnNeUZlNL0Tr5:gSxNJnuqMS98qN+2N5WpNeUZ/0Tr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777076477, "uuid": "fa1ff5f8-0673-4d5f-908b-6b907ef8f123", "value": 66816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777076477, "uuid": "ca191809-67fd-4c5a-bb9c-3300b315e241", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076477, "uuid": "747243ed-8af2-4ddb-b849-f5f142c96ffb", "value": "sora.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d8f484f-4058-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1777088289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777088289, "uuid": "00ad69a0-4455-4f49-87f8-d8c5e478519b", "comment": "Malware payload (Vidar)", "value": "138f7e7c194ef56cc717a238f1cafdf1", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777088289, "uuid": "eced48d3-2013-4d76-933d-4309e1e5ce61", "comment": "Malware payload (Vidar)", "value": "bb74254778c3acc16fcd8dd06509c4873814f44ff996f7765401fe6dfb5f54dd", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777088289, "uuid": "c5360461-e020-4058-b0a5-b021795edee7", "comment": "Malware payload (Vidar)", "value": "778b1d55ae322c63fc97638b43bd370aeec8db85", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777088289, "uuid": "d893f45f-e99a-414d-bf9d-352cbb08c289", "comment": "Malware payload (Vidar)", "value": "1963b9e6f793ca4fd8e17ab1f4f222ec9882d067b675251ec4dcc5747c46e76536d34832ccc6b7222c965a36c7887680", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777088289, "uuid": "594120e4-2518-46e9-9da1-0c440a24b592", "value": "T124B57C027C9105EDC099773249F23691BB75B8490B3A67D32E917A783E33BE01C7A75A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777088289, "uuid": "4dbd38a9-c3f9-4d21-9ff1-18a394948463", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777088289, "uuid": "16616fe4-9adc-4eef-be29-e4f2a94a086f", "value": "49152:mlOEwb45sTbDgPoZjuk8d6i7IMUC3Z6tYRo+EQIQkmMTWWXdf:m0vPgG2RnEQ9MTWeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777088289, "uuid": "38fd5929-cb8f-4ba4-9904-4383d8cf5f1a", "value": 2474160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777088289, "uuid": "ce6faed8-d61f-48e0-a4ad-b1e3acc9deaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777088289, "uuid": "bd8afaf8-969a-4a6a-ab9d-1ae7a86cb08d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c040f84-40ee-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1777152684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152684, "uuid": "428f5de7-1b57-4856-b588-15b4bb198794", "comment": "Malware payload (SnakeKeylogger)", "value": "82a76f27ea6eeeef7677b142250ece14", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152684, "uuid": "e1ad34da-a600-417d-bd7e-94de1d453be6", "comment": "Malware payload (SnakeKeylogger)", "value": "bbe37ae6c1d6534ddeb3b9f28d59150b7e43f82a3fa6259152581e5fc0d3e3bc", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152684, "uuid": "0541d842-8b56-49ed-9528-6121dfb421d7", "comment": "Malware payload (SnakeKeylogger)", "value": "74a3e3a763444ec6b95fb281ac143894fb1e11c0", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152684, "uuid": "c534b365-7188-484d-b1f8-0a9794e4a7af", "comment": "Malware payload (SnakeKeylogger)", "value": "d2daf2d8c07b091e9f25048c1308e18753156c8b12b632810934ddd952767e14ce7af6c59db88ab389c79f33bfff1b66", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152684, "uuid": "549a8ef9-1f6a-4e4e-b423-9ff7fd90105a", "value": "T1C9D42322DC8813368668C62E50EFFF4D37905EDAEE6F9E738B5101C645D8B5C464FA14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152684, "uuid": "d5ba355f-8e9c-4b18-9473-67a0adfbc74b", "value": "12288:5kTM2DGFgnrH4knw1RwAvx9AhlJl/UPmYbg5tq3XIUIULc+lDxd163:EDG0za+XjtqAexi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777152684, "uuid": "8db8d61f-8a4f-417a-851d-0efc5ecca602", "value": 652007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777152684, "uuid": "452b13c2-c773-46d7-b528-eb840bf88645", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152684, "uuid": "07021159-acf7-491a-bfe6-d2d06b59163a", "value": "ps_HnlGI71CktiE_1776149876718.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d9712c-40ee-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1777152667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152667, "uuid": "176964de-0823-4312-a86d-25dc0f20c5e5", "comment": "Malware payload (a310Logger)", "value": "35cd402105b94cdfcdd02f0e96396faa", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152667, "uuid": "c8b04197-3028-418d-b661-b9c946a1e0a7", "comment": "Malware payload (a310Logger)", "value": "bc07ac39c30183a6df28c4cf91d7ea4600d45d219e3cdc1080f8eecfc1dc8616", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152667, "uuid": "69ebde9f-7585-49a2-be6d-bb7c21c889d6", "comment": "Malware payload (a310Logger)", "value": "7a55300e0e992db2534fb263f83fecf415b8bd29", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152667, "uuid": "f879ec26-81e1-40b2-ac0d-bc433ba9aa73", "comment": "Malware payload (a310Logger)", "value": "14deb07ae67a685b033f9f67112e4adb7aba0c312482027b287354caecaa54a3a8e2e081ee50f032ff525f0626b82787", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152667, "uuid": "abc46c8f-476f-4228-8a8f-1c4f3dbf725a", "value": "T177A53320ABBCDF7806A8C73D706B7D9D27E51B828C84399BA29427D31DBE703554F816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152667, "uuid": "2a660a1f-258c-4a88-b720-68516fedb4b4", "value": "24576:kTjZZ/jnhTTwblHsjYyf3bg4X57fLYm9iqKCjFV4cthwe9QmgcIRl+e2g3yW2dmu:kHZZ/B8lsv9JJt4bcAtyyGWu8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777152667, "uuid": "7da91a61-947c-40ef-8eee-160386d57a2a", "value": 2104212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777152667, "uuid": "075c9c54-7b06-420c-b42c-3516c125d00b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152667, "uuid": "ab85ce34-d464-433e-8f7d-5a1aea8cfe30", "value": "ps_Gtk5pTwAkeTR_1776241703124.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3abb0467-4085-11f1-a769-42010a9c0008", "comment": "Malware payload (WallStealer)", "timestamp": 1777107638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777107638, "uuid": "7742a0e9-6a9a-406d-b34c-86cf3e8d2f68", "comment": "Malware payload (WallStealer)", "value": "4cf3dd130b529b1dc3ff82ce37b8bc9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Lazy", "colour": "#4044D2", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777107638, "uuid": "4d0bf889-50a4-4a56-9083-64fed6c6bd4a", "comment": "Malware payload (WallStealer)", "value": "bc80b97ad4828c6f859ae9b420d41c2f7bf65eb6de38adec2dbfc43b08063139", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Lazy", "colour": "#4044D2", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777107638, "uuid": "8d690f72-f00a-4c0e-877e-c4dbfce36663", "comment": "Malware payload (WallStealer)", "value": "2ca29f3eb00aae68c71cbd56a2b1938f2d19a461", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Lazy", "colour": "#4044D2", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777107638, "uuid": "675cc1ab-a290-40ea-a61c-bafd188c8b69", "comment": "Malware payload (WallStealer)", "value": "efd9a2cc497b2f21ea76f957960c380beaba89a919c7411ca64294d457e6c21790a604d6c2b039f5411817d6c0e0d89e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Lazy", "colour": "#4044D2", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777107638, "uuid": "9fe05a01-4a1e-4615-afab-dc211e5bc446", "value": "T117C6758FB674861388E263B5B2063573BE2BD43547998336BCEDE435319F07E4A628D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777107638, "uuid": "43fde492-5beb-412f-84cb-57ee56d68fcf", "value": "cd8a40d512a5852289e756de87c9660a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777107638, "uuid": "f449a66f-8c84-425e-9e9d-6f94363ef397", "value": "49152:zMmOw5Q1HmrX1qr4S1NYpouIRAJYO6okAWTgogIvlqbZkd0JtHjEDJySsyTulltF:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777107638, "uuid": "70f5ab1a-4c5f-4a14-ba35-1cbc158caa55", "value": 11663872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777107638, "uuid": "4e8a81c5-7cfb-4dcc-a79d-4707b22d1f78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777107638, "uuid": "27e8e2e2-e662-4e1c-be15-361086ae8a9d", "value": "SoftWare.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7613728-406e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777097969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777097969, "uuid": "1a946570-8bd1-4c9d-923d-baf04e05fed4", "comment": "Malware payload (Mirai)", "value": "e27cfaa44a1c6466ac6f47ae2d438bc6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777097969, "uuid": "07f26e03-c7cf-4c30-aa9b-deb8e195af82", "comment": "Malware payload (Mirai)", "value": "bcbd3df7b693812fe8cc10642373167a3246fa406d0825ce6cfca1f757f29d21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777097969, "uuid": "d2982a89-f8ae-4bbb-92f2-c489a8fcec73", "comment": "Malware payload (Mirai)", "value": "eba7d7657a6487e3a7d14979de6d447ee9651ce1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777097969, "uuid": "842aa5f5-7bb9-4277-b64e-aba1f84af1e4", "comment": "Malware payload (Mirai)", "value": "7b4def86ff7d07610d7cbaef26d2f06856ba6fc1cd33ea633113da7787efa41b368faba15e7998ee9e250392e13202fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777097969, "uuid": "a043c931-bf63-4d76-8500-e9e69dc04a4b", "value": "T1428302461B4B56727C80597347A429F16BC7F3D290F82BE235DD4A17A4AB6973EB0310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777097969, "uuid": "40991790-c9dc-40e7-93e4-9c0e879beb25", "value": "1536:fet7qvHhrxVzXYrgEiNvKEJmTdnp7+2bvefYu2ZJ6Img7EsviUy5g89DR5C:Gt7qvpXzXYrg9vKEMBwgeGwIZ7Esv3hZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777097969, "uuid": "fb595e93-ba82-4e5c-bedb-cc09c2851b7f", "value": 85736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777097969, "uuid": "667dd49b-4d99-4223-ab9a-8f632d95494a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777097969, "uuid": "7ff1eb12-d524-4a66-963e-19d0d795ab92", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e943dbd-40b4-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1777127777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127777, "uuid": "cc089a81-f200-4192-996a-1d0e2d25d7d2", "comment": "Malware payload (Efimer)", "value": "b37ed15811a4ee3c2290e75dc7f1d6af", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127777, "uuid": "95adcd99-d0de-4abd-a623-841e53232d67", "comment": "Malware payload (Efimer)", "value": "bd8dcc507de93b3b33305d3bec54edba9c4515dfea05cbfab2290083140855b8", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127777, "uuid": "cad8991f-05b4-46aa-8511-3afa4209e48f", "comment": "Malware payload (Efimer)", "value": "cfc63ebe9f2df603ac2f9ee0a55283605de6acee", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127777, "uuid": "e3623876-c761-40cf-9def-095cafa6369a", "comment": "Malware payload (Efimer)", "value": "14b63e5bd31abb1e8b6a23dcd24df3e97c383d489a6be20773bd9129815df13398f51acf844af3bc198616ed39c27fc7", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777127777, "uuid": "f439faa7-1c10-4550-9d00-720e436de887", "value": "T1FBD6331DA4D632DDC7B7D138BBD101B2B86878541170CC2A6B6CC3B17C6F5A8AA26CD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777127777, "uuid": "858b4065-fc37-460b-8997-3df1990c0ae4", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777127777, "uuid": "9a1c85d6-ebe5-40c0-ae6d-42b27d873e66", "value": "196608:3uEkhYlTA8HkoNZdh1ToHwqN4XMCHGLLc54i1wN+MCQPIcu9KYK39sI3PPGTMrRd:ePY1HkoxT0MXMCHWUjXncuI3/PGTAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777127777, "uuid": "f2921358-6c97-46c8-b6dc-5e5abf0e9d0c", "value": 12617524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777127777, "uuid": "da286bba-93e5-48b0-b27f-0780c321f2c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777127777, "uuid": "a22b50fc-d254-4e38-8574-2a5be4294033", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "136ccc39-40ba-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1777130335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130335, "uuid": "d6d64ff2-7fa7-47d6-b4a9-04c35c14dab7", "comment": "Malware payload (DDoSAgent)", "value": "256b920a5ef26a84c2d609500f5f5da6", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130335, "uuid": "96dafa33-8d48-4109-9cea-abe0f8dde378", "comment": "Malware payload (DDoSAgent)", "value": "bf2de43591b3de11199f65e2ca3f37874e1be3ce87a5f4ef2401379dd675d418", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130335, "uuid": "b2a9a0ae-97e6-49cf-8029-5283aaf2c429", "comment": "Malware payload (DDoSAgent)", "value": "ccd6d09e0c2027c83dd6d3732876723a78df8959", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130335, "uuid": "69854723-c8e9-4c65-a82e-cf60540b8752", "comment": "Malware payload (DDoSAgent)", "value": "28373e74a7e276a8471df96b7176d743553d893b4010c6e2eec65eb43b4e2812c477e3e08b895d25166c13d122b74029", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130335, "uuid": "45ca4695-348d-4920-a07f-280d67fe264c", "value": "T1ABF33B17671C0A43D04B6EF036F717F183A7A91125E7A140F60EFEC86776AB1A41AF89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130335, "uuid": "561bbb08-973a-4bc8-b1af-1e61cefcf5bf", "value": "3072:oSg3lZxasbk0xD71p5dghr+r/Kl6zfmHkaNSrxth76XWf8xi:oSgVZxbbkED7r5Sd+rzzfmHkaNSrxthr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777130335, "uuid": "c52e050e-f70b-4422-9c9f-3d2fb97564f7", "value": 166598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777130335, "uuid": "07ae4587-d757-4121-bdd6-006c63826c0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130335, "uuid": "3e9fddbf-1316-4b3e-bf1b-7b33f89c3d46", "value": "bot.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4861b264-40bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777131283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131283, "uuid": "5fd6d01e-9730-4ef3-8151-722defe16391", "comment": "Malware payload (Mirai)", "value": "31202a75b059514ea9973cb44c7551a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131283, "uuid": "828a3598-b8ab-4852-8a94-76c5b45541f4", "comment": "Malware payload (Mirai)", "value": "bf4e236855500a10e0b42660660e9a2bccee5a634186cc07184b712704e31574", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131283, "uuid": "57623091-a715-4c40-8fb9-4df48aa26732", "comment": "Malware payload (Mirai)", "value": "1b291cd2a97950329dabb49c94296257f539a024", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131283, "uuid": "cd137c82-2178-4c60-8f92-6ab4ada907e8", "comment": "Malware payload (Mirai)", "value": "e7ad4ed760e1415c526ea93666557f28f2a050b92f393d1dadf3161171f0cfb62a2816dc2a7f43f0aff2d443a614c972", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131283, "uuid": "66820d9c-89ef-473b-8b61-52a0936bc754", "value": "T142564B03FCA918E9C1AE913586779253BB717C895B3127D32B50F6282F77BD06AB9340", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131283, "uuid": "00f166be-28cf-46d2-9ddd-c500ca37214b", "value": "49152:Opt5/08pryuDNMNxnUv/6L6WstIafQ3sHklF9Ubt+qXoWcyv7WsLK5iYsuwKlK1f:OpP0c/Cgp4Wb/smK0Eg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777131283, "uuid": "a684b38e-78e7-4448-baa6-15e883f288b9", "value": 6090914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777131283, "uuid": "499a2372-067a-4d21-8354-447cb12e52b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131283, "uuid": "5ffdb042-8299-4799-8fc9-a78fc55e3d99", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2086e99-40b7-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1777129394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129394, "uuid": "c9f86d7d-2152-4c0d-8b2e-2d1356359ec0", "comment": "Malware payload (CoinMiner)", "value": "8c0ba5be7abb42d2969bd675d7ad0e65", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129394, "uuid": "73a5d541-7f6d-4d79-b8a9-7a128b9c9f72", "comment": "Malware payload (CoinMiner)", "value": "bf77d73a22c6324f77a549662e41a3b3fe80a38d546ac03e846755e52e1a79f4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129394, "uuid": "133dde56-39b6-43e7-9f0d-960985537c40", "comment": "Malware payload (CoinMiner)", "value": "f1ce34ad379560337c005804b6b218f3813a81ed", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129394, "uuid": "8a360463-80eb-4cea-82c4-1043eb4edd53", "comment": "Malware payload (CoinMiner)", "value": "dbdcec57d6175f143f0c22ac789585e23f1738f258737c4c5614fa180e272ea913116fce741d023f92b1d41598a27edd", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777129394, "uuid": "228594b7-0959-494f-a988-793c6071b5f0", "value": "T13F9633B95EA2993FA1F4E0FB7D44C6661BD4047365C8B9EB6432D34169CDC341DF820A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777129394, "uuid": "b717e6bb-2531-46b4-aaf9-c7f2dfd76872", "value": "196608:r1xrLmDXzRizBuxl2rCh1WYglXsHTuMAfD6a1XL7frcM//Qr:LmLzR37ZFQr6a1XL7foUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777129394, "uuid": "e5822126-fa44-4d1a-8fe8-bd1d847f9ebd", "value": 8694004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777129394, "uuid": "af1339ee-e80e-4b08-8875-700008bd16d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777129394, "uuid": "c91ee21b-a280-438a-bf45-446a4662c00d", "value": "vca1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617a510f-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128748, "uuid": "3f82d3a0-fcab-4484-90d3-f193f6d3f81b", "comment": "Malware payload (Mirai)", "value": "e92202cc1775341a8110aa1068d1839b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128748, "uuid": "3f766930-e596-4047-8bde-4e66740676f9", "comment": "Malware payload (Mirai)", "value": "bfe3c83b6a43db2673b40160a23187331f8c94871245ea80aaee57e0324c400c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128748, "uuid": "f84ffd9a-58b4-416d-b4c4-cfafda051518", "comment": "Malware payload (Mirai)", "value": "709afe08cdfed39f7082bfdd26886c6fcd27e9c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128748, "uuid": "d03d4103-d195-4db0-8ddc-5cf637eeb125", "comment": "Malware payload (Mirai)", "value": "05333c10b39b858a4c4e5f0b3e845cd61b44034cd14d81ce742c810f83053ec7fa96d053b35baa00e26b3067fd1472bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128748, "uuid": "f74680e2-d357-430e-9c6c-eabb094cfb2f", "value": "T1F74423680623DBCAD31929E56EFF809C294F77340D582BA085ADD38D07FE039D39E659", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128748, "uuid": "368fb5c1-85a3-4d8e-931b-07f9dd878292", "value": "6144:v59j5rPkP+B8Ewz9oY8Tlk3Vjyckw6ybirGoVoXRt03:v5ImBwz+Tu/bpRi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128748, "uuid": "bc3e661a-7e9b-41f3-9d3f-cbaddb6fe942", "value": 276056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128748, "uuid": "51f249a1-8d00-43a0-b3d1-ae4a7ddfee69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128748, "uuid": "302d2eb9-c60c-4bc9-a5fa-7c0a657577f7", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c4b45e-40a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777120859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120859, "uuid": "279ee659-c899-416d-87d5-15678d015cab", "comment": "Malware payload (Mirai)", "value": "44b9c9b80a57e83c336e6a5218fabcf2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120859, "uuid": "83bf0e08-cd7b-4249-995a-1dc79ee042db", "comment": "Malware payload (Mirai)", "value": "c03ce30c171e4f2392c8066ac2c6bba0b818b2b2100e9ac2655d644d5f4b5220", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120859, "uuid": "fdefedff-465b-4c47-9eca-e4eb02af839d", "comment": "Malware payload (Mirai)", "value": "ce390b640017ceb7b706027c6efc3ea3c2d1a2d5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120859, "uuid": "86a3d8e7-4572-4799-8022-b726357fccd0", "comment": "Malware payload (Mirai)", "value": "8dfbc254a6e45194203fdea6d2b4edecb47a0bf50b4bc37cc8cfb9b76d3d853638326259ecae26d9ee076c15bdc5bf23", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120859, "uuid": "51fcf376-8324-492b-805d-43901e71c2dd", "value": "T19B21778F2030B58289C9DA0A70F1C5E1BF29A2C598BC4FB9DD4D4D3BA480D5230A7E39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120859, "uuid": "01e47baf-ede0-436f-ba2f-b7d9a3a6cdb4", "value": "24:mX220XwxrDzXwZrqyWmXkuhpG1Xa+5XBdXeTbZZX1v1XR+LXIbXpT0xeXarXHdXc:g2zkrwjVQ9JBVeTb31vdR+jIzpT0eaD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777120859, "uuid": "4e86f338-92f8-43b0-86fd-88f604f6459b", "value": 1235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777120859, "uuid": "58986eb9-a57e-4e94-97d4-f6e174b999a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120859, "uuid": "6aba9a5f-bf0e-412a-8fba-b2800e1b2d16", "value": "v.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8614305-404a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777082535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777082535, "uuid": "d952a87f-9018-45bc-9166-a9ee177c780f", "comment": "Malware payload", "value": "ae9eab0380e03ae6a4a00d802ee6c30c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777082535, "uuid": "e20fd9fa-72af-45c8-a859-24019d7fa64e", "comment": "Malware payload", "value": "c19e7926f63a2d9fb78d0ef9fc8f72e30e010866b81b9c8e42225beb856e5a08", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777082535, "uuid": "1d26c4b8-a003-4951-9c3b-831ec0de4277", "comment": "Malware payload", "value": "08c9c4d22563acd5f7e728761b2ff56d19b95887", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777082535, "uuid": "6d0ae910-28a1-44cd-b709-54757867709c", "comment": "Malware payload", "value": "e2cc5ee9283ba07b5771ffb7a04119b0e73105fc0d498f90de5aa218cf813108bdfbe3e0300084955ac8ce470f937d31", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777082535, "uuid": "36ff08e9-3385-44a7-b2d0-cf2cc8163806", "value": "T11C37339AFBD15A3DECF7833207754126A2064D82C753C28B5860727C3D7BAE48995FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777082535, "uuid": "ccc964e2-d566-495a-ab38-b6d6b345016f", "value": "393216:1PmDjyP0GEABKOZyLTfmNIyhyNHKqkKjky42EherLOa4JYB3EbGeb4t45REUl3hF:FGyP0GNPE3EyNvkKoOEherGsi+YREUZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777082535, "uuid": "db89ab82-9b24-4ff8-8713-8f2b86ab5290", "value": 23679740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777082535, "uuid": "6110fded-9042-4ded-ab5d-23a5ecd9ee58", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777082535, "uuid": "d9de10e9-6b5e-4d56-aa97-3535be1add8d", "value": "Togewatch.plugin.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f676764c-40cb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777138018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777138018, "uuid": "171188c3-150d-4c68-b269-40bfc75e1d9f", "comment": "Malware payload", "value": "8540937c98d341756fcdb95d6580467d", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777138018, "uuid": "fbd5ae52-56c1-406f-82e8-d956d791a21b", "comment": "Malware payload", "value": "c1a4a47aba162b22f77d52ff695ba21c9fe773fe6265574e611900e94c0b81c0", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777138018, "uuid": "2f0746f7-9d8e-47ff-a4b2-603894917a83", "comment": "Malware payload", "value": "6551a99e1af5de5ebd0054c2899e56b68d1b3880", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777138018, "uuid": "64c57042-b8de-4031-9974-e7386960b7b5", "comment": "Malware payload", "value": "a917a294ffdbaebb4f1474cab8896cb87c5cb5379b2265cf80e8990dd0969bf415205326a8dbe5ced2a49580bce14b88", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777138018, "uuid": "326e02e1-db01-4db5-bc5a-582c9f399311", "value": "T1A665586C2B4C197BD15C9F75532A5C133AFA28FA7C83F7C38A07AD253D0782589994E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777138018, "uuid": "3761ec51-ebbe-4b19-9eff-34f801fe1a28", "value": "6144:NlAS3owzpi2lyzSfVwS5XcPSOpOIGwgKL3AKvqtWZQ3vFqxYBqcheJoBMEqGrkZN:e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777138018, "uuid": "cf23411b-833a-4b1d-a582-3f16e40f97ac", "value": 1460315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777138018, "uuid": "afec74e5-752e-4a67-b106-5ac63ab79c4e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777138018, "uuid": "fd7a8256-dd3a-4549-b972-fac7fd13800f", "value": "jd16493.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f797c881-40b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777130289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130289, "uuid": "7676912b-e3c5-42e6-8008-d3c77e317153", "comment": "Malware payload (Mirai)", "value": "05eeee2a15ba146477c1a74ff778f970", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130289, "uuid": "63e62c9b-bcc7-4d1e-898c-304b3b784500", "comment": "Malware payload (Mirai)", "value": "c1acb4b97025e9e7a6dfd906baad136c95b57b7e1a12c1eacd34084e444e30be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130289, "uuid": "c43fce9e-a4bd-4520-8b1c-1b7ec75cb0ab", "comment": "Malware payload (Mirai)", "value": "d9a5b5d774a079057c3e316a3a0b7245b04b2778", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130289, "uuid": "5aa69782-5c47-4496-86bd-ee2f737f3f6d", "comment": "Malware payload (Mirai)", "value": "bc27429c834eb30615aca1a4169c1e357a17835e366402f4a858f1f9eeab404e625265a889791522d352dd1ab74465fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130289, "uuid": "c1982104-0544-4135-a89b-51d0a0656e9b", "value": "T1F304F901F9144B57C5C22BBAF79F42993B366B2897DB3301EA18BEB42F4679D1E39101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130289, "uuid": "508028e7-652f-4c27-a611-f1a4a1c9e2cd", "value": "3072:PDMToVhS6iG754rQH/4PNYdD4siYDsz3+IaWf/m5kn8SGZEB1LbjSBwmi:LSUH/4lYdDJ7Iz3+snm5kn8SGZEB1Lbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777130289, "uuid": "26aaae89-77aa-42fb-aaff-12a0e10beeb1", "value": 175047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777130289, "uuid": "4d51ec70-16fe-4ad7-81eb-91cd11f3cb31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130289, "uuid": "71994abf-f49b-41bd-a84d-abc764de2e1b", "value": "bot.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a3192f4-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128736, "uuid": "d5812c7a-0f85-43c3-839c-61848eed0c3b", "comment": "Malware payload (Mirai)", "value": "930648cfdeff8968a02f7231a67e3bb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128736, "uuid": "6cdfbaf4-f7af-4a01-8297-4e3b1a0f2f0e", "comment": "Malware payload (Mirai)", "value": "c1da7fdf5c20914a29e5b21b05136b340ec24ea190797db59a0c1da22404f4ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128736, "uuid": "534cbba9-f0f9-46c8-8a76-ee5d437c27dc", "comment": "Malware payload (Mirai)", "value": "df48cea07630177b154c9aeba523a655cb854729", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128736, "uuid": "5ed3e6f3-c213-461f-883d-617b84a5d0c0", "comment": "Malware payload (Mirai)", "value": "df9fef9beb2864bd1af8acc24d26e758f5f8087f8d674d49b74ed56581ede53be42ca1ace9587c9f7dbafb4467072b99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128736, "uuid": "e19905a9-5631-4f9f-9685-fc004169dc1e", "value": "T1B64412D4AA41B94DAAACC7711C61068B750B85E4DCEFBA228D7B01E2339035DB7CF6C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128736, "uuid": "39c96249-a237-460b-89a9-4cb77b680ea1", "value": "6144:A4bjwu8obEcN62Vnb6IOlrCXXSmxtIJluLp6cAiy:A4bp8ob1N7l6FCnShb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128736, "uuid": "0e6cde67-9b7a-41a3-b2e7-8d9860839bae", "value": 273164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128736, "uuid": "f26292e0-8f16-4b30-b01f-5c8fbf561d7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128736, "uuid": "74bbc8f1-c677-45d7-9c02-32996ecad35b", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77c2afdf-406a-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1777096144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777096144, "uuid": "93c1fa10-29d2-4641-9d34-e45de9771cb2", "comment": "Malware payload (Vidar)", "value": "096ba022695efe8c04e7a90ac5b1b02a", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777096144, "uuid": "7de0ce90-691b-423c-a67e-4345a87295fc", "comment": "Malware payload (Vidar)", "value": "c248f3ca65908e82a9c621631841ec053bc7d48adea2d6a227ff13cab952407e", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777096144, "uuid": "7db9d71b-2078-410c-a753-caa19e3907f6", "comment": "Malware payload (Vidar)", "value": "4362946d4e8f73ec1ea250e2d2e277c02e0b2b00", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777096144, "uuid": "d4ad85b2-82ee-4cb6-8c3a-d6a0a7bae870", "comment": "Malware payload (Vidar)", "value": "52565b47eb75ad5d42527cf3579e3852256aacdff1550100538f96d6c7a7833d50ed253a47bd7ecb788305539fa90f46", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777096144, "uuid": "e3f69e72-3a63-45d6-815c-e618d9b8c9a1", "value": "T178B57C027C9105FDC099773249F27691BB35B8490B2A27D32E91AB783E37BD00D7A75A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777096144, "uuid": "4e5f6e9a-65df-4c98-bd76-33aedada7c8c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777096144, "uuid": "51e203d0-67ff-489a-a686-b560154c5119", "value": "49152:XOI7Ntin51bHxtZ+KfImjLL/mDLcgSDrs70eVng/MNhgQjCdi:XfmjpjjLL/j4A8Cw9CI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777096144, "uuid": "fe445063-18f5-4737-a65f-c57f61c58707", "value": 2444976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777096144, "uuid": "db7adca7-372b-44e8-bac2-f4f5222222eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777096144, "uuid": "aac0fe6e-3de8-4bd5-a610-2c633025550f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4773a883-40cd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777138583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777138583, "uuid": "dcc6974a-0065-4560-a227-785aa46aaf3d", "comment": "Malware payload", "value": "74af05607caba189a02e4fdec9457ea9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777138583, "uuid": "1dfd7dbc-f48d-42f8-a0b4-b83ddf6662c8", "comment": "Malware payload", "value": "c2cd2d28e1f7789f6d1e9749808d5ce677d5f80a659c50cdafe2dabad5fbca89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777138583, "uuid": "677b6936-367e-46f6-afb2-f1e9e009b75a", "comment": "Malware payload", "value": "ec899252b2e60a719598ed62949068864f30830c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777138583, "uuid": "cd998f25-d976-49ba-985f-b3394ad640b4", "comment": "Malware payload", "value": "e7114f5b1d2dc5257725a54263a956574b5e0d1857aee4c9ca1ab26f56c9290335bbc651fc4d8e9254f50700ca0baaaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777138583, "uuid": "d0f1bd33-0025-4a7a-9f08-0c2c57cb706f", "value": "T121D75B217246C43AE66A01B1692CDE9F552C7F720BB204DBB7DC3E6E1BB45C21236E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777138583, "uuid": "c9f2de8e-b745-43e5-9a8b-d6f1e8e57fcc", "value": "608505ff1e7e27ff4a42ea9c4e9f4192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777138583, "uuid": "796f9fda-88f0-463b-b4e7-7abf456981c6", "value": "98304:Xr99u4kc8Hao8eRjYBU4UAir2Y53CB8koyISaSk5gU9Q:R9upko8Rr6rWCyuWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777138583, "uuid": "bea6d1ac-5143-45aa-8c2a-56a0a594b1e8", "value": 58720256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777138583, "uuid": "91ec3a81-93f7-489c-9060-5553834b68a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777138583, "uuid": "902bf5ee-1fd0-4cc7-a64e-10de1a64d0d6", "value": "FNFskinMODv1.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc62b24-40b5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128584, "uuid": "f5dc21f2-cf39-404e-82cf-298954a05b26", "comment": "Malware payload (Mirai)", "value": "f28960ea1f5040cd0b1c727406fdd5a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128584, "uuid": "2a8a7e6b-5281-40f4-afef-a2cff517d737", "comment": "Malware payload (Mirai)", "value": "c2f8d195d88786994bede36de69e9b9b2d578963680f7838dfe0abc058c3ca9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128584, "uuid": "0e2235b0-7908-4511-83be-8ed3e7d2799c", "comment": "Malware payload (Mirai)", "value": "b48beb36757c16b32521a494198058a0993370b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128584, "uuid": "cf68e024-6212-4e15-b665-5f5db5ac971e", "comment": "Malware payload (Mirai)", "value": "2a710a5a458474feef799ce089e10475a152a4e646f79d3a2f9d30e4f5df6fc9a7e42c5067eab6ec7300c8c07b5236a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128584, "uuid": "b035ef83-6b25-4279-a236-c1e827d4eca1", "value": "T13141DE8E1F315EF9F555D83C87370B352BAA564883C14249E1ACD9402EC030D899E7E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128584, "uuid": "95c133d0-f989-4bb0-a9ed-7331893e0dff", "value": "24:3OShMgJc8AmsCxj8Amyz/z2Hx7llPKpYWB4u33gliI8pajDdz3N9l5zBkEp7iMpD:+SegJNOw2HnAphgjD/9LuEpHnHsdOR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128584, "uuid": "fdd06609-f153-4599-9982-5a78e8d8f7e3", "value": 2016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128584, "uuid": "2dfeb2fb-b81f-450b-a6e5-b8654101d7aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128584, "uuid": "19263d6b-b771-4353-aac3-39509a8d2062", "value": "dlr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "607b934a-408c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777110708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110708, "uuid": "78dfba67-b860-4752-8a47-53e8d90d5ccb", "comment": "Malware payload", "value": "ea2b6a1c8448ef650c1dcebe3e2dd6e3", "object_relation": "md5", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110708, "uuid": "4e95998e-1818-4291-886a-dbaa57eb322a", "comment": "Malware payload", "value": "c3a63b3eb9d6daace2479d006b08d44be9722df96b09c784dd53d00be5eea7c1", "object_relation": "sha256", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110708, "uuid": "7efaba22-91c0-4d05-9dac-310ad78f26c2", "comment": "Malware payload", "value": "b046b521f190502f75a2613d0185966a8ab1d6f1", "object_relation": "sha1", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110708, "uuid": "26815f57-c7d0-4cb9-92b7-0829c882d0bb", "comment": "Malware payload", "value": "acfd35fa45ccd1a42db7964ddce4927236d23d66aac7f0865c6d4d1559b2332ca6625b8768d10f46a62de01138a32297", "object_relation": "sha3-384", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110708, "uuid": "74366f1a-b3b6-438a-b347-09a5a2fd2cdb", "value": "T178775B2FB2A482A8E15EC23EC157CF40D97371715B77C6E716E206289E568C98F7B720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110708, "uuid": "7458258b-9b10-4bbb-9d9a-e4b16eace7e3", "value": "dc855ba4ed17d8feca28bead7f574dff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110708, "uuid": "15fa9c18-5275-4210-b15f-b8c9ce487952", "value": "49152:qnnPBCIliDhznHoAh2SoR/U1WpJ9v1GSmzDcJ+:YBlWoLGSmzgQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777110708, "uuid": "5801ed03-1cd4-4673-a92f-105e2b015a32", "value": 33660984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777110708, "uuid": "3bdf2d47-1601-4b4a-8f67-9b3f256bdffe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110708, "uuid": "0a24155e-f9b4-4f07-a819-969b88aa0b5f", "value": "c3a63b3eb9d6daace2479d006b08d44be9722df96b09c784dd53d00be5eea7c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "976ad497-409b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777117242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777117242, "uuid": "9a0ea7f6-a9ae-45e2-af8a-4c9a90987975", "comment": "Malware payload (Mirai)", "value": "9b2fb13e76dbc3afbe7d869e220c30ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777117242, "uuid": "d3eab20f-c7db-4896-bf5e-59947015c264", "comment": "Malware payload (Mirai)", "value": "c3f9eca562c130fa7aec5210e5d0583ff383580c3f6fdb6e3cee233f79ee066f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777117242, "uuid": "aac860d9-a1fa-441c-a692-a087529bb552", "comment": "Malware payload (Mirai)", "value": "baad66a17f8f6c9cde51db9df4d5ef240daf18dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777117242, "uuid": "0b9f586b-5b1e-4c66-8988-7f1bfde5d817", "comment": "Malware payload (Mirai)", "value": "ee3788d1b66dc80239476828acaea7fde92527e57188939f2c209fc5eded79555fb2a0e13ec8e7e890a035fa39f6f314", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777117242, "uuid": "1111d2c5-b5de-471f-963d-05a112add1cb", "value": "T13C85E189F793D4E2F25341F5024FC7E20470A1266057FAF2EB44AA797876B922F1632D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777117242, "uuid": "3113dd22-c71e-4e85-8732-4113954db3f9", "value": "49152:FZSKQphYuhMEC9m056KyBSpFnEMckJqBmHF:elphYuh49mMpFEMu0F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777117242, "uuid": "4af64566-f888-4714-b76a-9819c5b4dc70", "value": 1718172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777117242, "uuid": "28569855-4b52-4fae-b7f7-210d9d5733e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777117242, "uuid": "14777b29-9e2a-431d-92e1-c658c2250c98", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3241b48a-40e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777147138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147138, "uuid": "5795111d-0985-4ef5-9d7a-bd5bdc40a57e", "comment": "Malware payload", "value": "600ad710dbf387702ee1de3739dc34f8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147138, "uuid": "cce6c835-be76-44d4-aec5-5a16c07fd0a1", "comment": "Malware payload", "value": "c4c0a3aea39727d52e0d78688b3115e3a16f71f234a8e193da2db811d0419b0a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147138, "uuid": "011d0853-aa85-4b28-85d0-2ae46a2f5a25", "comment": "Malware payload", "value": "523d0d487c6a3c5062658eddbb8a9a48931fecb3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147138, "uuid": "cfc2b4e3-7bbd-4473-974a-cec39dc630d3", "comment": "Malware payload", "value": "a6aa706a3b837dd11cc7e5bae90131a3a3d6dc0b88d514dd258e025c0300f761dad549d80df09271d95333736b135593", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147138, "uuid": "36c4cd9e-829a-4c2c-8665-8fb4dcd0774e", "value": "T124436255F2817C4103872BFB761FB0CAF66E18D63888494BD150F86CE9B971BE5E1A32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147138, "uuid": "342d890b-3322-40a8-8ff4-6491291548ce", "value": "768:iQQ133XVpNxswIF65MHLOi1QdHvNBDZ/Y99vwk1PkxTDVzafUPhOhT8MDbhuHjCP:NUNxOF65wnieYaKDJXMt/75JzQ0EqoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147138, "uuid": "7309aa8f-25d2-40a5-bc71-6245124e795f", "value": 58804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147138, "uuid": "97568857-885e-45f6-8d42-5f54f8d967ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147138, "uuid": "2cec6649-3d63-454a-854f-58d3f1f1d59a", "value": "sip.3019026_eSinerji M\u00fchendislik - Teklif talebi - Elektrik malzemeleri .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178bfac1-40ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777152676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152676, "uuid": "5a7bcf1b-929e-4336-980f-3577906dcfe2", "comment": "Malware payload", "value": "08626570becc31ae6c6b35aa4590c4c7", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152676, "uuid": "aae0e423-8b69-436e-b06f-7518f0c800be", "comment": "Malware payload", "value": "c5552d33f8cd872a68429ad6218b03deb438b29c19afeb8e501431bd1baef216", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152676, "uuid": "c70748a7-23be-4dc2-bbd5-9d9802d280e6", "comment": "Malware payload", "value": "e3be0a33ad380e451067185b0217ae7bb3a84507", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152676, "uuid": "2df99261-62a4-43e0-a3f6-53e5c9691f45", "comment": "Malware payload", "value": "029b8b00d08f9ad2d2d0ada3e9dd55dc6a95afd3d850bf703f08e3f5523c1a93db11574a46e5f2b5625e5ef352a3b056", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152676, "uuid": "3b0c4a8b-970d-4832-8db3-8f0d96772aac", "value": "T1F0B57C02789105FDC499B73248F23681BB35B8590B3627D32E91AB783E37BD05D7A74A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152676, "uuid": "43f99781-9c0f-487a-b1b5-f94a0b5fc6a8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152676, "uuid": "952770d7-e865-481e-9004-c4b2d258da3f", "value": "49152:7KdtM/EkWAqrNb0ZljBVPN7fzhUtaFs6OGqo1AUDATJ4ITuxnZTdH:7sG7+T6d51AJTJ4Jl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777152676, "uuid": "c32eb99f-322e-45f5-a957-ce310d1c94cd", "value": 2478256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777152676, "uuid": "97fc37f6-8e41-4c79-89f1-ee2c49f87b9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152676, "uuid": "46b937e0-48b8-4c32-b6e5-a5c36174ae7b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15739f27-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777128621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128621, "uuid": "3f4c6d05-2a79-4620-a259-76cd9e7c205f", "comment": "Malware payload", "value": "660eafd067b823566c071cce4623e044", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128621, "uuid": "95fac2b0-fb0d-49d6-9490-da7ce0fdffc0", "comment": "Malware payload", "value": "c55c4ca3ea393e1d34a416c04e5d668810e5e9ddac4b7846d8163383309dd96c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128621, "uuid": "ec2974b0-fa42-4d20-a0da-910e42ad8c07", "comment": "Malware payload", "value": "f4b753eaaf55396645544a7ddadf8f2f2416d319", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128621, "uuid": "2fa7cca3-700a-41e1-bcd9-007a2e313c75", "comment": "Malware payload", "value": "bea6f66b617c2a854ae0844e923ed05e908e9eece23ae1d636d1a766ec3aee41ab5f4895fca8e4fb070c3568503ef6a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128621, "uuid": "16e1b5f0-257d-48cf-80ea-d6a799c86208", "value": "T1E118331BB6A2053DD0979634C21B9963AE3578E00013AA3B7EA5A3513F77E74570BF23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128621, "uuid": "9014c270-70b2-415b-b48b-6cfde3021471", "value": "1572864:fIuGg/3iuc4gj4P7+wYah7dI0q2f/r2Czrm4APsYr4bji1Ku5u98s1rpUU5bDPC/:TSP4PYafV/rtG4A5rnEE255XHNXKC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128621, "uuid": "5eafbc3e-a87b-4d78-bad8-692d0907db5f", "value": 91437560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128621, "uuid": "0d268ad8-cd62-44a6-b105-634f9f950b5e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128621, "uuid": "1d4c85a2-cd57-4ff5-8c5e-42072f18cdd3", "value": "Ledger-wallet.AppImage", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65815849-40e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777147223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147223, "uuid": "6edd31c1-1da0-4f11-88a3-2f793c89426b", "comment": "Malware payload", "value": "f713db0af64fdc125e7f36158324a3b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147223, "uuid": "8ae87f98-a14d-4a04-8e2c-2d2d139bd706", "comment": "Malware payload", "value": "c570ccdae59b84d6acbdc2e4d1e5fb6ae39ec6b703daf94c7e7360c3e14e139b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147223, "uuid": "a3bfb994-6c5e-49a4-a02b-28b5774cbaf7", "comment": "Malware payload", "value": "4762cb8d3862ce5094b1b6e21595afcfbc883280", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147223, "uuid": "2d575538-e1e8-481b-a8c9-a524aa7157dd", "comment": "Malware payload", "value": "fcbe660fa8404951ceb79de80f20f2a89e5e363656706c719debd65765f85e009d1b14434ba715e5c9892875547dc4bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147223, "uuid": "9c8f38af-407f-4551-a605-731e43ab4e62", "value": "T13B5302415AA8E43ECEE2893D0F6841E6859C5DE548D3501F43CEBCF88616D68BAEC5C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147223, "uuid": "118d1309-172c-40a7-81eb-c65db72276e3", "value": "1536:Mdcqm5iERozq3p7o8FwOA4zCKOFGUfKbeH6UhV/uvFAQ2:MaHJgMo8FwOA4zUFGUO3UhAveQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147223, "uuid": "2263bc92-9827-481c-92f4-683a72d7f6f0", "value": 63928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147223, "uuid": "b3a0b8d8-5e8a-4d76-bbf5-54a60aeaa47c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147223, "uuid": "38c5528e-9aa7-4dba-9b58-4f462b03a8e9", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a900b3e-40b3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777127475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127475, "uuid": "beda27bb-fcee-4288-80a2-6287f411894e", "comment": "Malware payload", "value": "bae6a98f8011e7e7e531853b44afc86e", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127475, "uuid": "91a229da-ecfd-4efa-bcf0-56674e79aff5", "comment": "Malware payload", "value": "c59709b4981b63d1301876d3d656a85c6fbd9df91e3ec8e4633c37f9b3e187f0", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127475, "uuid": "12c3b42d-28d9-464f-a4ee-9ea80e89cfa3", "comment": "Malware payload", "value": "1898607431d4c5df42006440a43ba53631081abd", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127475, "uuid": "059d4117-25ec-43eb-a57a-62a992d430bf", "comment": "Malware payload", "value": "8ff5de49e48a23c9b4263cb8a3604d5ea88108b2aba1ed05d48e79cde643b5f634d44f26cdfa64a6b8f352ccd27be678", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777127475, "uuid": "357a91cf-0206-4861-9390-19e9301cec19", "value": "T132D3BDD40BDFC7E5B5976598C69A1B82DB906013092CFA98FF2CB9F32F0505CD4D98A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777127475, "uuid": "a1f3a25c-ffdb-4012-9003-ba6b402482ac", "value": "1536:6ORyvy+xew9T4w3o4/y4f1o/IN0sW1NLDgsKS4P:6Qw4GawaoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777127475, "uuid": "ad87efb2-4b83-4010-9cb8-2f53fe052d0b", "value": 139133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777127475, "uuid": "2eb7b282-5bd4-4630-aedf-e6e5043a78ce", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777127475, "uuid": "8a708203-76e4-477d-8681-a9bdd17366db", "value": "Internal_Omega_Summary_915.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cc8c086-40e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777147101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147101, "uuid": "2bb8e0cf-fb50-42a4-9779-df3f1aab8301", "comment": "Malware payload", "value": "a92729db6df4c31cab379e20fb7d785f", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147101, "uuid": "8464cbde-8eaa-4aae-bc20-e604c7df0132", "comment": "Malware payload", "value": "c7398d50e27b0d27e25e4258f40e35b600cad8d6d5d74f742336c89ea6c5743b", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147101, "uuid": "8293e10d-7976-4fad-ab3a-6dc063d3a92a", "comment": "Malware payload", "value": "0ce0bd498797a9173322fbf8d252dfa39529b20b", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147101, "uuid": "5a684248-b9a3-4007-aaee-d9542d093f99", "comment": "Malware payload", "value": "1a071ecd163feb7d2ad5e838e8147a371e1ddf6fb3cd8e1f2123366ec7bb96a96740400f6936759a8e77cb3f9d14cf61", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147101, "uuid": "f3bbabc0-18d4-4b1d-aaca-ae1cffa86cbc", "value": "T153653374BEF08C894160D72CB7BF7B5A4FA7BA21095760E222F070CA09B3A175B37955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147101, "uuid": "f94979a8-7a9f-4369-8ea2-2b4b93fc1b97", "value": "24576:OsXpE5+M5GnO3iNsHQEZEn6VtqG5IIfQoRK3aW9yeeeZwET9Yv5ofXpuiHDPlg6:jpZWGOSwMetI+yPZwETaWsEy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147101, "uuid": "896d1dca-24a9-477c-a0f8-bb855f531276", "value": 1493742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147101, "uuid": "316744fc-e2dd-40e7-852d-5775bf41300f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147101, "uuid": "9b9aff50-8750-4e60-a0e0-18d351d15829", "value": "ps_X1G7LxKub90a_1776851767043.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45362e70-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128701, "uuid": "d6fdef76-f5bc-46f9-b7d7-2aeaa0f84b5c", "comment": "Malware payload (Mirai)", "value": "905cd193ab0159519bfc06affe031b1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128701, "uuid": "fc33ebbe-7e4f-4925-96a8-2ed7e8f9e422", "comment": "Malware payload (Mirai)", "value": "c8947ff0a47857b3ecaca59692ffec3de4d793644a19379cc044155d54534a1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128701, "uuid": "3c0d12a4-c8c7-4f06-a82b-930dd291188e", "comment": "Malware payload (Mirai)", "value": "99bcfc8d06c31739e0e7c287ea7f6e14c73e1f13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128701, "uuid": "4b8d7a3e-1bc0-4deb-8191-c2ca31abe8a9", "comment": "Malware payload (Mirai)", "value": "81162ad7118881ad39415fadac86872213cc6ec3c05c646ccf5a04575e0047dc7104b73648c7a41c04b3e3a619fd1dee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128701, "uuid": "234ed10d-3ca3-404a-91dd-b325c3fb7930", "value": "T10CB3088AFC919B20C2C616B6FE1F118E330257ACE3EA7212DD145F6077CB95B0E67646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128701, "uuid": "b56d7f06-24a1-48a1-b230-e91470a2ebdd", "value": "3072:ynbMMlqc5m21i2PnxraI/dcVUyu63frz:yQGquDxragcVzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128701, "uuid": "217288bb-0092-485b-ba71-2723c7be8ea3", "value": 115852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128701, "uuid": "da7eefc4-6b0a-4271-848f-16dd2d8abb94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128701, "uuid": "ca8ef700-1629-40e3-bd8c-b0bfb236fd38", "value": "KKveTTgaAAsecNNaaaa.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e643b7f6-40a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777120811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120811, "uuid": "12f316c4-d413-4094-a9f7-d565ecc11c07", "comment": "Malware payload", "value": "f1da09e0d338b29a62d1bcc8ec30e9a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120811, "uuid": "1472e03c-57dc-4c1b-b981-dfe4834d8bdd", "comment": "Malware payload", "value": "c8b6a2082b3690785c8a092a957adb877aa1e7df6d186da01115f8977a680b9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120811, "uuid": "578b83d6-dab3-40bf-bfe6-ae3980a9907f", "comment": "Malware payload", "value": "4b4fa3863d70934e1b73d024e675db3b3fe2abeb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120811, "uuid": "fdc22fa9-ac11-4c67-891c-abb8383223e6", "comment": "Malware payload", "value": "54e9383d7a515259783a5b992920e3ccefe1ddafb61e5088a53e8d18f808f0b4992e8138a37c5da2a13855e26d8baf2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120811, "uuid": "bfb553d3-75a0-4497-a60f-049ba2110333", "value": "T17775D193AB091F97D0EF8F34841A829A03686D939911C76EB6DC3F9D6F3E3994BC1444", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120811, "uuid": "978a6244-29e8-42f5-a233-4b72086d327f", "value": "49152:SPS3333333333333ZI3a33333zqH3iFFSL68EVod8LhxZfym:S63333333333333ZI3a33333U+soid87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777120811, "uuid": "d425cfe5-bced-4320-ac6e-752e43c95902", "value": 1641058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777120811, "uuid": "60d416d4-4604-42e7-ae70-bb4f5938e5fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120811, "uuid": "67ba43f1-524e-4a35-8f5b-fd7764d2e760", "value": "bot.mips64el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16aa02fc-408f-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777111872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777111872, "uuid": "a8fd1345-da06-432c-82dd-f95675138231", "comment": "Malware payload (RustyStealer)", "value": "b60e4777759623b9fb92b02e234eea49", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777111872, "uuid": "034b819c-af3b-45f7-a410-0380aa72a87c", "comment": "Malware payload (RustyStealer)", "value": "c93b4da592441062b80ad9036f1bafa5ac77714f66c3eb2185081c04c29ff0e9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777111872, "uuid": "72921baa-ba8d-45e8-9e0d-cd424fc8dfb0", "comment": "Malware payload (RustyStealer)", "value": "aa93f30cd1f8c1b7f5a0c7226cf53c846d44b824", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777111872, "uuid": "2f6e49b9-8b8d-44db-996f-244bf3463da1", "comment": "Malware payload (RustyStealer)", "value": "2513a1997ce264dcf23136b51c5ce56910ea3f7deb4c3db498f3bdb91c84df1dade8046c18555abbcb8404a42ca8512a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777111872, "uuid": "1bec1a9d-30bd-46c2-9e33-a00ec9cccd1f", "value": "T1E4969D03E39181ECC46AC1748367AB33EA73F8894634B2AB5BD85B212F66F505F0D759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777111872, "uuid": "b81d8225-5519-4331-a3c6-d2cbd0a59946", "value": "be9db20a0a086f6fcf0e952dc3183a39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777111872, "uuid": "2f1b837a-1072-4af1-a948-9bff40949e28", "value": "98304:uw+jWkfRo9uhUUOI0qBainVTwdNyoPWswU4Bb/+s:9mXCqryFoU45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777111872, "uuid": "7b7df343-ad0c-4ba8-8c8b-67ebc015809e", "value": 8952832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777111872, "uuid": "2ecd213f-a9a2-4cd7-8036-236261f31ba0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777111872, "uuid": "c8b0a683-aee9-4224-9890-572c35c0119e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e38ec0c7-40a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777120806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120806, "uuid": "8efc1c1a-59d2-4155-a6c3-768b9439111f", "comment": "Malware payload", "value": "08e843e237360e725d64e71a8349bf21", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120806, "uuid": "b84f48d0-04ff-4814-b02c-8d9ca860a2da", "comment": "Malware payload", "value": "c96e47714d403295fa738664bce2f7cffd2a7abb1170a8f06547a7d6d7bb4163", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120806, "uuid": "23e2f44e-7c81-48e3-8a12-9083103865f1", "comment": "Malware payload", "value": "c18ee0442874ab0dbed0fa46421b5565ea88344f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120806, "uuid": "4f83a834-c7e8-4418-9d13-cc92766d2e50", "comment": "Malware payload", "value": "400cb0973ea5689f91f7eac27bc8f4086b93e1140f830f0bdf3dca48e06882de99fe596c2be6ddfbdbe79b327eb7613c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120806, "uuid": "37bd63f7-b866-4c1c-ac1f-ab8259c0ec45", "value": "T10AD09EBA02D640B2683194D367665C94F5EB90D219D5DEF570A825A2404D94FF8B0E52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120806, "uuid": "ebb0440e-a508-41d9-98dd-a3108d20228d", "value": "6:h9OnFflR0HaAuFgGFSdFQ7naAdFgGFSdFm:Lw7SG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777120806, "uuid": "41c48637-e63b-4512-b13c-c4a5a15acf3e", "value": 240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777120806, "uuid": "f2df45d2-603e-45b1-aa3a-e196559d4928", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120806, "uuid": "f4b9a7b4-137f-49a1-9e6e-0b49a426e0a2", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fa4df59-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128772, "uuid": "05a74a73-db48-4710-bee5-9173ecf6c74d", "comment": "Malware payload (Mirai)", "value": "d53552b00f101812df21485279922599", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128772, "uuid": "636c2758-dbba-4b79-bf8a-54646fb6df6a", "comment": "Malware payload (Mirai)", "value": "c9f2ffafa27ad4812c57b988bf8caf1394a99d7ff858d84c70331d801a318b9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128772, "uuid": "a5000867-dfa3-424d-9f85-9603deb89762", "comment": "Malware payload (Mirai)", "value": "ed384e7785b14a315cabc0940c6acb30fac54382", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128772, "uuid": "f445e0f5-17e6-4a2e-a865-bd445b9a0090", "comment": "Malware payload (Mirai)", "value": "553a586487304f2192740f568818b01f0ff2fc142415ba71481110515ab7ca17fb30ea33bc099e16f7fe2476c01a2691", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128772, "uuid": "d10f0f5d-cf70-4ce5-b3ec-9db100292f1f", "value": "T115513154DBE20E7ECCF0227F56971B243369EE0090D67713432CA2140E27AAC6E33485", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128772, "uuid": "9955ccdd-099c-4645-9589-2babad9fb645", "value": "48:un1KGpa7UrLZGRlPSBu3AAO2IixNS+w+1lQbM:un1KGEPSlIRwYlYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128772, "uuid": "f9c21d64-0e5b-4be1-91bf-23a12521d9c2", "value": 2919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128772, "uuid": "b10e9468-c78a-41a1-b0cd-eba003462725", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128772, "uuid": "417614e4-3174-4ed2-8c87-176006a6fd67", "value": "dlr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f252f282-40e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777148319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777148319, "uuid": "16bdd0d6-3f3a-4c6c-aa67-4e8b66ff8eba", "comment": "Malware payload", "value": "4f6e16b0a305d5b29ebf98cc57152bfc", "object_relation": "md5", "Tag": [ { "name": "198-46-243-99", "colour": "#617654", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777148319, "uuid": "5afd1a24-cae8-42ea-b52c-4db0072b665a", "comment": "Malware payload", "value": "ca5afa5f633ec50d13ac5c2fb96c1318d1f379eb742e387d3e37a27b05bc82ad", "object_relation": "sha256", "Tag": [ { "name": "198-46-243-99", "colour": "#617654", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777148319, "uuid": "879e24db-a3bc-41fe-811c-addf787b2dbf", "comment": "Malware payload", "value": "5384eea430e6790dfc7a5d61a3fe2f874b721b6f", "object_relation": "sha1", "Tag": [ { "name": "198-46-243-99", "colour": "#617654", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777148319, "uuid": "ccc0cabb-c217-49cb-93db-e422fd10645f", "comment": "Malware payload", "value": "c5afc19e1549c6e12220ad4bf637a7674fc60474a03cee8aa43fdbc3abfc886add51c599a5e8d89e8908c4f8413f43d4", "object_relation": "sha3-384", "Tag": [ { "name": "198-46-243-99", "colour": "#617654", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777148319, "uuid": "77ae0a75-9bbe-46fb-b319-5457f22bb8c4", "value": "T126D7AE3322A714F9F9BAA57485521906DE7A7457433187CB738C22752FBB6E08E3E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777148319, "uuid": "d230c12d-9161-4971-b60e-dfcef0bda6d7", "value": "4d0fb8dc9ee470058274f448bebbb85f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777148319, "uuid": "9e132159-f837-4ff8-a63a-0f5fce994253", "value": "393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfO:fMguj8Q4VfvQqFTrYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777148319, "uuid": "799f145c-e654-4cff-a260-fc588c69cbfb", "value": 62000507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777148319, "uuid": "d4bd40ff-a393-48a9-8b7f-d803e5e35a75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777148319, "uuid": "4082f58d-82c8-42a0-a6b2-b3ac7c58dcdd", "value": "launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "621a689e-40e7-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1777149795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777149795, "uuid": "37cb2095-460a-4561-a6b9-62320ace9198", "comment": "Malware payload (LummaStealer)", "value": "f629e1555b00a41ba50eaeb172615cc4", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "pwq-scoffatop-icu", "colour": "#1AB002", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777149795, "uuid": "789f67c6-8648-401b-b532-57b328134859", "comment": "Malware payload (LummaStealer)", "value": "cabf923be13af3f5a125def5f8ee8bb43d1a9c63e78d146e27298d95f76fa5ce", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "pwq-scoffatop-icu", "colour": "#1AB002", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777149795, "uuid": "9efb5fae-21b7-499e-8020-fc24ea5ae46d", "comment": "Malware payload (LummaStealer)", "value": "f7a3f363308c3b79ec82b3f090596889e032fb11", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "pwq-scoffatop-icu", "colour": "#1AB002", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777149795, "uuid": "628a4f99-4eb3-415c-bdcb-eb97c4d234ec", "comment": "Malware payload (LummaStealer)", "value": "11c1783761e2343ea8281b39d139f18a11910eff2b9018edd168a73f1866e9f2d5bfe0a20046869b1e364a0de832b206", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "pwq-scoffatop-icu", "colour": "#1AB002", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777149795, "uuid": "ac55645a-c39e-4605-9195-7b4140c95abd", "value": "T118754C40FED744F6E806163299FB62AF2735A8090F369B83FE447A79B9772D10836345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777149795, "uuid": "898ad680-2c8b-4ff3-b7c4-e3bc488f6953", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777149795, "uuid": "8c3afaf1-4762-45b2-88b5-d11264b2dc96", "value": "24576:pwxmZrOHfWLQvLH5vmlj9/U/pTOr1nJJ2fQSt9U77wCoHouhIIWW0cHays:pbUHxO1wt37kgLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777149795, "uuid": "06c1d815-f8d5-488c-bd5b-019c8aa193f3", "value": 1683072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777149795, "uuid": "cc05971b-53be-4445-b194-728ad353302d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777149795, "uuid": "398cf706-bf05-4e6b-879e-fa005a527f40", "value": "xpeSrUUl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20e8a0de-40ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777130358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130358, "uuid": "063b191f-d548-40e9-92b7-29a88b772d13", "comment": "Malware payload (Mirai)", "value": "387f61191bfbc6c8edc3b90f851e194d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130358, "uuid": "b11f6796-6bed-4b6e-ba93-f22fee5af715", "comment": "Malware payload (Mirai)", "value": "caed174f157f0d80119a5342e5147cd2ea753f55f0cd8cc6079e1a9794641dec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130358, "uuid": "9be16eec-1e92-4aa6-b72c-96dcbaecf93e", "comment": "Malware payload (Mirai)", "value": "fa77920230decd9ec74df225a98d9b61021de6fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130358, "uuid": "0c1a0720-4b75-4efc-bad9-2fc8e883513c", "comment": "Malware payload (Mirai)", "value": "9a927affe25952193f9b000776ebd0a69d239a9e928f6235e684e9c0c257cf41c938ff4ebd850423119b961ccafc385f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130358, "uuid": "fe0b48ad-0b80-4d6e-959a-200015321874", "value": "T1B0042B05EB508B53C1D22BBAF69F434633339B58A7A733059528ABB43FC679D4F22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130358, "uuid": "991b2867-2675-4026-b83e-295d713387ab", "value": "3072:wv3e5CsovungilFqWXxna5uG7QiXs850P5ZOfPzSe7M/RpGjICSO:wOTVXxna5uG7Q60P5ZOfbt7M/RKIfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777130358, "uuid": "8e0865ed-474d-467e-bded-a692806c4286", "value": 183674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777130358, "uuid": "830e01be-cc88-44b4-b471-0192dff9814f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130358, "uuid": "b76489a9-50a4-4f4c-9108-f7d520860475", "value": "bot.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b15d149b-40ab-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777124158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777124158, "uuid": "9859bae3-26ad-45bb-9677-d410e3e59b10", "comment": "Malware payload (AgentTesla)", "value": "56727e3bbae84d2faac9ae2dbc2292f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777124158, "uuid": "48d9be41-112b-48d2-a11a-a01b17c64c7b", "comment": "Malware payload (AgentTesla)", "value": "cbf6b91b9c3b3dba24e385d9a48e5a7864f7029445763f66db8450b5f13ea354", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777124158, "uuid": "9c3b415a-3c60-439e-9cd0-6c6ee1a8c750", "comment": "Malware payload (AgentTesla)", "value": "1ed8097ab05492c3a811e5fb94499ff91bcc0802", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777124158, "uuid": "3fc8ef83-9a62-499f-adda-497a171c1484", "comment": "Malware payload (AgentTesla)", "value": "941906f7245dd050353bd02db872aebbd21bdfaff101ee32d83b50a3e09e9c477c426b37529e9bf696b33ecf28e8ac78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777124158, "uuid": "ff916b04-328d-41e6-aad2-b1e41f4fb0e2", "value": "T1461523370E9F7E365ABA562594F3EF2853E5433B0449204736AE17E32B2E310D31746A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777124158, "uuid": "73411bc8-7017-4b40-995d-4e62652da0ff", "value": "24576:ZcejfOfVTVX6jTxHn3jZ7Ee477mCAAPqQ:Zcx5iREZnXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777124158, "uuid": "725e0062-1ac2-4f2b-9429-661045873572", "value": 955196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777124158, "uuid": "12daac36-e3c4-4f6f-ac39-be0f94e3ea71", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777124158, "uuid": "c3fdd4c9-e112-4491-9941-399bc4f68adc", "value": "ps_clqJlVfyZDYP_1776932977641.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f34962a-40e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777147079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147079, "uuid": "597b2bf8-754b-49da-843d-b5ec5442021a", "comment": "Malware payload", "value": "4631ff182c1677cac6ceed3b4dc6d0fa", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147079, "uuid": "2149c305-9a05-46a9-9e54-9ed9cb3f7423", "comment": "Malware payload", "value": "ccc99964a6c400bab997c0faed71ec06742c69a81b9537cc39c8b744f9995f33", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147079, "uuid": "141e1430-7267-4c34-8e1a-7f98dc467e5a", "comment": "Malware payload", "value": "1eab3f24fccbe47a8f4e171471eed7164a551747", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147079, "uuid": "0177401d-4f94-4d7a-8632-bc697cc2f4b7", "comment": "Malware payload", "value": "871a106862ed13753f9d14911977179c610410761f6e14711713d416b5285686cab4368410227cf19fe03253c6ec6790", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147079, "uuid": "4213b163-a63e-46fe-9519-47eb3c3ae11a", "value": "T1A76533101B5D2E7E475CC3AAE02EDD7A93B10B53D04DA0D7229CA4C62A9F54BE973D88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147079, "uuid": "13b9ffaf-4837-4321-9c3b-5db8352f6a8b", "value": "24576:v83HH4Xt8EHdPd49lhVvbXKadZSrKMnkEENpZFQpjHDT8zdvqp/QHuUoQ3FgUqt4:k3AtwDhwaSrK4tj48p/QHfvvShVRc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147079, "uuid": "39295d11-f762-43b8-baae-c11e518304b5", "value": 1536567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147079, "uuid": "c1f948c6-8780-408b-87fe-58d64053bcc6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147079, "uuid": "c89b2bf1-7da0-4981-82fb-5c12e1665f9b", "value": "ps_tG1yPQWvAlSA_1776443456976.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "196d2d78-403e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777077088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777077088, "uuid": "f1b37063-7a27-4f27-bcda-c1f7d8948edc", "comment": "Malware payload", "value": "2528b35372c3e1267bc94f4489c9f241", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777077088, "uuid": "54e1450c-0ccc-4a6d-9796-0786d73ef006", "comment": "Malware payload", "value": "ccf7ca42eee667916cde44e23576ceb7c00ab53146ccbdd5978bd465baa99be0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777077088, "uuid": "cac1facf-078e-4086-b758-4c19b7f983ca", "comment": "Malware payload", "value": "e5af881e0f95f37875bd7985a848971e5e4bff78", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777077088, "uuid": "251ff1dd-f3e2-4a05-8b97-eced76de9d8d", "comment": "Malware payload", "value": "d6cf56f660990377ff16558a49adab094eb97f77d8c1357c996bae4442ef0bcca5028eb945c359efbcc59ac43021815c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777077088, "uuid": "062821f7-29ad-496a-8a4b-b9bf88a1f88a", "value": "T117E0D8CE64D08D7038454DE7B061490694CBD88D1BA24FC456C8107F584ED08B293F12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777077088, "uuid": "71a481cb-e0bc-4d63-959a-ee5736b25d01", "value": "6:ebAAj73w5/KiYEGvwW2AVFhGq4XXQZrKGy3D2QZrKGygt9Me9Sn:7AWKZHY4uqDZrKGyT3ZrKGygt9Md", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777077088, "uuid": "3c0b2206-3bbc-433c-ad09-d691fac02d4d", "value": 352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777077088, "uuid": "a696fbb7-c642-4891-9e78-106c3ed167e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777077088, "uuid": "daf89e19-5f7b-4ac3-97d1-f92cede40642", "value": "s", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e86cf123-40b7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777129404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129404, "uuid": "7ca78079-1d2b-4821-b0d0-f09d9aee8615", "comment": "Malware payload (Mirai)", "value": "6316f4c052aaf5fd0d70858ac45441d4", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129404, "uuid": "1f9b0cec-b5b2-4685-a986-903078918057", "comment": "Malware payload (Mirai)", "value": "cd7b220a8f1c8d891c24e2bf1e82403bb6a5125ea9f7c9d21b8a531e5f902b30", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129404, "uuid": "05bae7b7-9b5e-468a-a492-2493e363e0fa", "comment": "Malware payload (Mirai)", "value": "9042782ed9ddd4c9a320ac0ca0544f5f8184f276", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129404, "uuid": "bfee3c45-7884-4360-8cde-f9b92a245cc7", "comment": "Malware payload (Mirai)", "value": "5f7d4024c3307183ce10deb77faa33cf4b13622fb15eda9e654c07e20278a23f72346ad7526bc69067493dc739004643", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777129404, "uuid": "285f706d-821d-4f6e-94b3-f52013822b17", "value": "T14B968D5DFD1FBC41FADAE3389E8A9BE3B22B7590D213C0B33A91524CA58B6D4C5B1510", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777129404, "uuid": "7d37c316-cff9-45d6-b841-18c2d157cc07", "value": "196608:DapUX5cPK1r4VvCG/EbPbthX/nnvXtiMhIA7/B9Ps:DapUX5cPK1r4VKG/EbP0MhIATb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777129404, "uuid": "98f34aaa-795e-43e1-b05f-8395b883cde0", "value": 8836112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777129404, "uuid": "7152f2d2-5453-4cb2-8d86-839de7730167", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777129404, "uuid": "63bb6df7-5be6-4216-97cd-547fe3b0c662", "value": "karm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed43fdbb-40ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777139291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777139291, "uuid": "fbd32486-758d-48e7-bd5b-76037f1332a2", "comment": "Malware payload", "value": "a90e9e60236a31a953f3da839ecc059e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777139291, "uuid": "e30b3df6-e462-47ab-952d-a5a8c608fad1", "comment": "Malware payload", "value": "ce60c0254f43bd1a64182dbad1d9218de33fa1e24e618dd6acf49ce9685e1f45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777139291, "uuid": "b99ff9bc-a542-49e3-8de1-ea2f15c5a55e", "comment": "Malware payload", "value": "96266aa270cf8cbf09482441b9cb7f8e4319b490", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777139291, "uuid": "2e270b11-b450-491e-a14a-7c22dcd3e7d8", "comment": "Malware payload", "value": "9df5c6412e90b275c671c09f8458915c532d89c590f784ad27e60a59e310da7642548d1aaebbc26ca9c735cce3794c4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777139291, "uuid": "b83b1419-3f94-46d7-a952-df6b087a932c", "value": "T18DD69D21765AC13AD66E01B1192CDA9F517D6FB20BB244DBB3DC3E6E1BB44C21232E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777139291, "uuid": "d2e59728-f867-41be-9929-6f9ff87eb603", "value": "608505ff1e7e27ff4a42ea9c4e9f4192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777139291, "uuid": "45f34845-3cd9-468c-9998-97bee298aade", "value": "393216:O9/o8zAcb0HEIQRuq3dfLH7jOKnT3hM1A2:0tCbq3dfLf9TML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777139291, "uuid": "bbc03da0-b6fe-4324-a3b5-1e3b1e063122", "value": 13747847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777139291, "uuid": "78278af3-1a7b-4cc5-9b8d-5cddde48c51b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777139291, "uuid": "647b0eca-fc82-423f-b6bb-6eaa0a9b9163", "value": "MetaMask_1.0.0_x64-setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e46018-40e0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1777147041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147041, "uuid": "b9f9a7ed-f11e-4e58-95dc-697b127126a9", "comment": "Malware payload (Formbook)", "value": "c076afcc4da629ef6ebc4130e8a71b8d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147041, "uuid": "0e2f23a2-7074-4dd0-9f4f-5f4d3d4c4034", "comment": "Malware payload (Formbook)", "value": "cee094a9047311d8f1cfcacca1448069dde88bbfd9db1ae2c249a169d06d7b41", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147041, "uuid": "4b00ab17-4c99-4660-8076-895c7dd72cf5", "comment": "Malware payload (Formbook)", "value": "609dba221c71b3d4bc5900cf39e4a5a8780f1b54", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147041, "uuid": "7e7a93ac-a0cc-4438-9832-ad6b36553538", "comment": "Malware payload (Formbook)", "value": "7575dbba7d9104d868eaa70a5c6f421789bc59915e2d42d20c64e1fdfac681bb916cadaeb67de1482087a205053cedb6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147041, "uuid": "cbaa7e29-1c08-4765-93ec-d434f4f0a72b", "value": "T1206533309D11FAB53F89F335B9676F1D24B017508C78E5D293682ADB02AD2790BE7A0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147041, "uuid": "315fea73-6d91-4300-9d63-32f8f6a3f101", "value": "24576:60DBMhuaFVncltA1L9m91UIHb6X6Aj1JtZ/jLCtK8mzs:HSVcTmOAB0x7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147041, "uuid": "d744161d-6241-4102-8c8e-15650df05681", "value": 1532342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147041, "uuid": "2364e87a-107c-4768-85fa-f43fbc56d782", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147041, "uuid": "e786f173-81a2-4996-b32e-c6deb221c448", "value": "ps_hOs2WBlzHMPj_1776434404842.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02dc72e8-403d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777076621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076621, "uuid": "0210a070-c19c-4021-80be-69797cde80bb", "comment": "Malware payload", "value": "a1c9ac4f0573718921cb25357b91c470", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076621, "uuid": "93ecab52-7dab-47c5-8f52-c29b6fa1e9ad", "comment": "Malware payload", "value": "cf8a61a6b64c4acf6f248db8b94a5c40ec9f8b1df239705de27019e09cbf9836", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076621, "uuid": "0d7567a2-3daa-4924-9cde-69df9bda3c9a", "comment": "Malware payload", "value": "170f3395797d361e8104e76a538cb36f4ccdff9d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777076621, "uuid": "458e2f9a-af97-464d-8029-261500ee5a0a", "comment": "Malware payload", "value": "afd9c90ab7c8d114a5cfbc75431748a97169b0393e986d71f0e30d5164299feb3bb62d8d59626f96c196772c4e7a640d", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076621, "uuid": "d985e097-a4e8-4b60-9ad4-16dc69b8ff95", "value": "T1CDC0C002D002C79908130C7308FB018EE0972C0835C59B780E86DC2C2D4F4B7B24FAC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076621, "uuid": "3732d2ad-3ea0-4703-b9d8-9b9c24f10901", "value": "3:mKDDBEIFK+KdTVpM3No+HK9ATScyW+jn9mVgyIMdIdASBktKcKZG1IkVViE2J5xX:hITg3Nou11r+DExxd0KOZG1Bn23f/5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777076621, "uuid": "0a43a3d8-48d0-47d3-8ba5-fe1948d816b1", "value": 194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777076621, "uuid": "5907994e-040b-474a-8e76-3e05cc771550", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777076621, "uuid": "e08e39eb-3a71-48b5-b77f-e468d6f3d38e", "value": "agLgmjaLqi.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ebe648-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128843, "uuid": "719eec08-7528-4d62-97ba-0947cbd48d33", "comment": "Malware payload (Mirai)", "value": "4480b5fd69c17193f4634a337444564f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128843, "uuid": "be58423b-623f-4ad3-a034-d97b1c6dd1a8", "comment": "Malware payload (Mirai)", "value": "d1256de401ac58b400cf3327058c903d51cf076ca88645b8460787b412655085", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128843, "uuid": "7901c440-4a53-4252-9f5f-5339a9566dc2", "comment": "Malware payload (Mirai)", "value": "371943d3eff3cb1fcc7459b632e6e83d4406aec4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128843, "uuid": "90ad6185-519e-43b6-a0f8-cb825eb25388", "comment": "Malware payload (Mirai)", "value": "a9249880927785cf4f42a129864bbf9e49dc9d95d039a4355e89d9ff09dfc120971fd58d991c67e6b5af57e262a46c30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128843, "uuid": "846f4e56-659c-4fbf-a86e-8b1130382f44", "value": "T1FDC45B55B881D792C2C02FBBFF5D934873272778D2EEB0069D195B642AABC1B0F76502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128843, "uuid": "68e7ab01-335b-4cae-aee7-38559494c0d4", "value": "12288:wpXO7GX7C+d4HyL7SWqNZ1Bphtun77UarmGl1VIAPQm0IeCvl+lrA18xv:utfdz7SoEvi1rp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128843, "uuid": "a0da832c-23c1-4973-993d-71476002cfca", "value": 556000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128843, "uuid": "83ea2a53-8b3e-49db-88b3-9f74737cbc92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128843, "uuid": "9032071e-30c1-49a0-9c0f-cafdea7365f1", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ada6486-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128657, "uuid": "c0a6c52e-3aa9-40d1-b092-760d6e3c7d9e", "comment": "Malware payload (Mirai)", "value": "4de9763c9bdd12fb25f907bcef4144af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128657, "uuid": "d4f2da7f-c3d9-492b-83f6-7ae9f804540f", "comment": "Malware payload (Mirai)", "value": "d176be0e9a7e5c0d247f14797b7374db62bc60f31e93227409cf2c5a7a5befc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128657, "uuid": "a519ee87-4698-4afc-9a90-c4afee3d204e", "comment": "Malware payload (Mirai)", "value": "94a1435320ce7a438a3f5e8d4f804ddffa7ef65b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128657, "uuid": "bbccc2a1-c4fd-478d-9761-463e0a4a9473", "comment": "Malware payload (Mirai)", "value": "501ad41514dbf4550e00b31142b0d2de94dc1b2313d10caa49c717e96fa701a1279f99edc12f47a8359b6f6b04ddc96f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128657, "uuid": "68f1e825-05ac-46ac-8c52-b843241162eb", "value": "T185C35C1775D180FDC8DAC1B49FEAE226EA33B4295138B21E27C86A671F4DE205F5D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128657, "uuid": "ea16c0b2-c95f-4de3-9ec2-fb66e91a6c7e", "value": "1536:UaAFmGO0Ng7K+9CIiqDG11Bs0+Ndm1/lAqK3dtNI/xSeabK3c:UlFmSmviqS1Bs0+Nd6lAqktNMxSNbmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128657, "uuid": "ef3cfa49-1d07-4d29-8839-5ee1b3bdbc2e", "value": 123464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128657, "uuid": "0dc9673e-c821-470f-a22d-a732b3601811", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128657, "uuid": "003bbd3b-c0d9-48b3-bda1-3122e33c2bf9", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27aecc3d-4045-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777080118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080118, "uuid": "f3e3c0cb-8b0d-41cf-b8d8-744dd5b3dd56", "comment": "Malware payload", "value": "f5e9614e59d1244abf5315d681e8117e", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080118, "uuid": "31129331-0cf7-4f55-b04d-cd8cf3ade847", "comment": "Malware payload", "value": "d36162d5ca74004ad4c90c9168262754fc18bcccf589def9466b0d88b07f2066", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080118, "uuid": "50c8fd09-9dbd-46dd-bda9-3e6689852a1c", "comment": "Malware payload", "value": "f11a67c81a36fcca6642e72b6c8af130e733d212", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080118, "uuid": "26653389-02e3-4147-b6de-79693c63545f", "comment": "Malware payload", "value": "4c05b5bd992a03bae359cfc15b62a99de74da82be1ab8d3aeaa2b083c4eead2a818b8324f6fd1163d10b18570ee20b43", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777080118, "uuid": "a0689519-ee54-4a40-9633-2c61a169c4dc", "value": "T14DE0AB00B9149679CAE2B42083827AB4CA77C64D332D0201336FCB0FF208A1B507D3AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777080118, "uuid": "64a21b70-6d42-466c-822b-81e62aa998fd", "value": "6:jt2clFsDuwZH1j0IQHjo5mRrvny1R3KbQO0c+EkjAuBn2nK4sKm3ZX5d8ZX5SqGw:jZfsVVj0dhngkbQpc++e2qZz8ZB77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777080118, "uuid": "b899b87d-b390-4bf3-8a50-d0a4bd4ac65d", "value": 418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777080118, "uuid": "bacf0242-8349-465b-9b88-2a9eb347d237", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777080118, "uuid": "013dfb31-a066-423a-aaae-997c2896d122", "value": "oguco.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa6fe26f-4070-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777098806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777098806, "uuid": "300f78f3-ff71-4cee-966b-047c9bbe2378", "comment": "Malware payload (Mirai)", "value": "bfb1181ecc782b7cd295569bd4092745", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777098806, "uuid": "fdea7ba5-edaf-40a3-b600-b5f9b865095d", "comment": "Malware payload (Mirai)", "value": "d3c084cba6219a37f7333743597327c160fa43bc45ac65616aaa784ac5174922", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777098806, "uuid": "87f56909-9f31-44d1-9956-2198a83898a3", "comment": "Malware payload (Mirai)", "value": "572546e1374380776dc049a58545c3adbf92efcc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777098806, "uuid": "8c825b96-73c4-4255-9a81-388ef8fd260c", "comment": "Malware payload (Mirai)", "value": "e8d7eb0996c864ff4a52b2b9c00381a1a998d80bbd990a029b5b13547ac11f5a36f4561542ad2d6b94bfbf7e58e7ba2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777098806, "uuid": "41e3db75-ee86-49e5-811c-f9db17441fe7", "value": "T11F730261CB142DDBD2BFA9F10A84D7C687D2498F937C5DF294DA7503BB0BA4607600A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777098806, "uuid": "1addcc8f-5d8e-4f22-ae5a-9e971f1a8e0c", "value": "1536:zoVzyx1jSexGWHo1wvSgP15XZCDoggdf/cqq0xW/XUlV4FoJ4u+qgw0z7:E2btBuw6gnXZYordf/CDXk6a4u+qgwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777098806, "uuid": "6233d757-68a0-4a43-aa54-ac232f341636", "value": 74068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777098806, "uuid": "dce21ac7-b904-4c3f-9c39-df070635c46d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777098806, "uuid": "816ba8d2-35b8-4705-b0d6-369396ea8977", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9747128a-403f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777077729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777077729, "uuid": "dbd5ea3d-9d7c-4b73-9dcf-dbd06e2e0134", "comment": "Malware payload (Mirai)", "value": "98617b95584529f35f123e1457ebb176", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777077729, "uuid": "c3d07524-2ec8-44a1-805f-96b9df18677d", "comment": "Malware payload (Mirai)", "value": "d544efd2cad930990c2df29b70b619a8f54573a3d25d5ba78ffe23544e3aa2ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777077729, "uuid": "126f7f63-b20a-460f-8228-9864c4caee98", "comment": "Malware payload (Mirai)", "value": "4c34531af204586d452f70a55ce7230ae8fc2a7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777077729, "uuid": "6203d96e-c22a-44a4-a7b4-62219a7dbec1", "comment": "Malware payload (Mirai)", "value": "2e8f6e7a5d04d8f4ede857969e7e6481c2245d2e649042ae0220ce50e855dc63aef83d1af20231bb9c8679991b919a64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777077729, "uuid": "c64c6353-5be3-43e6-82e8-921add0488f8", "value": "T164D41B0AAF540EFBD82FCD3706A91A1634CC645372963B3A3539D914BE5B90B89D3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777077729, "uuid": "f26f1605-b542-43d4-bb0e-d307d7c1bc7b", "value": "6144:W8/U6gNTQA47g/tLgTkZFL7gNroALdd44oCWZlxPcypxkbJzv9LWzNnyMjDP:W8/9wykZJcNroW44pWZfPdkbJzbMXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777077729, "uuid": "e80e42e5-e413-4842-ac55-1840116f5208", "value": 648492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777077729, "uuid": "afabbf65-f861-4aa9-a284-3ed74393ed35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777077729, "uuid": "f8cf64f4-9103-43b3-9175-43b87efd2550", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe587080-40e0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1777147050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147050, "uuid": "ccc95d2d-55f3-44ad-9cb4-4282ca727630", "comment": "Malware payload (Formbook)", "value": "cfd8730ebb2051a86fab67c8f659aa00", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147050, "uuid": "05ad55ce-a6d5-4c5d-8f7f-20fa36e57505", "comment": "Malware payload (Formbook)", "value": "d6907c27a99cf1e30dbb514684768dcd20c819c53ec18de6897cf259cccbe5cf", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147050, "uuid": "cb3d7097-042d-426e-b728-33417a0927eb", "comment": "Malware payload (Formbook)", "value": "d9634c01a9fe42933a4ac56de6046867fbbbcd1b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147050, "uuid": "aa420901-3b8e-4fb3-b1b2-285f1ad393a1", "comment": "Malware payload (Formbook)", "value": "cea9a35f54dd486b65bae2d02f305905063f1877016f9b8bf6ef43a5c51248e864db48a25bc1bb8a1b63652736b12b1d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147050, "uuid": "91475b28-1cae-4a18-8025-3f21c6543e89", "value": "T160653372DFF07C29C7D98628707B9DDE1AD28AE8C85D26DE669403C399BF9C60113D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147050, "uuid": "b64857e8-1a97-4a37-8d7e-69595784e61f", "value": "24576:o3fTB/1Fk4fyioqZGMQDMlVtII9HK0P8Z/Rm/swiwKsbDpWoVb:Cu4fyGGMOT0EZvgD/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147050, "uuid": "54ff6c71-945b-494d-adc6-13d99301d4c3", "value": 1539517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147050, "uuid": "c6b787fa-b184-4e3f-9ec5-48742b46d0d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147050, "uuid": "b884f790-1235-4918-8dd4-c6fc72c5c74f", "value": "ps_kc1e9Uyz3ugy_1776434515164.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3aa73ee-40e0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1777147006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147006, "uuid": "01056d04-b2aa-4259-ac85-096de884c251", "comment": "Malware payload (Formbook)", "value": "6584427c69b48b4a8c95b66c7bac8886", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147006, "uuid": "77ffb841-0aa8-4b3d-beb5-189bd8eebaef", "comment": "Malware payload (Formbook)", "value": "d6b615ca6c74bab9c3e65cceb9b6d7bc1225805c7ff2f551a0ba77f6ab69d122", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147006, "uuid": "78cd4701-4547-4894-8730-381e51fc1e60", "comment": "Malware payload (Formbook)", "value": "ecc0a9ac03acf396127112094af8275bfb9d6722", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147006, "uuid": "04ae1c7d-8d59-45ad-a320-611573f1c693", "comment": "Malware payload (Formbook)", "value": "d31422ee66255bcbe6e02c575254bac038f477ef9d9c6792693827df585936bd08d344422239171c53cd8dc36c792b26", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147006, "uuid": "84e72ad7-4c9a-4791-b970-142018bacc93", "value": "T1C06533204F24BC784918962BD5FF5E3D99B63327C5096B6F01A9638353BEB4180BBC76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147006, "uuid": "4367d91a-4c9d-415a-81bb-618f8854fa7e", "value": "24576:wvRuHryMz5G1n1nAjoSVfXAffZbmDPgv8mYX/nBpr+mxJvx:iumyoSNAfgH/DrVxJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147006, "uuid": "14e7bde1-4507-453f-b3de-ce4146084b3b", "value": 1424882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147006, "uuid": "f02dd740-8cad-40d7-8701-3c330046814f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147006, "uuid": "fb86c5b5-63bf-4214-8243-255097554d17", "value": "ps_7X8Y3VbD0Ei1_1776698905753.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc87ac2-4072-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777099479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777099479, "uuid": "f0dde1a5-5ab5-483b-8de1-f6240665bbed", "comment": "Malware payload (Mirai)", "value": "ae144aaa6e57bd34e76768cf68f955c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777099479, "uuid": "3516fffc-3170-4c08-ad83-6e83b95bfcb1", "comment": "Malware payload (Mirai)", "value": "d73b18d4b3d801e28448c58a25ca4333628278842ad724c1f3880a1332f32b73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777099479, "uuid": "850419fc-1df8-4fa4-a54d-f01e449e818d", "comment": "Malware payload (Mirai)", "value": "cb3ff3b5be96ec01b4fda13554184ebf5d4e98da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777099479, "uuid": "cd8f551a-d8cf-48cb-b2ca-bcdf098bc497", "comment": "Malware payload (Mirai)", "value": "1edc20c73827cbc35f931c32fae83e0064b6a67b810115a571317729fa4cc86dae46a257910788e5b803ad82184f3536", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777099479, "uuid": "959741cc-afcc-40da-83b3-23bb444f4484", "value": "T165442313D9158895E1658CE322773285AC4783BF89E732D3EE5A49A1FF2141F42BEEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777099479, "uuid": "178b3723-be74-4402-926d-ee22ea884ad3", "value": "1536:OAwvWjmXUBB76MkwL9B6jHejTstmGbLcZNHAoeR47:OAw+jmXHchBc+joCQo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777099479, "uuid": "0f2d9a3f-b445-423c-adc8-fe6a275d2525", "value": 275352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777099479, "uuid": "e8295518-3ef1-4960-95e9-88e85be8197a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777099479, "uuid": "d0ccc0e7-c0db-45fb-b660-0a57b65f9a29", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3502b5a5-40bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777131251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131251, "uuid": "5441aa95-c0c2-4860-8de4-d00cb8ed161c", "comment": "Malware payload (Mirai)", "value": "a7b290bf9188e8c5e65cddff0c2d4a4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131251, "uuid": "f13c32db-77e8-4716-957b-b246ba178c57", "comment": "Malware payload (Mirai)", "value": "d7db7cc665c24daf43fa0a5f079faea75201afd47c9dad96adeb82cbd2775712", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131251, "uuid": "51135c86-695a-4c04-8b95-663a327a6798", "comment": "Malware payload (Mirai)", "value": "7ca494c71628d1c8fa3795dbf51c47e4903e617d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131251, "uuid": "fcca6c63-0c2b-42f5-b7c4-0c4f687dbd10", "comment": "Malware payload (Mirai)", "value": "559f018a5a319cc05844e84c1a97a65e6ed35ea50dc8611d08dd94dfe96f400dab4b8018c10263ea9124fd72d9455b2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131251, "uuid": "5226e598-f20f-42d6-8d37-0f0586b58a42", "value": "T14A66EA19ED842BF6C81D5B3444EACA9503B05E104AF19B262664FFA9BC772397F47C8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131251, "uuid": "c6119e90-7a34-4c5d-93ed-6b5ff34f7676", "value": "49152:dHqun7RQO88/JeyXsDoBjxd1Jqbi4N5Ez:iGUIMEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777131251, "uuid": "9f97e984-a2b2-4cc5-aaf3-bf341959b019", "value": 6750401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777131251, "uuid": "626c3306-efd0-4955-8827-7238e72cf792", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131251, "uuid": "16cffbee-bd9e-4857-94aa-5ca46ab4e437", "value": "mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eeb6615-4084-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777107296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777107296, "uuid": "896ed5b1-8cb2-41be-9145-9f94e67d69ac", "comment": "Malware payload", "value": "a31422ef39673af212a59246119a44c5", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VMProtBad", "colour": "#E208F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777107296, "uuid": "627b67e1-b1a7-4faf-9fc9-e9e7420442ea", "comment": "Malware payload", "value": "d8c8215f4975a29c43e4d016b2ecd5c8c072ed4da6571736ebabd38509ca33ba", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VMProtBad", "colour": "#E208F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777107296, "uuid": "ac4847ae-155d-48f4-a8a1-14c54b5992ea", "comment": "Malware payload", "value": "5b1f4747f07fac059a8c81edddf1589e99d2ac35", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VMProtBad", "colour": "#E208F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777107296, "uuid": "f472a25f-43ed-4889-95f3-61e5261ab561", "comment": "Malware payload", "value": "a19acd4cc4fa43b310895360e75b24661cd7542e3094c967787794388a2bb87b1d365aee35100667e43aac162cfc7a1d", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VMProtBad", "colour": "#E208F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777107296, "uuid": "5009cf42-6eed-4f3c-88f6-296dcae5f516", "value": "T1CF55AE1173E8BA16F2FF9F759C74D41243F1B0166B62D61E2E58D0A92DF3B808921B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777107296, "uuid": "e9ba50ec-745e-4575-bfc8-73e403d108f9", "value": "24576:X86AUZaVbqC4fZHkLGP/Y7/kLt/wpmzD/uiqvuCbiH/Hwp:X8/q5HkL+OUwsiGCYvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777107296, "uuid": "354e26fd-6202-44a6-a016-29bcaa7957bb", "value": 1378816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777107296, "uuid": "5b5236a2-d8a8-4b0e-a769-4d3a3be281fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777107296, "uuid": "c9e41f5d-725f-40ef-acce-78c0b01b1cf6", "value": "Hydra Installer.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de2ab462-4044-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1777079995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777079995, "uuid": "c41dd2bb-19fe-4741-9afa-f390940d07dd", "comment": "Malware payload (Phorpiex)", "value": "b8937b9074758278ec0ec003b1eaf255", "object_relation": "md5", "Tag": [ { "name": "77-91-97-98", "colour": "#08CFFB", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777079995, "uuid": "4000d0f7-b649-403e-ba66-b439211a0290", "comment": "Malware payload (Phorpiex)", "value": "d8f2d41436a6c74215d44842927522752c6b2c80ed16050bd54c624e47452ae8", "object_relation": "sha256", "Tag": [ { "name": "77-91-97-98", "colour": "#08CFFB", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777079995, "uuid": "bb9dd527-c9b7-4468-8da9-b736f4ec3a9a", "comment": "Malware payload (Phorpiex)", "value": "5c6039613018ab058f3d5b49eea312b95b479152", "object_relation": "sha1", "Tag": [ { "name": "77-91-97-98", "colour": "#08CFFB", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777079995, "uuid": "35d4ca4e-e88c-4c9e-ac67-f5bb9e26d6ef", "comment": "Malware payload (Phorpiex)", "value": "10b7a16a3ef1aeab7dbf9eaf22c7829f1be7c830a8af79fb8752a60868811efd6c4f202c7962c56d7c3e0d11d16cc3ad", "object_relation": "sha3-384", "Tag": [ { "name": "77-91-97-98", "colour": "#08CFFB", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777079995, "uuid": "c8d55a65-2b1f-4252-bddb-81ccfe5cbdb6", "value": "T1B5A54B40AD821DB2E141323264F6729B2B38D8090F3EAB53EB507D79E97F6D17863719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777079995, "uuid": "20dd5afe-cdff-4f0d-819c-e90e242bc6ec", "value": "e8c28134163fa189336ed64a759c7015", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777079995, "uuid": "9d5edbc0-51e2-44ae-bc79-ff49f8e06ca7", "value": "24576:5hGuoe9qFJVyg/LKSXNwkIEXoW0qknDfuP964TXVt0g1vNYqnb3cu9T14A/8n:58lbtikIs5ZN3bsuf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777079995, "uuid": "76ca0d8d-cd41-4294-8f6e-e725bfa88ad9", "value": 2084080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777079995, "uuid": "fa346718-6838-420c-b4fe-836f24d0519c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777079995, "uuid": "ca219f24-93ea-4382-8de0-d1f996219527", "value": "qExbopet.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a1b2713-409b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777117247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777117247, "uuid": "0781a02b-717e-4e18-9863-9ad81afa3529", "comment": "Malware payload", "value": "25f2b678f5543b59570b97ac8cdaa726", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777117247, "uuid": "1afbecb2-a054-4e46-9645-17e6b2aa9cf0", "comment": "Malware payload", "value": "d8fc7d35381d321ec59794e28fc819a53baf3236708c9b074ed23d7ae39dbc00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777117247, "uuid": "c14e5751-30c6-47d7-8dc8-eb0d29ddbd54", "comment": "Malware payload", "value": "61b6718594333d602fd81e376d683e83a5672c18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777117247, "uuid": "954d531d-35e3-4565-a235-99c2a3d03d10", "comment": "Malware payload", "value": "905db3e0effcb7418d7ba9c927698899a838b0d564758c2f60699fea2b71b7a145d775469c81db81a59e71f4a960237a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777117247, "uuid": "3a17d2df-dd51-4a56-8f59-fd447ce6a59d", "value": "T1E465D002FF805FEBC06FCD30892EC35711E9E8825591A62A71FC4B9DBA5D35A0BD7588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777117247, "uuid": "d5cb7507-aa19-45c4-8779-27de2c26046e", "value": "24576:ZYnr5PrLsOf860KhwVfLeyxzZChj4C4LYzRtkvnIouh0ocTVbGb+4o:ZIrLyrVTx0Jn4ERtYnIoU0vTn4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777117247, "uuid": "2f407a14-c507-4672-af49-2c0adcbecf1d", "value": 1492724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777117247, "uuid": "c76915a5-39d9-4417-abd1-b4561d3e6925", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777117247, "uuid": "f98eb3b7-d757-48ca-b7bd-3493eeab82a1", "value": "bot.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a78fecd-40d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Vjw0rm)", "timestamp": 1777140816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777140816, "uuid": "2ef6eb67-572f-483e-b4d7-54c0fb76bcd6", "comment": "Malware payload (Vjw0rm)", "value": "23add457c49eee0139a4a3d3702401ad", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777140816, "uuid": "b4aac0d1-3a31-44c5-aeb4-a85264b2e691", "comment": "Malware payload (Vjw0rm)", "value": "d9921f8af671521c36a1158f9ae98a52b45cba288d2bf84abf33575b2bdd78e7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777140816, "uuid": "8bef2d9f-0fb4-4af8-8842-5f8700a2629b", "comment": "Malware payload (Vjw0rm)", "value": "535fef8df1b1416ac56a119b7626773ed4b79fc7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777140816, "uuid": "5625ad16-2fcd-4f06-a3c7-6c9fa0f79778", "comment": "Malware payload (Vjw0rm)", "value": "2d6c80e2a4eb79abc0fd17059dc413bfe83b947ab7fc32634a063624547477399c026eb32a0de246241c8372f47a4de9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777140816, "uuid": "fcf3649d-6087-4ba7-8795-7f5d79eb3a3d", "value": "T12723532CBD6322AF729588FBA5D40543987E37DB620E17851581C3E04727A2FAC7ED2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777140816, "uuid": "3e9f63e9-7f30-4916-952e-2d314aea1b44", "value": "384:dSzqdahuhwNQIcWE7y4xbpbBJy+xHNdqHPhegMieqidyZy6aIoEdJBoqjCp3nDJ3:onMieq2qy6aLOq3jfvr46N5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777140816, "uuid": "c0bf0089-c7a9-4bab-b1c5-7ac552a428a2", "value": 48724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777140816, "uuid": "7726ce91-fb45-401e-983b-6245d7a7887d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777140816, "uuid": "fab91861-a7cd-46fe-b6eb-e397c6551168", "value": "Patch.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2af3c8-40c4-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777134672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134672, "uuid": "8462fc5a-c79d-40b9-8781-2b1020c869de", "comment": "Malware payload (AgentTesla)", "value": "69d7e7890e622c8c2fc4d5e3d3c624e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134672, "uuid": "e5587691-63e4-4558-8abb-9b2444ba2f82", "comment": "Malware payload (AgentTesla)", "value": "d9b01a4e8529655fff9f35abda18fb311400003c51345f0627a534df5785f3e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134672, "uuid": "548080c0-ee9f-4647-a18a-35a8f0dd6bc0", "comment": "Malware payload (AgentTesla)", "value": "a84f349a6de349f656b948b9256ad857f2ea5a6e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134672, "uuid": "c422dc97-ca26-4733-a5c4-34819889205b", "comment": "Malware payload (AgentTesla)", "value": "922eb9e0d17381e37363a5f8c69fee376954607b37c84a078b24c43af687195ad03de013b0e3a43bfa78eb0a99900b24", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777134672, "uuid": "6446ce5f-23e8-427a-aae5-a624d66f9a06", "value": "T19C1523727BD27DFE4275AB2961FB8D14D9B00FCBD16D95AB7DB8A0132B21B851233042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777134672, "uuid": "2e355417-292c-46f0-8e2f-f08db7a05572", "value": "24576:e+6SBQso2bT0Anawi2CZA3Umiwj4oKnt56FAv0fyu18Yb9Xz:B6SBUWN9hunmFa/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777134672, "uuid": "a1685141-ae04-4642-aab9-e94866c2a5cc", "value": 952917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777134672, "uuid": "2f8a4963-cca4-495f-b208-5f2cd5807b48", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777134672, "uuid": "3251398a-009f-4bba-aad9-543176ac80cb", "value": "ps_pzRzADuvkx36_1776697707697.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d60f06-408e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777111492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777111492, "uuid": "3a752d61-5abb-4bd8-9ecc-a75ef615b71e", "comment": "Malware payload", "value": "9001b2c0e0c64b04247808a171ade866", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777111492, "uuid": "b5f0ef91-8a0e-4861-9e8e-20fe6954bfcb", "comment": "Malware payload", "value": "da5b03d80048852b51cd62eb61387c3247896b2e331eabeffa59f9f63820ab62", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777111492, "uuid": "da708ecf-fc58-4f06-b704-cf669a971027", "comment": "Malware payload", "value": "87b8f43ac28b65f200a6beb20493d45ad05d4f4b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777111492, "uuid": "b432741d-553b-45c8-a904-3942dd74ca9d", "comment": "Malware payload", "value": "5af8efb4d1c901066f1f42dc355ace4ba0dcedee5943f9a579c426153a5dfb75bfce5beaf335a4185e4eab0895603dfb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777111492, "uuid": "2168eec5-bd31-4c1f-a005-df2de8be2369", "value": "T17A968D07EC9155A5C0AAE6318A729293BA717C485B3123D73F90F7392F73BD06AB8750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777111492, "uuid": "f31bdcdb-3d80-4195-a161-65ead64076cf", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777111492, "uuid": "542869ba-5cf0-4893-9d85-adc38c3116a5", "value": "98304:3UFtBMHqONe814wktNji9Fwur+yjNX0JYkR3ud5stHnE:3UFzMKONe849NjuFRr1jNkSIeoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777111492, "uuid": "107b2c83-cf59-4ab2-b357-a49cfeb0595b", "value": 8744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777111492, "uuid": "9a3ea12c-88fe-4d1a-9f0e-d2b2fdcb6c60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777111492, "uuid": "3b995dcb-6a1d-41aa-8324-49ed18e1de92", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88b1e2ac-40d5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777142129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777142129, "uuid": "b9b6570b-f4b6-4244-ba66-e21ad5163cfe", "comment": "Malware payload", "value": "67556777c958f3cb3961727a705afdf2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777142129, "uuid": "9675f706-2d02-4ba3-9143-137d179d71d2", "comment": "Malware payload", "value": "da8b3bcd94d3842e1a20d898697a856809077d30d763f9d2e18b43ba6f4889f2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777142129, "uuid": "07633174-561c-4462-8299-6212c91b5fac", "comment": "Malware payload", "value": "d1b015c381eeb76d3c67b9025fde48d2d7d81b53", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777142129, "uuid": "a0fdffb8-9778-440e-bf77-387aa32aee7b", "comment": "Malware payload", "value": "b68c5714a92f4feb8d1a60939ebbc59d1cd2d4fa130232adbd944b29ec0edbdc10c7e69aa226891d61f4afb0508a4cd2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777142129, "uuid": "83c6738c-cd32-4342-89df-c5c7d739552d", "value": "T1C6136D6566813C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777142129, "uuid": "e17487e9-ac13-499d-83ed-8bbcf225edc7", "value": "768:byXRWNGxVW9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:b+lxRco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777142129, "uuid": "4e3e1ca4-5592-401a-9795-b9d8c48d7683", "value": 45522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777142129, "uuid": "b6d1fb05-1639-48be-8ecc-260e9a8241b1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777142129, "uuid": "08b12222-afa8-4fc1-b673-acaa374e85ba", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ac3cd41-40ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1777138991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777138991, "uuid": "ed4f9006-5e75-48e5-87a0-7d2801dc5e12", "comment": "Malware payload (Formbook)", "value": "84d726fc3919ddb0b2cb6b4d691af44d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777138991, "uuid": "0d113a0d-159e-40ee-8ed3-c54f6b634843", "comment": "Malware payload (Formbook)", "value": "db9f42884c1a7e89475cf33e639f3e98d88300615309de64aa2a7232a9823a2f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777138991, "uuid": "4cef326b-000f-4aa4-bad2-dff8ad5cc23b", "comment": "Malware payload (Formbook)", "value": "b84fbea821f11da3553091e516cb034f0db0defa", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777138991, "uuid": "569d78df-7277-4395-ad53-0c266625bff7", "comment": "Malware payload (Formbook)", "value": "7604f13736258b3c2979dfebf496e2deb5365b84c153e79a0770bdfea71c9f15238f6a04193365ed01e8ceb1ff5bd764", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777138991, "uuid": "f91e5150-87db-4ac9-ada1-e2cd6b204789", "value": "T1426523955DE26DEF01F9D39EB13A4E1E14F0190C8C49F8EA6B8038821DFB756690FD1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777138991, "uuid": "60f01f73-2b83-45ce-a15d-24c091c5d3b0", "value": "24576:NF5nHkHgrUvfopFAZElkF48nYd0pbQ9OtBVkyASJ+Zu6bUKpLjwuCzvpNjKJU71E:NFFEH6UvgpFYECbNxVka6RJ8pM+ds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777138991, "uuid": "85c876fc-1879-4fec-9748-d3b59f517387", "value": 1535267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777138991, "uuid": "657a0434-1c60-44e1-ba04-049c402393b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777138991, "uuid": "0dc0626d-d459-4e7b-92fc-0c3151f3a44e", "value": "06EWFQ0K.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef27c32-4099-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777116235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777116235, "uuid": "ba5cf23a-0657-41e6-8a1e-ed23028dc99a", "comment": "Malware payload", "value": "cad4cf2ef675f1d0be23b89b2721ec0c", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777116235, "uuid": "a901a416-3e04-4590-9e8a-c76958212ead", "comment": "Malware payload", "value": "dbf871f8e45d38af3848f63fcfbd11218e9b2f043f237bd24c21149ff9422771", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777116235, "uuid": "1e0db131-8e38-42e0-b1b7-03cf2a64c557", "comment": "Malware payload", "value": "55ccdd05670549ade94e9eafd39640940aabf935", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777116235, "uuid": "31fa7ce0-92e5-40f4-8042-37a695158fcc", "comment": "Malware payload", "value": "0aafc0b8b6f664e83e8cd8e18d673d417fec38f4c6954b25683c7c891b97a5796c4e5579e9603b4673e49fdc9e2aad33", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777116235, "uuid": "7aa251f6-2f51-480b-a0c8-8580be034a0d", "value": "T117C3F0CB4D8E88ECCB4F6028714F7D43C98B9317461EE950B69FAD953F22E69709A5C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777116235, "uuid": "94d4f8b8-fdd9-4b10-93b9-455958903c38", "value": "768:yGwbkJRcIUC7O6Nat+d3GhuwGVuvANwylpFuGt9IM2y7zKVXJrR6vhri5NTfbo:yGwb2qIRq4FumiM2yPUXX7rM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777116235, "uuid": "0a590533-09cb-450c-8eb3-c502381a957c", "value": 125356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777116235, "uuid": "84af5728-64bb-454c-a778-43a2306645d8", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777116235, "uuid": "bcf4d4cb-0429-4da4-9a40-d2cca1d01ce5", "value": "Build_Primary_v1.8.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c955b177-4039-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1777075236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777075236, "uuid": "d64b0184-ef8a-4ace-877c-05926e1e7953", "comment": "Malware payload (Gh0stRAT)", "value": "4afac418d6fd9e691e86ed413ec02ea6", "object_relation": "md5", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "rtjthgjnwetghf39-top", "colour": "#922282", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777075236, "uuid": "be1cf74d-3fab-4d9c-8625-d17122164686", "comment": "Malware payload (Gh0stRAT)", "value": "ddd032bae572a54648fa87005b1a0dccd98da5045c23ebf41e02c8ebbf7ce648", "object_relation": "sha256", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "rtjthgjnwetghf39-top", "colour": "#922282", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777075236, "uuid": "48796291-701b-49b6-bb21-dae3e51e2187", "comment": "Malware payload (Gh0stRAT)", "value": "62a5736805a0b2430169db32603b765152203158", "object_relation": "sha1", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "rtjthgjnwetghf39-top", "colour": "#922282", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777075236, "uuid": "ca2114b5-653c-4e6e-a31b-3ffa230f3613", "comment": "Malware payload (Gh0stRAT)", "value": "4b54c7042c8653d3b2ecd969e9870a2d62588cd780ad603f193d7040f1f3242dd6fe52b7b3b495f596b96fcd56d75858", "object_relation": "sha3-384", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "rtjthgjnwetghf39-top", "colour": "#922282", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777075236, "uuid": "205e77c7-5d57-4c28-b09f-703ddfbd5b7b", "value": "T14B873316F3C9C1F0F97B043208A682DA19E57E674374C1D39B9CFED9989C6D269B1B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777075236, "uuid": "be41f19e-8992-47ba-8ffc-40070bd152c5", "value": "1ff847646487d56f85778df99ff3728a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777075236, "uuid": "7624fad0-db79-4a88-9d6e-0dd7fe656b2f", "value": "786432:KFRIVBs1y/sHzH1waOxAP8SGw3ObgQyhbilm3hZi:XA1y/Sz1wpxA8w3ObgQmb6gri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777075236, "uuid": "0dfaf555-90e9-4839-b2d9-3b6b7de1ccab", "value": 36057546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777075236, "uuid": "2425bfe0-d67f-4768-8d56-ceca085054b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777075236, "uuid": "19ed389d-ad9a-4d7d-8f64-881700d8a625", "value": "l6dts_w9inx664iw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8657a520-40e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777147279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147279, "uuid": "778281b2-6f66-4d58-bd2a-fb3e0fd25e83", "comment": "Malware payload (Mirai)", "value": "3c6bdda1f59e40cebf63c756dac90252", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147279, "uuid": "8db74707-6143-4f66-bb69-97ac418ded2f", "comment": "Malware payload (Mirai)", "value": "ddf69a53ade7d36408dbc4268a146a787994d76ce5296a68db3e47692cbf1474", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147279, "uuid": "1fd35c87-315f-4288-985c-dd65a7271150", "comment": "Malware payload (Mirai)", "value": "fab41ac134d20537ab7c096faabf23bfe5fcc404", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147279, "uuid": "cc556404-e885-4b3d-b056-52af8b685683", "comment": "Malware payload (Mirai)", "value": "be80aacd81bd6ac7820c8191cb8f9c94b017b98aa0c87caf668f09bec82ecb1110ece66aff0c76284a8a2fccf79ffbaa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147279, "uuid": "47c5efaa-ed37-4065-92f4-49f82b48469a", "value": "T115C3F185BB6369D1C1A242BDA4C00AC387916E318BE317080699F674387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147279, "uuid": "ff933f55-419c-4ebf-943a-b2b1558394e1", "value": "3072:OBb4K+nqsnSjZldbaUXGSgqTWo1OWqEwztlMMTnY:0OCDjXG9qTWywxlxTnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147279, "uuid": "e0bfc2bf-b484-444f-829e-eb68d554862f", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147279, "uuid": "56c90dde-b49c-43ee-81b1-d7f5fc490b8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147279, "uuid": "73ece985-61eb-40ff-91a4-e2726c9f2b41", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7fc20c2-40f2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777154690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777154690, "uuid": "158731c6-30f2-4740-96ec-0cb541716be1", "comment": "Malware payload", "value": "be3c7847e6248dd2ebcdaa6ca24d656a", "object_relation": "md5", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777154690, "uuid": "5db661ca-a75a-4240-98fc-217970a2b4ca", "comment": "Malware payload", "value": "de472ed37e33b79e1aa37e67a680ee3a9d74628438c209543a06e916a0a86fba", "object_relation": "sha256", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777154690, "uuid": "63d73786-413d-4894-ace0-9b7bf6b8de9a", "comment": "Malware payload", "value": "7801de22344a72031e9ba7a19bbcbd027d2a1307", "object_relation": "sha1", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777154690, "uuid": "e4324dac-fc0e-4414-8041-b2392d0e2ec0", "comment": "Malware payload", "value": "011a06205f50a3ec9475be7be41ff52729d463ff2c529464b6402b8a16ff2efd6d53ce094cfa47198f75da213ff773a4", "object_relation": "sha3-384", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777154690, "uuid": "c2a1c951-9464-426d-820b-267c3c7b6bb2", "value": "T1C9B2A357B96C82BDF02DB6340CEB4A65A5B37078E71F910FF7811A246B2C3804D4A657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777154690, "uuid": "7825ff9b-de09-430a-a7b8-75cf32c6d7b4", "value": "384:oeQ3/3oDPoQodUPCaqvITgCtB3+shIbMCfZS3FSa/zGyUXpXGZdSlYP5ihQTSHRB:oeQgDPogBvn4bDRS3v/zoXrq8RB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777154690, "uuid": "ea2fbc06-01fe-433c-823f-1b24e5aeaac5", "value": 23632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777154690, "uuid": "68472f7a-f5ae-4794-815f-47eaa6003b8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777154690, "uuid": "98bb7fab-3da2-49c0-8db9-0b25f306750a", "value": "dbus_socket", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b74c546-40ea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777151072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777151072, "uuid": "87724308-d052-4d45-827e-728dd1c29804", "comment": "Malware payload", "value": "1dca47fff92d2b11678ff3fd35ab9b06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777151072, "uuid": "8cf12767-d6b2-4ba4-8219-4d46b34b8676", "comment": "Malware payload", "value": "df9fefadf7012452f597602f84a31f6e40637004260c1457f819ce1ceb89b7d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777151072, "uuid": "75847792-b9e0-4081-b1b0-3a77bb94f669", "comment": "Malware payload", "value": "7a5e21d0be1b45b32833d6e6848d1b90d11cd28a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777151072, "uuid": "734efb94-4a25-4351-a954-e37248677841", "comment": "Malware payload", "value": "420279da8774d9861b66e5f199cbc5a241968d3fb4ff65724fa2c3059e0427f0492f7473dcdabf010e0509c1d820d6aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777151072, "uuid": "5c7f0e62-4456-4ee8-86a8-6fe598aa20e5", "value": "T11D76CF12B545A8FAEC1B1B3D4D63DE9C983BA71225CE9C065FE47C4C4E340723A3A65E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777151072, "uuid": "47162fbd-cdec-4cf8-b432-1edd2ac83abf", "value": "e95bed2f908bb55dac8b71baa42ff8a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777151072, "uuid": "202d7fd8-89c9-4de0-8ecd-78ca3cea845a", "value": "98304:ePBuzWA2Ddews53WSJWy9olzWTH4OGAD47WBg:KBuzWpUFB9olKTH4OGl6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777151072, "uuid": "a845549a-5c27-46e9-b27f-0fc9a8efcd40", "value": 7498704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777151072, "uuid": "39279806-7d0e-48ed-9700-effbc4c34eb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777151072, "uuid": "0869717b-4c95-4b98-a6d1-ce8c2c6da2f9", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f3d814-40f2-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1777154655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777154655, "uuid": "65b74a99-bb10-423e-b815-d6331b056104", "comment": "Malware payload (LummaStealer)", "value": "5db2888c0cb3b8073c1f4fe48be7cdc3", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777154655, "uuid": "2e757598-1153-4765-8ea2-32e9d8e9956b", "comment": "Malware payload (LummaStealer)", "value": "dfc5c60143315bb7acad5cfadbf8da057659166fcda08c70d1d520fc0cb9c496", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777154655, "uuid": "cb2ce3b5-f2ae-4458-ba84-57337f22e998", "comment": "Malware payload (LummaStealer)", "value": "b046af2fb357d0d4c47fcbd1a1e6b5ea14dbdf88", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777154655, "uuid": "19d22532-140b-4dcb-99c8-54950258312d", "comment": "Malware payload (LummaStealer)", "value": "05941c1a038a84761794a6f1c8ec73257a60599383daf5bbc416a0b788dad489f876dd5914eefb7ea7dcf9d8edce47d3", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777154655, "uuid": "511499ba-437b-43f4-80d2-f1595df61585", "value": "T15E564B80A9C314B3D58632325076726B6730980E0F7ED693DAE6ADBCBB7F7810867754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777154655, "uuid": "91d6e1f7-af38-4b12-a02f-184f446e1a2c", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777154655, "uuid": "c3b31848-219d-4911-987c-f82fb5c36c05", "value": "49152:JYGcJMRSHTXfDS3k9HHHVHHHJjOXbsu5Gxq:iBMRSHTXfhHHHVHHHJjOAu5Gxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777154655, "uuid": "4828642d-8d60-40d5-a8e3-37643edf9c52", "value": 6216888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777154655, "uuid": "1dcde648-e5d9-4005-b5f5-72b00df3866a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777154655, "uuid": "bedfb07d-1f9b-46d7-a7a8-5ae7eb10bfc1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b74972-408b-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1777110535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110535, "uuid": "ce2e6df4-aa5a-4b6c-92f6-1e0ff81b8ea8", "comment": "Malware payload (CoinMiner)", "value": "3a9fb5c95772fe0b2f909525b65652b8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110535, "uuid": "30f122ce-8d9e-474c-bb4e-1531447b9d73", "comment": "Malware payload (CoinMiner)", "value": "dfc79247925183c692576c87607d5ca6ea397238e93ece04f174227f8cfde1b0", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110535, "uuid": "777e588a-93ee-4739-b840-10508a86a20b", "comment": "Malware payload (CoinMiner)", "value": "b2e57542e4c3f9ba1ff80231fdc803d787e94e96", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110535, "uuid": "02d8cf9c-639e-42ba-9050-df4726b7db71", "comment": "Malware payload (CoinMiner)", "value": "7f415570f8a88af2737068908444fba335c63f9a19a43a3b1bb6d3c86ae85c3c9f439fe44a44e88c7478b7d8d4840d70", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110535, "uuid": "615d945b-e705-40e3-a3c2-ce7b4d63a02f", "value": "T124679E49FC1E6862EAC9B2395B5553A43239BC80DF42C3277615B73DA5F3BD4CB22260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110535, "uuid": "4047fa2a-3c10-4083-83c9-6b1b7fcbe284", "value": "786432:WL7XapUX5cPK1r4VkAMhrbOjF9b2ANOCxr/8WPr:QapUX5gxDy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777110535, "uuid": "76341eb6-7deb-4627-8ff8-81281e69c680", "value": 31129784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777110535, "uuid": "8cb740f0-a533-41a5-80f0-6e8f95c9b3bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110535, "uuid": "c3ec166a-bea5-4b8e-b5e2-63d2545c085b", "value": "vca2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50395cd7-40c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777135591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777135591, "uuid": "e30a850c-a01c-41c5-8ee6-4b1021964bce", "comment": "Malware payload", "value": "b3373bf7d2228e10a96129ba9205a399", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777135591, "uuid": "2cc44a33-a8ec-4279-92cf-73e0fef43063", "comment": "Malware payload", "value": "e00d5ca014cee86d31ca66b56953902e7a40b387ee15c7e45adad5c6a5cb2cb8", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777135591, "uuid": "2498b9c4-b0d9-4866-bac6-0fa21a62b1d8", "comment": "Malware payload", "value": "1df2dcc289ca136f4cc196a03e2a1b5060d9a519", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777135591, "uuid": "94a6c0b1-918e-4baa-8eda-3d94e6098d04", "comment": "Malware payload", "value": "5ee85109a0a2398dd782556f4b7d7578bed9ef9e03d5fb712e911e444b20e57d9d2f294228c4433c39348f4bf924fa08", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777135591, "uuid": "59daa51d-7edb-4f39-94b9-23d006bd45ac", "value": "T1D6973A47FCA540E9C4ED8538896586527E727C8A9F2033D32F60F66C2B7A7D0A67E740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777135591, "uuid": "5fde85db-60b4-42c5-8be2-176b2214c8dc", "value": "4fb21852370c7b61f98b9c32c7e11a6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777135591, "uuid": "d03e7b67-2c8c-43d7-b387-25ae288567dd", "value": "196608:KiqKMBx9igBL1rP0zeNeN7nVlPSgxQCcg8dyEYI4kHIM49qRh8icdQoh:KvBxk+L1zw7nVsgsZdyEYI4oI8xc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777135591, "uuid": "561ae912-f525-4925-bc90-fc89144556b8", "value": 42811392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777135591, "uuid": "87f0bbac-2aca-4cb1-8aef-c25c58bd4043", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777135591, "uuid": "3fa41079-987e-488e-a43c-d0cd38c453fe", "value": "libGSELv2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2673c45f-40c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1777134662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134662, "uuid": "7c54c507-a481-4d26-9201-cc2f00da4181", "comment": "Malware payload (Formbook)", "value": "91bb99c2570799524e79e5f66f3249df", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134662, "uuid": "e49031cf-1c72-459e-b381-94a793485ba6", "comment": "Malware payload (Formbook)", "value": "e054bb5f37b87553b6b6131b10527f0d56444b609c32db30f0ee28bc21d530e2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134662, "uuid": "718b8899-0e9b-4bd2-b0b8-311aa4d2b03a", "comment": "Malware payload (Formbook)", "value": "34d49db27778fcb415e153370abeb8a97bb1c705", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134662, "uuid": "8c01d5b8-145d-44ce-a67d-b6de3d7bef35", "comment": "Malware payload (Formbook)", "value": "69dfc1c100575a885bcb60fb51c77888d10c9bc00a25f3f2a0a30ad88574297aeed5d629a439255306a2247ceacf3cba", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777134662, "uuid": "00967468-2a7b-4f08-bb92-7168b72b4531", "value": "T1F86523147C8858FF0B354E5EC197DD1D23A94623125AF0C6AB913AD78BEEB488F07E25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777134662, "uuid": "ab72bfb0-24ee-4a69-929c-094c1680df1d", "value": "24576:uPK8qSHC+epp3ptQnkvrGfd3sPTkF1x9StqKdRm0gcUGxRrywg2c:u9i7QgG5GSotqTyg2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777134662, "uuid": "3060a68a-31b8-4722-856e-1c04738b90c5", "value": 1430172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777134662, "uuid": "d2c9853b-daef-4abb-9e56-6c9b2c2502e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777134662, "uuid": "6728a73d-fb34-466a-8327-37b8adbe1d51", "value": "ps_p2ebRt0IL6Wl_1776699425788.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b98249-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128645, "uuid": "be3f92f3-7ddd-4bea-8da5-7d760dd18f4c", "comment": "Malware payload (Mirai)", "value": "7db89faf8dd519136744068561ae10f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128645, "uuid": "fa8680b2-4f33-47c2-8d05-689755d232a3", "comment": "Malware payload (Mirai)", "value": "e085cb5001788ddc04c4dbdcd9bf66252b517490810414fa8b99a406436ef999", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128645, "uuid": "5580e58c-eb6d-4c47-8a94-32552ec2dbe0", "comment": "Malware payload (Mirai)", "value": "f81e56d4f45d07f76c8de2f44f9884f5c6853b3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128645, "uuid": "c27f7143-543e-4f28-9f91-55ff7c434cfc", "comment": "Malware payload (Mirai)", "value": "32757a1b10fd8a7652c6701daed0789e4043444d218400109260fbee36311439d58719716990697a2885f7c9cba3fb35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128645, "uuid": "f39878e9-1dc1-4a8f-9c07-77082eb26e78", "value": "T10C32C517A7B7AF1BC4D027770193072162A99FA16025472F7D0D1C4E6E9B3812D3FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128645, "uuid": "726404e6-8deb-47a6-9c40-d449f0fd3821", "value": "192:xvPOR1CQOV/1NxfAzcHaCD0SdbNlDqM+2mKdc0E6+e+f:xvPbbzfac6CISd1/c0E6kf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128645, "uuid": "28190907-13b5-4dd3-b582-cb914c112036", "value": 11024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128645, "uuid": "0a57a8a7-9c25-41ae-9cac-2c31f096de8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128645, "uuid": "43a93be8-0a56-4c85-a632-40cc46fd6bbe", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc1ed86-408b-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1777110489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110489, "uuid": "a5931844-3a25-45d6-b0be-aea41830b463", "comment": "Malware payload (CoinMiner)", "value": "dfcc70c1e7d9a622a73d62f525fdb82d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110489, "uuid": "20712a13-2f5c-44c0-8d2d-c44742eefc63", "comment": "Malware payload (CoinMiner)", "value": "e0a28938bba298c91330a85dd51ed121c1d830f0a8f06304669e0af9ae6cd1c2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110489, "uuid": "b888471c-66ae-40ff-bf7b-f557dcb0ef57", "comment": "Malware payload (CoinMiner)", "value": "7e0dc04fd7e84b2a345f9460ecdedd9fc35170f8", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110489, "uuid": "18c23990-9e7b-45d8-8fa4-fb4ef5a2ea0f", "comment": "Malware payload (CoinMiner)", "value": "bec9f11a5aabc043fc3c23558f29e9578aa1f4b43760eddf7e48575759b3e9558c3b8ec57f672814c1fd7c0c89af93f3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110489, "uuid": "8983b6d1-96ce-41b1-ba7c-ef63449845fa", "value": "T122963318CD124E87DCBB69BB4AA240293F548934D3E29DF6162DD3C93EF2CD099B1725", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110489, "uuid": "24c89437-231d-4e38-af34-a59087a5cd09", "value": "196608:zjoaV7rLmDXzRizBuxl2rCh1WYguJxxzyHqiLD3lD9XzdoN4+al7zDnx:zjoMmLzR37ZtJxcHXJkN4lNvx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777110489, "uuid": "31aa2083-653e-4ee2-857d-b78b650f4730", "value": 8693620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777110489, "uuid": "71cf70cd-df61-4381-8a85-3173c38cb71b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110489, "uuid": "dbd9721b-f14d-4f7b-afd1-86857596d75a", "value": "vca2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d528d781-40da-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777144404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777144404, "uuid": "dfecaf7f-6d49-42e0-acfb-83c4cb018cc2", "comment": "Malware payload", "value": "03553d7e819e641c0855b9a160a7881a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777144404, "uuid": "98a8ef2c-588e-4c94-9605-f9ff524b43cc", "comment": "Malware payload", "value": "e17264322fe008c0762947564f29080756dd34a314d03d957d639ba4b26f8946", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777144404, "uuid": "0f353731-481a-4766-aac4-55fce83d2f49", "comment": "Malware payload", "value": "895358330adfec831b6a7f5a4f8e7572428b5d68", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777144404, "uuid": "0483c6b1-cf25-4e49-8711-2a5637607968", "comment": "Malware payload", "value": "2432d94dbae0406f238269d6fdc9723eb4c087c71f90b5f77bcc22210612407af5c2537a71596b7c83ec815e23230323", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777144404, "uuid": "cbc4a85e-8e45-474e-935d-4cc48f9dce1e", "value": "T1E4E64B320697BDFD3B6D3D45E4052E445C5D3B4B1269824ABB8830BA67ED4B88F2CD78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777144404, "uuid": "3ea31e51-7e6c-4bc6-98ab-aaeb11c0897c", "value": "49152:6CXq+HaV6SOii6V0256s6JOe4HDqY4lBEyo+V+fAf6gibXmDCDfKcDavnys6JhwU:8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777144404, "uuid": "50d6d851-8bd1-4eed-b0f5-9a1b532a12e1", "value": 15090694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777144404, "uuid": "bc8c8ae5-dea5-4486-9678-697d10c1696b", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777144404, "uuid": "37c810a2-b033-4ca7-b4b0-0f1089eae6cc", "value": "agent-windows-amd64.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16808fbf-40ee-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1777152674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152674, "uuid": "46c3b7cb-264d-4c99-b076-a7a264060ec3", "comment": "Malware payload (a310Logger)", "value": "6c959df3f611f84d4d5e36df3b1e312b", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152674, "uuid": "aa675b36-ef07-4c26-858b-c1152c1628a9", "comment": "Malware payload (a310Logger)", "value": "e2157f2dfc275d131eac1990497e890876dba0d381d605737a1f1d803508e442", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152674, "uuid": "4ac5ebe7-58eb-42ac-bc0e-8dac74854523", "comment": "Malware payload (a310Logger)", "value": "b657dabee114ca02a982e0dc66899972fea88475", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152674, "uuid": "18ba3494-81a2-4e96-9a19-ed73691355e8", "comment": "Malware payload (a310Logger)", "value": "169c96b48b29653d089ee585d2a67b98c952694df580059d7b84fab2d508896d68b75531c03e17127d8520c06df8a931", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152674, "uuid": "7ed476d8-cc93-4ee6-99cf-ca48769e1bfd", "value": "T1099533612FF56EBF4AACA354B06B6F1D0FF20EF3A00491E755E298C10B943134A9B579", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152674, "uuid": "817bc278-5142-41b9-9c5a-d8e6f940179c", "value": "24576:g5RQkP7O3yaS/S+RnxjGXVDuist/cq+tInIzqH+1HulQGWG724ZZH6tcuhaEEhxC:Tyh/Atst0h1SEFhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777152674, "uuid": "15424ca3-a0f7-482d-91f2-af85af30d4c4", "value": 1879857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777152674, "uuid": "fadeedac-9377-4eed-8bc3-13b9e2755c38", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152674, "uuid": "b9d9d8d8-3ddf-4522-9a30-b0fd860d63b5", "value": "ps_gZVRuaTQUhHZ_1776434393397.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "febc5b35-40b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777130301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130301, "uuid": "9f27a2bc-52de-43f6-9bbc-909c099ef8c1", "comment": "Malware payload (Mirai)", "value": "fd59cd2f9479bb59c09b1a77c971002e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130301, "uuid": "34c1e6c6-6ae8-4473-bbc1-f9c3b7b11d9e", "comment": "Malware payload (Mirai)", "value": "e29a8f9d42d29d08f4bf541fb10177d37a81eb90f5ef37080fcbf7c544e61460", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130301, "uuid": "24a9e089-326c-4e1e-80e0-e2fea3c0c6d0", "comment": "Malware payload (Mirai)", "value": "24efc56ba2ad9f52b42fac2c5f8c5625c441e53a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130301, "uuid": "2664adf8-a8c0-4e3e-821a-25ca003b533c", "comment": "Malware payload (Mirai)", "value": "b8c230988343ad19fb760ce6dd5cd2b80bd1fdf9a07727edae5c12e8bfcde546d85a1e2f03932621b4cd1838f26eed24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130301, "uuid": "649c2e7f-a64e-4dd6-a6a9-a533c636f51b", "value": "T124141B02D5518B57C1C61B7ABB5B425A37336F6893DB3302AA28BFB42F46B9D0E3D111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130301, "uuid": "7a249a4e-2f5d-4bbb-8307-68645bef0f87", "value": "6144:uesZX+a2XvsboTMZYPOTUFUTmfGQ4ZP9P8Qg9PV:ue4X+a2kboncUFUTmfGQ4h9P8Qg9PV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777130301, "uuid": "85c401d4-3008-4ee0-b8fc-91eec71ce838", "value": 196840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777130301, "uuid": "39475e76-f2d2-4adf-b14d-59fb1f024872", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130301, "uuid": "43736c32-1c10-4b3d-820d-4229b104d064", "value": "bot.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f5528de-4070-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777098787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777098787, "uuid": "716195c0-38ac-485a-b862-3798996bf7af", "comment": "Malware payload (Mirai)", "value": "a7f1ee8a930e289ff945de8fe6999214", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777098787, "uuid": "16f21409-5965-48c6-ae08-a168605ba0b1", "comment": "Malware payload (Mirai)", "value": "e4e1beaf3033d7c1a39ff638f1b4e2ab7adf9721b34c28c52a7984112777599f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777098787, "uuid": "f3b23a77-09b5-42ff-8c2c-6128d1716a92", "comment": "Malware payload (Mirai)", "value": "2e5bb7cbef154d04082c7676505cd204a035ab2d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777098787, "uuid": "dc50ea50-e5b2-435b-8afd-c1f853939018", "comment": "Malware payload (Mirai)", "value": "c4151ab215799c78da3c592faf2b42ce4b1476f052d1c1434145c361604c30cee3316491443b2271bea9a96c9bd09025", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777098787, "uuid": "4716bc69-fbbe-4f9d-a869-e2eb9162b902", "value": "T15CC0C0C4846618460452E5C0F451413C303138D134FE3A0CCE81CCF0C04470DF200FE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777098787, "uuid": "55c1f9ad-5a53-4f59-80ed-2c8e9c76625c", "value": "3:TKWRt9jvGBwCjOolTLTeUWckc1II3v0RQQrFLTTLTeUWckc1II33B+HHGzFz:BRzqlfWeh/52FLTfWehHkmpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777098787, "uuid": "1bb41673-418f-46bc-97cd-69b8c15e7b46", "value": 181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777098787, "uuid": "8651497f-34fc-4a4c-9d8a-ad5ef80f8acb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777098787, "uuid": "4add6c7d-92e5-438d-9fda-12a4c1bbdc83", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b88d9c12-40e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777147792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147792, "uuid": "4f16b15c-b3e9-4822-a7ed-eaf2a60ac03b", "comment": "Malware payload", "value": "138266acae1fe8fb0446511546c39314", "object_relation": "md5", "Tag": [ { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147792, "uuid": "e06d82cc-3817-4b8c-846c-98b65a83c917", "comment": "Malware payload", "value": "e509431663ed1839770e56a17120afcb1692e25a1bf6633ba46c6e0a96155624", "object_relation": "sha256", "Tag": [ { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147792, "uuid": "40861475-8c5e-4ac7-8527-9350cf2958ad", "comment": "Malware payload", "value": "21b436d25375e2f19cd69670fa04b18a60ee0ad2", "object_relation": "sha1", "Tag": [ { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147792, "uuid": "8f80d9b5-0ed5-48ce-9267-4b5132224f79", "comment": "Malware payload", "value": "a3579692dec3695b7cee710b3f41ccb8e494c56df7fdf730c8ac87bfe91dfc7423c9e18673a0ed7749d18b63f2cf7092", "object_relation": "sha3-384", "Tag": [ { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147792, "uuid": "8f508f60-3431-413a-9713-43ea6aabacd2", "value": "T1B1747B8AE7BB54B0D54B0938259FB33BDF3416294328CEC7DBF0DA4475672E21936A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147792, "uuid": "0dca0b5f-93ff-4105-aca1-58336025c84b", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147792, "uuid": "d861da2c-b3c1-4940-98ca-27d3b2569ebf", "value": "6144:XvgEeOcmwvEL7fF1jTA659HSC8AVtZ5XlOHaoIhEFydXt:/8OcZ07bf0OtDlOHaoIndXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147792, "uuid": "2138bab3-bf67-4507-841b-2a7a98ceb603", "value": 345600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147792, "uuid": "1dd9a544-74b6-460d-b99d-a09df757b781", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147792, "uuid": "a10862c6-f89d-4eed-8fb4-4379aa442817", "value": "Build(4).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dafdfb5e-40a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777120792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120792, "uuid": "122d3a6c-ea40-4e5c-95d0-5040b40fe2b6", "comment": "Malware payload (Mirai)", "value": "f84eadba8b1000418e427978ae39867f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120792, "uuid": "fdc664b6-53f4-4992-8522-97ab4090b726", "comment": "Malware payload (Mirai)", "value": "e5a5556fe4f7822043b5c9fd61c5dfea493902099118eb9cebac086ed7684786", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120792, "uuid": "be7b8fa3-fdc7-41ee-be4c-a91fe75ca400", "comment": "Malware payload (Mirai)", "value": "3339c905270a9f81a2c3673b21ec37c708077bfd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120792, "uuid": "a067de56-af6f-47c7-8ff7-59883f166491", "comment": "Malware payload (Mirai)", "value": "4e91232127b02c30303b0cf7873f3ac134ed7f53e49acffd55aa828c4fdbb1386637ed78cb97b7a2de9edfb4478cd5c8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120792, "uuid": "a82bbc8d-eb9a-4c5c-bc43-605d61ed51c4", "value": "T14184234DC6AA0D85F38FC3393DD6AF34AD9071BE65930317AD45BABF395AA523400834", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120792, "uuid": "7ab61191-6787-4b1f-81c7-18098aea816d", "value": "6144:Sku9rg2S/rt52ufbH/kgEfvrhtAvLax8oQz1LAzXLyatkC8hlE6qYG30Wbvqrx3/:LDX/rt55VETAzaGoQQ2wXp6qX3Nq9nSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777120792, "uuid": "f31ff80a-aeb4-4e32-a87a-778100d61472", "value": 392164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777120792, "uuid": "3314a885-b4b1-4011-8017-a677d612077d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120792, "uuid": "e822dd45-0931-464c-bdfe-5a970dcd83a6", "value": "ntpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5464a2f-40b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777129399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129399, "uuid": "fa77204d-4bf6-4ae3-b65a-9c29b3d82305", "comment": "Malware payload", "value": "2325a294d923b65cfe1e2e367cce6038", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129399, "uuid": "e9437a7a-1bd7-430f-b4c4-b70419578c87", "comment": "Malware payload", "value": "e7fec8d6208f05fc36672c3365a6008d5153e4187c747f9b8a8d56b3f9291bf7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129399, "uuid": "32667647-cc65-4240-aafa-bb0256df27b0", "comment": "Malware payload", "value": "c426630b59aa7ff1bb58ad2932c38a6727a42f07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777129399, "uuid": "65083699-1ccf-43bb-b87c-64d5ed4c5e98", "comment": "Malware payload", "value": "5c1c14abde28e2820f7bcf5ee9e83110c0d1f23a127b845ebb6be124acf26778f819d7b3311f2e7f68feb5252001f5ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777129399, "uuid": "f39bc980-3488-4c26-9cec-04db62e6bb9a", "value": "T1FEA6336FA5C377EFE56378EC42FF72D57802B1206E68BB6950A428584B1E9050B7370B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777129399, "uuid": "fd486a4a-e1da-4d3c-94d8-586ef168972b", "value": "196608:tCyokIgn/V/W6LCbpZVhvV1g0xP3qAzOyjpf3zcp9vGutNGKSNxvoG9Me:cg/tW7VhvUuSEB3YTeutNG1xQG9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777129399, "uuid": "bf998fc8-b4d6-44bb-b5ec-808ffca0c1e9", "value": 9663940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777129399, "uuid": "ae2e51e8-481c-4e2a-81c6-46024316d8eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777129399, "uuid": "b59c7890-eda5-4917-9eb3-c116ac071de3", "value": "vc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd7ecd3-40ed-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777152636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152636, "uuid": "54d4e692-9ed7-4392-96d1-adde7a68b167", "comment": "Malware payload", "value": "7e099b63a9a5e5526ae0ac7690a8a8af", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152636, "uuid": "46a5d710-e4c0-4c52-863f-aa1c16db3035", "comment": "Malware payload", "value": "e87a0653a3a7c7873fc2df76df0202b059d0ce3f945d887172d9bebf284abe2f", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152636, "uuid": "071ac6a9-f7b0-4ab6-88e4-e80c031895b7", "comment": "Malware payload", "value": "6e006fdc5ab29dc3cf8988daf830c3d8a57d06ba", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152636, "uuid": "79577b96-1033-4071-abe2-4503f78f9ecd", "comment": "Malware payload", "value": "1fa461781af378c1763665a0f50f3f9b738ae44b232d67132068745a57e172ebf7a9e6c266d0502186e83d06894208ee", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152636, "uuid": "bf1c4a00-c657-4e87-aca8-076dddd439b2", "value": "T181170F3DCEE8423EC2B7C929D9CA4A17F85A091B231CFD4A64D773975527183BCA211E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152636, "uuid": "64dcd2dc-22aa-484c-96e1-ea50de06d43e", "value": "3072:IfC8pbP3luExvrprCm9jVaQ01EaKk3zHrDcjWxYt5ZtvcPc5GtOivGN6/DFybCV5:l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777152636, "uuid": "4907510e-6d8d-4824-bd79-cccfcb5c511d", "value": 18513866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777152636, "uuid": "6b189748-4495-48b7-8813-b4acb534734e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152636, "uuid": "d6bdeac0-c103-4933-b3a6-f7d9e67feb7d", "value": "krgvj.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf1819d-403e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777077094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777077094, "uuid": "581a462a-136c-4919-993e-2b5d5115ed56", "comment": "Malware payload", "value": "012364ec74d6beaeba730b798fb78612", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777077094, "uuid": "5a0ec444-33ce-47af-92ef-0023b966f7fe", "comment": "Malware payload", "value": "e8824ce538e5e0aa353c98dc6f787f1e218730f05cf28f177f5f3011382d474d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777077094, "uuid": "86ddc3a9-d942-49a4-9222-12cc9e9c81b3", "comment": "Malware payload", "value": "98b94c147adb8034fa7c40285aa01217bd0ffa06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777077094, "uuid": "5800cffb-4e24-494e-9d22-e0161b3be6fb", "comment": "Malware payload", "value": "b1be09c272b86edf9c2620834bca9be0b616b1736856a73a63ad7f1c7ecb74c63b5e89b000184e32d3e1da31e0d82321", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777077094, "uuid": "9479b82b-d5d3-4b8b-ae9e-bc982d2431cf", "value": "T1B565E0637711DFA1D314C63009B3C6555AF521A20BE2508AB278C72CBA21A6D6D6FFFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777077094, "uuid": "6e891aef-9fd1-4535-a523-babd8d87e9d1", "value": "24576:t4CTgOHoJHSTQFzx+J8nVZkpDZmFhJeyxwy6vSgE9B/x1UcXer0uhsY0LiGq:t4CqoQFzxLVZknkzCvO91/vY0TLnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777077094, "uuid": "923e52a0-1fb9-4de7-a5f4-c540deb1db1d", "value": 1484261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777077094, "uuid": "c4b01468-4132-43b8-8678-7d8f3176a2c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777077094, "uuid": "61ef097c-e8cc-4b6b-b4e0-87f73132a3d1", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5524df33-40e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777148055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777148055, "uuid": "e4e774f4-93dd-418b-a6fc-11d230ba4853", "comment": "Malware payload", "value": "81f74187b640e346c55b2941be313165", "object_relation": "md5", "Tag": [ { "name": "208-64-33-64", "colour": "#F6FA55", "exportable": true, "hide_tag": false }, { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777148055, "uuid": "95cd2d96-7123-496e-b57f-f801e714ed82", "comment": "Malware payload", "value": "e93ad0f448303c671615e99fefe6dc3bd7cf71b00204f964298d9dd7d7d5d34a", "object_relation": "sha256", "Tag": [ { "name": "208-64-33-64", "colour": "#F6FA55", "exportable": true, "hide_tag": false }, { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777148055, "uuid": "5ced0272-1e92-4ff5-9ddb-d906fcd37e2d", "comment": "Malware payload", "value": "48f96da0c2478853d3de4dbe63e747993ca4b559", "object_relation": "sha1", "Tag": [ { "name": "208-64-33-64", "colour": "#F6FA55", "exportable": true, "hide_tag": false }, { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777148055, "uuid": "5def90de-ee14-4d82-a700-0ec8e9ddab7a", "comment": "Malware payload", "value": "cf50f9e3941baa4980b6df3ea8116c548b8a7e9b1997777368989dcc5b5b930fbc2e0005dc1d8f5cf18221717dda3b7e", "object_relation": "sha3-384", "Tag": [ { "name": "208-64-33-64", "colour": "#F6FA55", "exportable": true, "hide_tag": false }, { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777148055, "uuid": "5aef81bb-6342-40a5-bb64-9d9fc6e6bb2c", "value": "T1F8658BEFAB6070D0D9256BFC94D4AD0193B4BDE4BAD0429F118AFB2BCE389438F19155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777148055, "uuid": "3c080a4d-6d9d-4317-8e2c-729d3d8a81a3", "value": "24576:vbt/h4SQPFslYFBNof7QUHkkbckmrGlxRr3f+XfqUmc0xL:vbt/pyF5BNoH1bckmSlPrsiJxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777148055, "uuid": "70205d33-dfcd-4d38-8862-d6287258219c", "value": 1455992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777148055, "uuid": "a8626b95-8b13-430a-98c8-aecff6306aad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777148055, "uuid": "32ffc6ca-cc9f-4975-9c49-24fa5d1f1e02", "value": "Waves.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f33b11-40c0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777133083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133083, "uuid": "ef28c38a-cf01-4e51-9fc5-5bf0cfa63654", "comment": "Malware payload (Mirai)", "value": "9f050567388965643551756c55e27d38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133083, "uuid": "ee097baa-4e50-4233-bd6a-2ad53f92ced0", "comment": "Malware payload (Mirai)", "value": "e9936495b7ee77fab7e33c04d6a73c33370e0e5502f394a371c34deee8745833", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133083, "uuid": "079a1eb5-54a5-4ec7-af04-cc5b960bcc6f", "comment": "Malware payload (Mirai)", "value": "f27d73566ee948cff0582a9cdaa9809289f82671", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777133083, "uuid": "ab6d1895-cc9f-464a-8557-78fcb7289301", "comment": "Malware payload (Mirai)", "value": "fe0a4d1a7f5ca3702d9af4ff104612954af88bcd9b074ac99a36cb9ebe97210256cfb599b2eec8291e6a5cb475a34b6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777133083, "uuid": "1b6a3022-4fe4-46a3-ad7e-e697146fbfee", "value": "T126762711FE8B50F2E9031D3105ABB22F67325D054F25EBE3EA407F29F97B691193A249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777133083, "uuid": "494fa012-b5a1-44b0-9ef6-05bff24d165a", "value": "49152:eQXTcXmOI0hdHUNOtSUnIzRkYiOPz2bsa/273kyMvwVIgRYXUo0E6mCLpd5EH:1oXY2HGOtS0TOrE7G3krogbgEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777133083, "uuid": "53ace69b-5670-44e0-9525-7a5368a84053", "value": 7270584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777133083, "uuid": "2afeec93-b1f4-46d5-ace3-b29d29558e0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777133083, "uuid": "200017ea-e4ee-4f47-82ae-f83510db4c6f", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be924fb-40e9-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1777150751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777150751, "uuid": "dd5060ab-ec96-4bb4-9098-641450642c50", "comment": "Malware payload (Stealc)", "value": "403a6b8e8af76987e282b5728e922323", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777150751, "uuid": "9a6f3b48-e0c4-43d9-bbb6-b36b3900752b", "comment": "Malware payload (Stealc)", "value": "e9aa0a12a88c2623a81513e9a2c9777b144b11fdf0b46b1cd90a4d8016ac426b", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777150751, "uuid": "2cdf17fc-3da3-4bd2-baaa-70cce0c1043e", "comment": "Malware payload (Stealc)", "value": "539bd4fa584f7a0a449121bcd087931c8702408f", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777150751, "uuid": "534cebe7-01cb-4cef-a6bf-812754e749d8", "comment": "Malware payload (Stealc)", "value": "fc529c738a8fd32bf8c8668618e63da744a4d7718bd8bd17918012e9379136d56d03e2856fbc2733d7078f509fcbaea2", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777150751, "uuid": "233d9db0-9508-4144-b43e-1569a5175149", "value": "T1C765395BBCA409F6E0AA5332887751A27BB2BC450F7113D72E50B2782F726D8DE79344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777150751, "uuid": "bd61e462-5195-4fbc-940d-7af7fa10798b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777150751, "uuid": "112bec85-c718-4807-ad96-965f00253f39", "value": "24576:2v6zNhNG1HpaiEtQ0u4nKInNyOQ/NBele5zK2I/LD6ed:2ypfGBpava4JnNmGnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777150751, "uuid": "1c1120e7-bfb8-4a33-9b87-03285d7c8810", "value": 1532928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777150751, "uuid": "9765310f-6dc4-4dd6-914b-0c6b494d0b5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777150751, "uuid": "35f8d3b5-2ff2-4fb9-8bca-46ba220da8fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1f893c-40ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777151956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777151956, "uuid": "b7069446-1e2b-4371-9cff-ae0a39d0f120", "comment": "Malware payload", "value": "f64c257e930a972f59c35e33fcfbf8d8", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Plusdrop", "colour": "#03E525", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777151956, "uuid": "b7e67d48-def5-467f-84a8-36a0caad5998", "comment": "Malware payload", "value": "eaa88387f08ecfa568dc2f70e477c0aa46d6a9443ec383063d12fd7c7e715502", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Plusdrop", "colour": "#03E525", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777151956, "uuid": "39471326-97e6-4326-b722-d78496f59066", "comment": "Malware payload", "value": "4ffbc5b826891625a9c79c04ad4042fde3cca9be", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Plusdrop", "colour": "#03E525", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777151956, "uuid": "ee3a7a0e-5188-4814-8ad3-c845d3064ec1", "comment": "Malware payload", "value": "7a3193b62f7beba8a9de27f4008d09d668f210ded0911c5cebece847a0a4cc43f585c7a295baf64f19ca041a007f2653", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Plusdrop", "colour": "#03E525", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777151956, "uuid": "bdccfae9-ed01-4e0f-8a64-f2a65f382323", "value": "T116263341F9C08AB3C55A1632841DE368293DD8341D3A953FB38A4ABC7E715B1B3F63A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777151956, "uuid": "f20cc05c-5ac7-4886-af70-85ceec4df7f3", "value": "98304:KUEPkBbZB0z84RyYKKArMYGRFjyl0pTSsfPf/nAq/K8kFMX8mvnrAtg:KUEOv0RXvyHWECTSs3f/nAqGM8mP0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777151956, "uuid": "377b3fbd-0af3-42c3-9397-f8d403b2fc1f", "value": 4771840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777151956, "uuid": "5ca05be9-e940-420e-9ecf-cd18cc43a955", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777151956, "uuid": "28d03ebb-321e-4f73-8d9c-c6a68690c028", "value": "lineinst.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a7ce2f7-40c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1777134642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134642, "uuid": "2c2a3e6b-0da8-468b-9401-fc6583d3acf4", "comment": "Malware payload (Formbook)", "value": "700daccd095914d06ed4d0431aac5a7a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134642, "uuid": "4419052f-9843-4f48-9ea8-be8364a5eda5", "comment": "Malware payload (Formbook)", "value": "ebbbe693e344634586260fc55ddaef6260508f3cb24960d9b987688705df1536", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134642, "uuid": "5e596279-1093-4b03-b4ce-41e7a5de4bdd", "comment": "Malware payload (Formbook)", "value": "b1bb835b13e27f4299097b545a919daf5e992f3d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777134642, "uuid": "2e61ee18-479d-4ac2-87f2-86b4a38e5423", "comment": "Malware payload (Formbook)", "value": "9e45ecab2f4eac7bdb8911132e9c4ee90c16035aa0de58589e1842020a98aa1e75e4842361de8a0e759240e5afbf89cb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777134642, "uuid": "7c6198d5-0345-4010-bf56-39e6a9f59c63", "value": "T1B8653350DE6F246FA658597A21BB7B3D46B3CD73568C088B4290A1C90C2B3D38F1F25E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777134642, "uuid": "cac889c9-8215-464b-a4e1-b09c3681873e", "value": "24576:a7Q+WRaVHXMyDlBHJQs4qXiu9NN4r01CKNkWjel9Z6KsSU6K:dbGHBDLpQszKQ1HNZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777134642, "uuid": "a011b8e0-e7e0-4379-9160-635c18da0b6a", "value": 1427527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777134642, "uuid": "b3c58d14-90a7-4142-a9e1-f8f7182ed505", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777134642, "uuid": "1af4b905-5e2c-4929-9014-3f04e2b37089", "value": "ps_Hj35DdmStsI0_1776697490020.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6fda3da-40ab-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777124167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777124167, "uuid": "55918da9-c99a-4a6a-8346-d101c1bb6218", "comment": "Malware payload (AgentTesla)", "value": "486c87002be6ddbc79b0090c45af8040", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777124167, "uuid": "54cbe18b-f0ff-4a3e-a086-3470dff7fcca", "comment": "Malware payload (AgentTesla)", "value": "ec1b1e9ea71149c5364c365a1004c67572c5f3b7fdffc650eb28eb5514f9c70d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777124167, "uuid": "f9bd51c2-8fbc-4a2e-b576-19a16e548575", "comment": "Malware payload (AgentTesla)", "value": "808f2af2938021965a6d1b4687b7793a1b65083b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777124167, "uuid": "c402b8e9-140e-4359-a2d0-aa07bea586f8", "comment": "Malware payload (AgentTesla)", "value": "c2b22ba74c42c327c40ed848846893c22592a9ec9711ee49be892cca52ffa8d5befb9b9a41cbd23a9e03f273a252de86", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777124167, "uuid": "beb610a2-0b94-4051-96ad-5c087b98f434", "value": "T10E2533801A959874CB7486AA367F8F4A05945F03F49865FB3DFC30AE135AF06D36BC26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777124167, "uuid": "f8c9dddf-ea47-46bd-b64a-89483eaef8cd", "value": "24576:PPfiWWG9Hf6Iiv8vdDWpCbudFr1dgMGGxgFdMHuQ+U:X6MSIlEwbu59wPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777124167, "uuid": "6988ef0d-70da-499f-a318-c43ec35bf2cd", "value": 1050116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777124167, "uuid": "508cc4e1-6112-4e76-9910-527901b893a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777124167, "uuid": "755e532b-b0c1-4611-82ed-10a789ff5ca5", "value": "ps_javVKZoNGF7Z_1775144132800.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79209042-40e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777147256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147256, "uuid": "0a1c5622-3ac6-4c4c-bc23-9cb5e09c4f20", "comment": "Malware payload (Mirai)", "value": "469af09e2d4afd925ca5aab5bf05e2df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147256, "uuid": "3d93893d-ce23-437c-8c54-9c37d348f868", "comment": "Malware payload (Mirai)", "value": "ec4fafaa08282fe0b90e953cdf682e6d2652b3c18a1a1cce309678ee5468602e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147256, "uuid": "656e7146-e35a-4857-9c7c-5fa1c462bbc1", "comment": "Malware payload (Mirai)", "value": "4865eac2c943e391a1523490ad7a7f5966e3d4ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147256, "uuid": "3059ef94-aac8-4e90-ba41-06198001c590", "comment": "Malware payload (Mirai)", "value": "02e06f1dc245a0fbfe641426307e1a62cfef00ead569b5cf918836fd559ee23398b5565e1bc33062369f3e5ffe713e28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147256, "uuid": "dc5316c1-8270-4d15-bd73-2e8c74edc6d7", "value": "T1DB147120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147256, "uuid": "04344448-a8e0-4967-9f84-4c3d0d13b01c", "value": "3072:IcHZcggt1NJmeDQBwnKUDMaVsb3pjr1lCRJUKG:IcY5JpMByVs9jSAf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147256, "uuid": "bc259d1e-541b-44f2-9855-b0e3809337bd", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147256, "uuid": "6018b284-d01e-4343-9770-aa2b14a4b82b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147256, "uuid": "3ae425cf-26b4-492e-a610-5f63e29e6c0a", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482a932f-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128706, "uuid": "91524204-30ff-427a-839b-869b475f83ab", "comment": "Malware payload (Mirai)", "value": "8f2e27d9e94b34b54f33f5c88a777e05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128706, "uuid": "ffe71785-2a80-47e2-b4c6-b55dffa611ab", "comment": "Malware payload (Mirai)", "value": "ece6df69d008d30f04e79e138e92a754cb0a26c581a8e11e081403d5d94a1ceb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128706, "uuid": "c690e8c2-40d2-4f3c-b953-d38ed91b3fa4", "comment": "Malware payload (Mirai)", "value": "0edd907ad2ce1b6dd0b59a03994acbd09f0686f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128706, "uuid": "e99834e5-cdbf-4989-a11d-60af2589c09f", "comment": "Malware payload (Mirai)", "value": "2561b555077be456718a93df245df479563bcfde5581cb387176706def2e84c20bcf33592bccae151f037bde843e83af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128706, "uuid": "e30ab38d-8d89-4367-b053-562f6e2dcd36", "value": "T1F2E3B71A9F910EFBDC6FDD3302A9060635CC954722A43B763674D528F64AA4F4AE3C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128706, "uuid": "27df7df7-2d1c-4d1a-8df2-0faeda7bb802", "value": "3072:7xjJw1Cc/0s6YAPwenUr48pzfR+JonKy:7xlw1xAop0YfRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128706, "uuid": "e4bae33d-f8b0-48d9-a290-e5b8e2de58c0", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128706, "uuid": "47f71ef9-d333-4e5e-974a-a652884ee703", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128706, "uuid": "a764ac22-5007-49ff-b67b-44f1067f7fe1", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e03d6ef8-408b-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1777110493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110493, "uuid": "0e3bb1f8-a35b-4e97-90c9-42b5f3d284f9", "comment": "Malware payload (CoinMiner)", "value": "63ea169119cb38247c71ebbf84d8fd37", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110493, "uuid": "231fae6b-6d30-434a-8130-8e3105aa09f8", "comment": "Malware payload (CoinMiner)", "value": "ed33fce6b1ea7732567eb674aaff983bdc2eac7da8f541b81963d37f0559e36c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110493, "uuid": "e4be79f2-e20a-4b37-9209-3bd4d0fd5b06", "comment": "Malware payload (CoinMiner)", "value": "2387ff8ffb44c4e50a9132b72045a9814168887f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110493, "uuid": "1bc469ee-3960-4f9f-9bee-d31ebb4db73c", "comment": "Malware payload (CoinMiner)", "value": "15b1b7584eda3f47333e321855af4ebf898ce792ef9f4a80193b7d35d7b454d50cabe04790cdd4e83fd0f381c111a144", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110493, "uuid": "17ccfe5f-f3da-41e1-b47f-54d7990ba8cb", "value": "T11FA633769BD0AF3F6F3400FFD46773D4A9819B9001786F6750AD284B8A05A78A9025FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110493, "uuid": "dfed8915-8548-4ffe-8417-68a234d7dc76", "value": "196608:rOyotIgn/V/W6LCbpZVhvV1CICT36GjeOCJTVESymQxC3jE5Fve:rHg/tW7VhvyVeOATVE/m33mFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777110493, "uuid": "82b1fb3f-6980-4759-90fe-508cdb00d3dd", "value": 9663988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777110493, "uuid": "f06602db-75d2-4dac-8338-f643a5492f96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110493, "uuid": "009be43b-c61c-4850-a723-974c59c5ad65", "value": "vc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c26ae9-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128598, "uuid": "2702a9d3-4e1e-4fb8-8422-07d7ffe2b116", "comment": "Malware payload (Mirai)", "value": "5b5995bcc6a946671b3af470f4f0bdcc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128598, "uuid": "b294ed02-18b9-492a-ab48-4d7f59d4cea8", "comment": "Malware payload (Mirai)", "value": "ed9ea29875585d8f9cf9fcaab75c24fc562e743e13d5fca2143cc5b32e7326e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128598, "uuid": "30d40132-64eb-4062-af48-463cd1cb250d", "comment": "Malware payload (Mirai)", "value": "20f1c71c3a8a3f96eeb65cb7f1c9c250fa4dcf1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128598, "uuid": "178eaef8-9717-41f1-bbb8-08103d5cc645", "comment": "Malware payload (Mirai)", "value": "47c5b56f8208049711d8b271daab8bfd5e7c494611d0d8f1978bd81182d65904ac3936aadebd44020f1fe97f94ed0a4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128598, "uuid": "5bda2514-16a7-4df7-871e-21c25018556e", "value": "T1A923F1E345F6E2F9C8FB047B0F2DF058961E704662136F8A68E07668583B545BF3C692", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128598, "uuid": "ec4d5665-55d5-42e1-bb66-0b5134e7cd44", "value": "768:/COnDnkX5/dfSgvtVtWGPwF8ooZoEmgHh8oKrKhTy1iDjDwpFA9D7jsDw4/:/HnjkX5NHvVzhooyEHpoiDWiD2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128598, "uuid": "cc2c74ea-72f4-48c5-97eb-07b76526c7f3", "value": 47776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128598, "uuid": "0a32f069-8f47-48b2-aafb-5c33a029a827", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128598, "uuid": "bc84b1f7-4b35-447c-a548-2b372327d4fa", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dd88bb6-4064-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777093604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777093604, "uuid": "31ec8e17-6e96-464b-9864-c30be08d7f63", "comment": "Malware payload", "value": "8e76d1e9293c0684810c8aa84201d5f7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777093604, "uuid": "6e420d35-ca1d-43b2-9966-1f6dc9748670", "comment": "Malware payload", "value": "eeda055330d668b20a44284ba525c15eee43e97bf576c80b6b8d42aecfd9e88f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777093604, "uuid": "dff6ba5f-d316-4a72-9256-d630a8609b77", "comment": "Malware payload", "value": "88bb69ad97a0740f6e732a595d4a3bb02362f33e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777093604, "uuid": "596ebdd0-e8f5-4b70-885a-9b01e4ba7095", "comment": "Malware payload", "value": "fbdaf0de960d1349cce000d2185690fd63bbfefa2b24195a3457060f76f12cc8ef7c5f84ff202190cc58d8a2539388d9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777093604, "uuid": "4d4806bf-cf10-4a18-8bca-0c49897861df", "value": "T1D0138D6966857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C19ADCD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777093604, "uuid": "c98785d7-bc84-4749-ba6d-94da7338b434", "value": "768:bs+i9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bs+ncy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777093604, "uuid": "12922b8b-32a5-406d-901f-973ed147be92", "value": 45523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777093604, "uuid": "b098f9c2-a793-4aae-a483-7ce54e037983", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777093604, "uuid": "ad080177-3786-4b0a-bc5c-c2a814de25aa", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2ea85f8-4085-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777107893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777107893, "uuid": "d881d0a5-1a7d-44ac-8cb4-7ca3c8fffb60", "comment": "Malware payload", "value": "9622e73b17723c2c57ad449917da8026", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777107893, "uuid": "8e4bd732-aaa1-4f45-beb7-c872ba17d385", "comment": "Malware payload", "value": "ef2398c728437ae49cb215e59859f10625e9acadf18356b2185d75bc60a3e30f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777107893, "uuid": "52f1af94-a3c0-465c-93c3-01398a6f99c7", "comment": "Malware payload", "value": "9e972ee12271758d64b15df7f80e84c8ada63818", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777107893, "uuid": "9457c863-283b-4226-9ad3-2327269feb7a", "comment": "Malware payload", "value": "f565c1a975f6ce2d63d0588331fc7e8bb44c793da72bfcc4afbc9e698b7a719aa2c6d0ce56b5d9bb04badeea08a646e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777107893, "uuid": "4b8cc59e-71ba-47a3-aa39-c3424a92cd2d", "value": "T102E623DA859562E4E8D30A80774F53CE72D0B25D49ED6C2D3AC71C826B32DAF414AE73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777107893, "uuid": "1ae48620-378f-4d9f-b3fa-03248439bf41", "value": "92514a1a91bbfc86f92768b6d7b51e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777107893, "uuid": "133d2e4b-5687-4c7b-b7ba-ef1b58ce45c0", "value": "393216:FjHxDHDj/9h3Jtv76+R1YCB9HL292jo87c:FjHxLD/v7fYCzHK92j0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777107893, "uuid": "fd54cd5d-60b1-498b-afd2-fc7d528d5c21", "value": 14001568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777107893, "uuid": "e904b819-7b3a-441a-9318-b0ab8e5ff9e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777107893, "uuid": "21b5266b-c0e8-46a3-9fca-a41608017353", "value": "RivalMods.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b7d04df-40bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777131235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131235, "uuid": "99ba7073-735c-4275-bc6b-885d483ed00c", "comment": "Malware payload (Mirai)", "value": "e0ceb524d4041510f5f96a1709eabae9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131235, "uuid": "f366607f-15cb-403a-bddc-fedb9658cb00", "comment": "Malware payload (Mirai)", "value": "ef9edc8f6c2741064e15109552ae7afa70861ae9df91aa6231bb8df11b834fd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131235, "uuid": "9d31262b-6774-45f1-afbc-e7e01b2bd9c2", "comment": "Malware payload (Mirai)", "value": "e1e6ba3acc63e0290fc42c991b5925bb0b024e38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131235, "uuid": "47d48de0-95aa-4f68-bc98-af6a85068bfd", "comment": "Malware payload (Mirai)", "value": "cd49eb2aee83d27aeeefd848c7ffc5391844e00ec71be4e0dbcffe2f717d49d1d6505b8553052cc9d9ff55a962f5922d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131235, "uuid": "dc555852-8c3d-4e78-a416-306d3523fa18", "value": "T146561897BDD24942C4E43A7BA8BE80C473630EB99B9752565D04FE3C3ABE1D90E38354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131235, "uuid": "3d161b2f-dd93-40b7-83f8-23fc71e15603", "value": "49152:3chkyOBGjWi7B+o+QT8PZs0VLXN++wxdJE9ZgNW5E1:jykGjWi7B+tO0UPJEP7E1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777131235, "uuid": "49f01987-3118-4d86-8273-d6a699a48101", "value": 5963938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777131235, "uuid": "4af38845-50a9-4cce-83d5-05995ca12f19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131235, "uuid": "8b372249-99ad-435d-a82a-2df26234c2f8", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e9213cc-405a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777089122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777089122, "uuid": "3866dd8e-72bb-4a52-9ef7-249f928e5ac2", "comment": "Malware payload", "value": "5dbde3740707faeabe8fb8b34fbb59e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777089122, "uuid": "fc822b8b-5f2c-428d-afd9-9cb6bc9f9cef", "comment": "Malware payload", "value": "f1d929206293540f1153d1aac7bc68cb0f9035cfd9d31c262976219275b414da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777089122, "uuid": "520035f6-1af8-4dae-80f0-959de58d46a6", "comment": "Malware payload", "value": "0422894bc1033248f9953227871d85cb28edffbc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777089122, "uuid": "d54858eb-a1a2-4f24-97f2-a5acdabc0998", "comment": "Malware payload", "value": "c643fd03ccb75829d2b444f8cde803ea939ffeea96e76bafefa3c635dcf05449b1d8e10b94b859544457531122d783e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777089122, "uuid": "26c289da-aef1-47c5-b840-8026cb50c5e7", "value": "T1E927CE77914338E9E5A98DB4D01025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777089122, "uuid": "babcf428-213e-42f0-8ff1-5d3c1cc4efc4", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQK:cqYUQuVDt0TZEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777089122, "uuid": "faef10ee-03e8-426e-a4eb-81c57110898d", "value": 21954560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777089122, "uuid": "f1a0725a-7fc1-4ecb-acc9-025b9d4a9564", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777089122, "uuid": "42325790-bd19-4e9b-b62d-5100c7df8574", "value": "f1d929206293540f1153d1aac7bc68cb0f9035cfd9d31c262976219275b414da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ccf587c-40ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777152658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152658, "uuid": "662c0fa8-b5b7-4d4e-a991-da2d79b88235", "comment": "Malware payload", "value": "26d0232a89f9f19ad0111d860ec9ab65", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152658, "uuid": "248f5bad-b724-4cad-8146-1141f222feb1", "comment": "Malware payload", "value": "f21e546d7e9c9c34e117f8450e27ff792acb93fb821a973904faabacafb6cb86", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152658, "uuid": "e113072e-f671-4e1f-835a-0b12f43e8f20", "comment": "Malware payload", "value": "cb273433db0bfbe0fa8a7c3bd0c0ab8c2e29e6c2", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152658, "uuid": "689f8841-853e-4fc3-b0d9-bdb1b1303d0a", "comment": "Malware payload", "value": "706dd835a74b589e0e2cf55e91bf981728cfa7ca8b6b6d8fca0abe1f82ad36eb6f8250e1eea7152436e6b5a7ebc0471f", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152658, "uuid": "66e96bdd-288b-4822-b277-84222cb97b0a", "value": "T197070F3DCEE8423EC2B7C929D9CA4A17F85A091B231CFD4A64D773975527183BCA211E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152658, "uuid": "1aa757e8-90ba-4ea6-b971-4afa8937362b", "value": "3072:8fC8pbP3luExvrprCm9jVaQ01EaKk3zHrDcjWxYt5ZtvcPc5GtOivGN6/DFybCVJ:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777152658, "uuid": "4afbc30e-5eae-4ea8-a028-2e3c52563f5b", "value": 18292892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777152658, "uuid": "03192e1d-c22c-4597-923a-614620c1d933", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152658, "uuid": "b0e65be5-d695-4e3f-a861-74dbc67d23ad", "value": "mbjuf.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3069cfd-40d6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777142602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777142602, "uuid": "e73d71ec-93eb-4e5b-bf3f-105581ae1872", "comment": "Malware payload", "value": "f8b736cd9cc22b416d1948a9218a8328", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777142602, "uuid": "0cf8165f-c1d7-49db-921e-080b1fa90810", "comment": "Malware payload", "value": "f263a5f8637f6c0ad1430c98c3ef9abc4f3d92796ffe6f7cd4b59bd867ecbf72", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777142602, "uuid": "d43d4af7-f767-4c20-b4a6-09eae8e747c3", "comment": "Malware payload", "value": "ef935086fa6612b128c2c27f579e92738b2ef53a", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777142602, "uuid": "e5c7836f-e0dc-4708-b38d-857a475536c8", "comment": "Malware payload", "value": "a0c6aa12aa9d1ba5cb521012ae0c1edf2253b34bbf4f6d78ae21e374d07cfbcd6cc3d3c3c9b70356f94dd1208d232d8b", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777142602, "uuid": "86c35b93-f283-4599-994a-8697fca9fc7a", "value": "T160D3EEC45ACA89B88F1F64B9452F9E078B9D9627051EC8D0BAFDAF443F115B230BD4D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777142602, "uuid": "dc3f6f56-af46-4d22-8e5f-61edff9315fd", "value": "768:0JoTt1b78FjHhus+Q4lKgabKCms9w74pP6S6R6N6a6qnAYN7ETJVIRdj+Kjqt4Hl:3LcNA0+ruRCegKmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777142602, "uuid": "6b763fdd-a97f-4965-8556-9fa925c20f82", "value": 140167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777142602, "uuid": "33e90b85-75cd-4407-9982-922e747e1dae", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777142602, "uuid": "08eb0cd0-f37d-44fc-b271-6305c11b690d", "value": "Finance_Audio_Old_5579.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "370576f7-40e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1777147146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147146, "uuid": "0d6d5348-d8dd-4621-ad22-6d741c8dc5f8", "comment": "Malware payload (Formbook)", "value": "b90c70d74a0bb7b27bfd228eb2c97cf4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147146, "uuid": "4ef41b9d-f156-4d78-be30-b1568af6c324", "comment": "Malware payload (Formbook)", "value": "f2705f7f8bf5e3fb5702745b51a5bda237da0b79d15ad37477f16fa959f8b3e4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147146, "uuid": "830960fd-1d81-42c8-b010-534de1a2c873", "comment": "Malware payload (Formbook)", "value": "832611d89cd097f627c4ab828270818f41cd21b8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147146, "uuid": "37f614a0-4c09-418a-8440-56892be04dc2", "comment": "Malware payload (Formbook)", "value": "ffa5dcebc4e6ac7c3a84bf0d2592c3eb91ad2aaf2a239666ba5b696464fb99cb18a44310d32d2fad2637a279cc6b4fb7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147146, "uuid": "2e0e3086-1c99-47d5-9b3d-9c8509ac9e6a", "value": "T1936533143EE27DB91A98523236077F0C59F70FC44C89F5C95ACC369E061578B8B7AE2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147146, "uuid": "404006f7-f86b-4d88-ae8b-b084287c84b6", "value": "24576:qmiBku2PKtYZUwEHLshlcFyzEKbpmkBgK5w0pN0J7DKhECuryqSabfJHGXPIJDIb:9PfTE8B+EQT58/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147146, "uuid": "563be333-f888-43e7-8a6f-51ff0869a412", "value": 1493287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147146, "uuid": "081c4187-c116-4fec-8660-00ba6512b4be", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147146, "uuid": "3df0d748-83df-4bbc-b95e-42fd79c3ec93", "value": "UWXB8KQL.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8575faa9-40bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777131386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131386, "uuid": "f9b58dfe-3c06-4bac-9215-e032e995bca2", "comment": "Malware payload", "value": "173cc7a647d85146da75e1e285f398f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131386, "uuid": "32c0002c-5df0-4e9e-89f1-7383898e9c45", "comment": "Malware payload", "value": "f4d986f2f3149563dc3b81cff76a2e77a43af83e0aba794e64dcd2b30502d47b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131386, "uuid": "83b2234f-427f-4b67-a29e-bc96403908c6", "comment": "Malware payload", "value": "c64767a674fe3125887237b46ac317586e626bf5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777131386, "uuid": "bd92993d-0426-4d91-973e-0466d0ee92f0", "comment": "Malware payload", "value": "0c11e4773c031feae5af981b3bbb5d0a95d8683a3d0de7505e36000abec59eb61dcc9511a6d9bb7245995069a23f4893", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131386, "uuid": "a891fedd-5deb-4f2e-9f3c-7b04eb0ffd21", "value": "T1E8E4D50A6E729F3CF2A487314BF34B24D7AD62DA13F1C585E29CD1155E2024E592FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131386, "uuid": "77a44128-d4d9-4252-8a79-487ebce1da69", "value": "12288:/zBmL6EAFeR1lubTIRLAjEU/2D3wxI/BfGRFZEX:VmL6EAF0ubTpjEU/2jXAFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777131386, "uuid": "362e7fe8-35c9-4488-bf85-be4374d925f9", "value": 709104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777131386, "uuid": "40a8b214-95ce-40fd-9e92-866fab11533b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777131386, "uuid": "561df928-1f46-474f-a796-2d0f9389900c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67a898b-403a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777075607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777075607, "uuid": "220ad4e9-696f-4c2b-a8b7-62e422ed6b84", "comment": "Malware payload", "value": "6609c9294d96f7870c63b3250041dbe9", "object_relation": "md5", "Tag": [ { "name": "156-239-14-132", "colour": "#AFD88E", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777075607, "uuid": "182b3152-1600-4bc6-8307-1c3f7cbd59e5", "comment": "Malware payload", "value": "f4e83c4dd6045cdf34f4fae0b46a4c87eba75cae148ab6d48a3b5a54506b8f1e", "object_relation": "sha256", "Tag": [ { "name": "156-239-14-132", "colour": "#AFD88E", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777075607, "uuid": "77b65c4b-b72a-42c6-8536-f9329edf9f8a", "comment": "Malware payload", "value": "49ff6674ea84faad12597ba0659e27825dc93095", "object_relation": "sha1", "Tag": [ { "name": "156-239-14-132", "colour": "#AFD88E", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777075607, "uuid": "19ad1c40-56c9-4c7f-875a-c498b4c678d3", "comment": "Malware payload", "value": "2c10ceded0d06fde285b6231e3ec28d4c959419f3b98217423a4696a29e8a380d802e865f463de59d2b9a86bdf0d4bc4", "object_relation": "sha3-384", "Tag": [ { "name": "156-239-14-132", "colour": "#AFD88E", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777075607, "uuid": "d7f3a6d0-ec17-4c01-8522-f7ac153785ce", "value": "T194E35B13B7E615A7D1A3E2BD89530549E7F6B8112321BBAF164082952F273C25E3FF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777075607, "uuid": "6d2e4aa4-887b-4235-8302-8c98bd8e191d", "value": "946b1e7041dbf096a8ea638e9e3d8ca7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777075607, "uuid": "0a4a07ff-ad34-42fb-a4ce-a1f061bc96bf", "value": "1536:og9Zr4JAER3SwC2OI4DnoFzMwe8zGtclz4THhSIhJD7WjoiwOq4sWCdv9dl7X/5C:oRSMQnGa8ploBnDDKciwhPN/5gRjyX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777075607, "uuid": "10e11430-8d2f-4f29-8eea-c5315229b40d", "value": 154624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777075607, "uuid": "7fca8ad3-182e-4353-8a15-7833288164eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777075607, "uuid": "7de2fe5e-9e22-469d-b5a8-2ae11f46bda7", "value": "parfait.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "792aa122-408b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777110320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110320, "uuid": "ef7d314f-3750-4d3c-aaf9-cfdc7f908062", "comment": "Malware payload", "value": "b60e0e2e17a98cd8315a11daac815005", "object_relation": "md5", "Tag": [ { "name": "185-107-74-215", "colour": "#13E1AE", "exportable": true, "hide_tag": false }, { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "bksju-com", "colour": "#DDD9E4", "exportable": true, "hide_tag": false }, { "name": "bksnb-com", "colour": "#0FE618", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110320, "uuid": "d21e1965-c1b8-429a-b06a-a6ade19d7e57", "comment": "Malware payload", "value": "f678e909972aa6e57156b7543bed6e10438621a76b738d20f58a79e3455b6c17", "object_relation": "sha256", "Tag": [ { "name": "185-107-74-215", "colour": "#13E1AE", "exportable": true, "hide_tag": false }, { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "bksju-com", "colour": "#DDD9E4", "exportable": true, "hide_tag": false }, { "name": "bksnb-com", "colour": "#0FE618", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110320, "uuid": "37aa08c2-94b6-49ca-bd46-328bc03f09fd", "comment": "Malware payload", "value": "522a871caff042bcd63374d8c606da8cb9f27097", "object_relation": "sha1", "Tag": [ { "name": "185-107-74-215", "colour": "#13E1AE", "exportable": true, "hide_tag": false }, { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "bksju-com", "colour": "#DDD9E4", "exportable": true, "hide_tag": false }, { "name": "bksnb-com", "colour": "#0FE618", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110320, "uuid": "6b5a266f-6589-4b76-a193-2b9ad2c67e2f", "comment": "Malware payload", "value": "68204da289477ca981a1367894d6168bab8235d7f1aa041a8bb3c1d2a97e69a957dcfbab7e57ccf9b9f629d59443207f", "object_relation": "sha3-384", "Tag": [ { "name": "185-107-74-215", "colour": "#13E1AE", "exportable": true, "hide_tag": false }, { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "bksju-com", "colour": "#DDD9E4", "exportable": true, "hide_tag": false }, { "name": "bksnb-com", "colour": "#0FE618", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110320, "uuid": "81c6bce8-eac3-4376-b487-a634cff4b257", "value": "T1AFB294A39AB70105B817C0A96BA39B4633358003964BCD797FEC219CDF85AD56D7378C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110320, "uuid": "c1ee0f66-d03a-4608-b147-d2918d065dad", "value": "768:KC8sXy7FUF/zS4ort6FF/FxDFZFQJT8uFjmFtvFTFeF/XFxQ:v8sXyWM4sed/Dfm8uJmDvhcFXfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777110320, "uuid": "60007af0-aee7-47c9-845e-9794b6fd4e6d", "value": 25230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777110320, "uuid": "d455fda3-615b-43ea-82bf-c5cafbced3fe", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110320, "uuid": "820a5ffc-7bb1-4914-aa59-cfde11549d06", "value": "f678e909972aa6e57156b7543bed6e10438621a76b738d20f58a79e3455b6c17.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "331dc541-4045-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777080137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080137, "uuid": "1ff91413-b2a2-47de-aa86-7333695d972e", "comment": "Malware payload", "value": "a7fce5a5fba08f721712adb26bc4553d", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080137, "uuid": "7015208c-2b1e-4237-bcc2-aca7915a99bd", "comment": "Malware payload", "value": "f875444b519bce683ab8e1d4725713a47c07a126aa420db8fc360c9652259cac", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080137, "uuid": "47bb1b9c-d0b7-4891-98f4-df6da80d65bd", "comment": "Malware payload", "value": "3302da86f9a40311bb3a7ca1d28c1560d5a6ba5b", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080137, "uuid": "77c87887-6edf-41ec-8721-053a0de5cf91", "comment": "Malware payload", "value": "73b2b8967b0ebb1a17292a88ecca2bb8a6b3b53a5337049a9a47b76adf98388da5383e3f37cf391dde62795adf6b2b6a", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777080137, "uuid": "90bd0006-6ebb-49b5-9121-2895d4a3e52f", "value": "T15731495066F99608B2B35D04EAFF65528C3B7B7E9D7ACA0D0050D14E17A1A44CDBBF32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777080137, "uuid": "aaad1616-50cd-4e54-86d7-ed08a6ee2727", "value": "48:pAlbx5Qh2QaAAU0rXtrVJR/RpreSkde4OggzAM5MxzQw:pQbfQh2QadUwz3Sve4mzExkw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777080137, "uuid": "a278b2c5-8b77-432c-83c1-18cf13c63946", "value": 1650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777080137, "uuid": "af62df1a-3a0e-429b-b274-536b51d34f69", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777080137, "uuid": "fda11939-b485-44d9-929d-0303c4c2db69", "value": "smpqx_01.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df00e4c4-40a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777120799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120799, "uuid": "447300b7-33eb-4efd-9bfb-90e44b2d0504", "comment": "Malware payload", "value": "a3340ef229fab5806f9860fd2750585c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120799, "uuid": "dea8f6aa-5eb4-4ba4-8a66-7896bdc41fdc", "comment": "Malware payload", "value": "f8a41e5a74264f5f008bed763c43645e8d7d54ec215daec47f13fbfb7355c1fd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120799, "uuid": "dd870044-28f0-4c07-a0cf-5f8ed596a136", "comment": "Malware payload", "value": "25b441e6b9e31d695b93b8d3923478b2e4f36c73", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777120799, "uuid": "38937cc4-924b-46c6-b23c-fdfaf29f9ac3", "comment": "Malware payload", "value": "3be65ef035a6f24f2d73695aecece20040c3cf3e1849e7b9016ba56dcf0a845a8ee40014d6f85bd1d8e61d65f8a47f6b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120799, "uuid": "277df0d9-21ed-422e-858c-a6474a499c4e", "value": "T14F21FCC236550C70298C88A89E822D49E903271785A0A95EB88EA23C3F7CD6073B479E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120799, "uuid": "46f12b47-594c-41e9-8678-8d9dace76bb3", "value": "24:yeWGyNoQirFNSiBXv24FrIV+d/OP1T/yoqwtjQSMPY1yA:XxyNnCNSiBf1dIV+d/OPtTcS51T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777120799, "uuid": "f6db3758-6df3-43af-8692-3b460d2f166a", "value": 1157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777120799, "uuid": "7dd6920c-1d38-4d1e-b35a-27fae1491fd5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777120799, "uuid": "ea0bce1e-3804-465e-85c4-06d21010a301", "value": "loader.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35aa0387-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777128675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128675, "uuid": "5c3aca3c-5f70-4296-ad64-c187c944cae0", "comment": "Malware payload (Mirai)", "value": "66d7a191e0e609c1200d501ddea8a000", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128675, "uuid": "3cf04435-dbab-4cd8-8aae-343ed48eff8b", "comment": "Malware payload (Mirai)", "value": "f9146c2abb3c36e52a1968879af71dfc1793f508159cbc72a830205d39d46918", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128675, "uuid": "70d2d39e-4f5b-4361-978f-dfacf27ac21f", "comment": "Malware payload (Mirai)", "value": "71fba20dd7ba27189cbe6692cd3e04de30b5c3ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128675, "uuid": "101d8c08-547b-49e8-9b99-d15baf4b9f69", "comment": "Malware payload (Mirai)", "value": "93dbc4bb1ef33d84ad8f5c5fa2c0b850a19ec93d61549863023ccc949f175b279e5021a4aff397da7ce6b6c350e84ba0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128675, "uuid": "c858e233-1f40-46d5-80eb-caebd23426f1", "value": "T166D3F8C7F900D9FAFC0AE7374853080AB230BBA545925A372257357FED7A1990477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128675, "uuid": "3c79763e-d205-4fdf-b837-297b4377955e", "value": "3072:/Nbul4MGHJLqHy5Fut5K/cwpifdDounVoQV1jbiGLD3rQtJ:qHy5ct8/cyiWuVosLDgJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128675, "uuid": "2bc0e5ff-ade4-4164-af21-8aa3127f2961", "value": 140064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128675, "uuid": "33170c0b-e691-4421-b55a-5a0bf5346c5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128675, "uuid": "cd257280-4852-4a3b-a777-0575df925280", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d42b4347-40ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777139249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777139249, "uuid": "e7d8bdf8-7e97-4e1b-b96f-e3d5a06b0473", "comment": "Malware payload", "value": "cccbd69b70bfa272e7d3e0238dd25476", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777139249, "uuid": "ea4e0127-1f5e-4d8c-bb76-ad9a2c043da6", "comment": "Malware payload", "value": "fa6d12025fb2eee6cd0b9da681188ea01777ec88acf037ec78fd1cbb871d8ecb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777139249, "uuid": "f34d570e-defd-4663-a52a-06c3b8812b90", "comment": "Malware payload", "value": "2c0921ea1369bcaf4e1428140a7ba2420e4825d6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777139249, "uuid": "44b6eb26-61ae-42d0-b39d-cc8043c6241a", "comment": "Malware payload", "value": "7977cf110cf340edfc8e74d0136a4ced90a48af45e03eab04ae83bf3cded60ef7eace95f5fbb5f2c00c56237a61e4d37", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777139249, "uuid": "60f4156e-0526-45f5-9f22-4b5880bc7c8c", "value": "T115D3B338BFB7413D62258892B9D5014BE82E739B720E6F46448783E12F53A5DFC69C1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777139249, "uuid": "3eeb2ecf-c433-4699-8a0b-e43a3033852c", "value": "768:7Yb/lNMAMmbgbBvYERxQvwKBMCDP834qJUKgARIcEhSVrmJR0Y11IQEQS/Uf1eNw:cbXiVu04pVKrmzOU4dbxexR+W/KJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777139249, "uuid": "8a1d0581-be23-4399-b9ea-c10d9725b531", "value": 137780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777139249, "uuid": "1619fa0c-41fa-4ed2-a613-ed35900a4e5f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777139249, "uuid": "7c69206b-81a2-49bf-9a2e-a9da32ad1adb", "value": "ActivationClient.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a06fca-40ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777130331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130331, "uuid": "00ae8350-320c-426f-a5dd-9e9dbe353465", "comment": "Malware payload (Mirai)", "value": "ccd1110677848fc5f381ea4cbfd63fbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130331, "uuid": "81c1bf6c-d3f4-4436-a476-353cbca5c4d7", "comment": "Malware payload (Mirai)", "value": "fa6eda47d9577b6641f1605dd40bb680e4412f488571d1b0b346ea1c5e6f9f6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130331, "uuid": "6ab593a5-a082-46b7-8aed-9397caf3295b", "comment": "Malware payload (Mirai)", "value": "79875329821ad4da7da6332a86427b848d708124", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130331, "uuid": "c3227c9c-29e2-4e2a-b4fa-50b7769f05b3", "comment": "Malware payload (Mirai)", "value": "d9d1a38fd20d778be6dbb56edb6223b183307049e13734a0327651fa55a885e8842a8259acad7ab1e519ff13cd47a2d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130331, "uuid": "543754a6-eb3f-42ec-84e8-eb709c6b3327", "value": "T14624B61A3A22EFFFF568863007F38A7097E5259636A19745F26CD71C1F2028D681F7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130331, "uuid": "0882454d-24e7-43a5-840c-b4e7170e44bf", "value": "3072:xhNA0o20YPukHbCRfnRHRQzzThdxAmoz9nzBsNcPUTkFizT:x/PH0fn98PhrAmoz9nzBsNcPUTkFizT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777130331, "uuid": "53fae294-5237-4d52-a6f7-49bc1f450ff3", "value": 227640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777130331, "uuid": "0810683b-2b38-4cdd-8506-9c9b49c62851", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130331, "uuid": "f3797c88-f767-4e50-86e8-f8e866724400", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d69ab00-40b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777128634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128634, "uuid": "c2b9f0cd-3e58-44aa-b029-ab8b16b6f51a", "comment": "Malware payload", "value": "8ad0a9aa218367738d0c0c6b45097464", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128634, "uuid": "5ac2bdb7-3c85-4b76-a9f5-c8d3d01b4eba", "comment": "Malware payload", "value": "fae0a3c4bc39ea8aadd96f9ecfe7d0eea54970d0df4520825673a52450fd5e75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128634, "uuid": "3204fb57-a9d1-4f4e-a50d-2e46c0877813", "comment": "Malware payload", "value": "90c6e1f4c1d8afe2b2a0c366532dfc68e17d52e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777128634, "uuid": "8efcf6a1-f649-489b-b689-406f8cecb579", "comment": "Malware payload", "value": "1aa5acd19f9a5c631a7aa283f50e92b3adc6a90a246c662f1163edd1c6f29bd4d6d89f24757ed9b083f28c10ddd6f91d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128634, "uuid": "330b27db-a167-477e-b469-29db0833c163", "value": "T191B2E025414FFE7492B01E33FBFDC313AA9E83A9D278A119387455B47AD1D8A10BC366", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128634, "uuid": "0d930c34-5a17-4dfc-bd1b-f97bc5c1035a", "value": "768:+N8TgPBilGVePumSt9H9Ul9bD+xs3UozW:XeMPudr9Ul92czW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777128634, "uuid": "d9b67e19-323d-46c3-8757-977085bf0b7d", "value": 24895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777128634, "uuid": "d8809967-705f-45dc-a9c2-b5fb455b8d91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777128634, "uuid": "c8b82c14-ae81-4112-aeba-d5438e533429", "value": "f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "168232b4-40ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777130341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130341, "uuid": "d2f02d04-7712-4ef8-b7b5-2f04ce2846bb", "comment": "Malware payload (Mirai)", "value": "e37e54372888f3e320263b031ee634b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130341, "uuid": "9424eb8d-00ce-4cfc-83da-e1b9b2f68434", "comment": "Malware payload (Mirai)", "value": "fafc4769d3f812ff8d7384cd729378381058469674f7e614834b6c6f1a05275a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130341, "uuid": "d231df33-09f6-4a54-813e-e916768d6453", "comment": "Malware payload (Mirai)", "value": "6121c5db2339e4b2f4273091538a04bafa7affb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777130341, "uuid": "d64e203d-7595-4d17-9c51-641918f3ee1b", "comment": "Malware payload (Mirai)", "value": "16f4147f08696b1869397b09530f13d7af009133ad3f7f094369eb1c49194f8956f0a94617ee9fb572a9b1d88eca5a9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130341, "uuid": "dec714bf-e7f9-4f41-87b3-260905c279a5", "value": "T18BF47D9BFE6E3C47D2D6E33D9B8A83B1632B7590D21341527642432CD9C6ADCCFA1A50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130341, "uuid": "ee5df0a4-a0e3-4623-8f40-f0d8bb1a9255", "value": "12288:VE71XtHjWKCCxdqKB/pgLl65IXRETcs5pVB+3cjgTVoVg4:VEHlxdqK12x6dEYg5oVg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777130341, "uuid": "fd724eba-2972-458d-b96c-5805aa8a567c", "value": 750320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777130341, "uuid": "4b14bfce-f9a3-46e2-8e90-14e66b27731e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777130341, "uuid": "2fd591ea-281c-4a14-a75e-f67647080d2d", "value": "bot.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb6af45-40ed-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777152608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152608, "uuid": "a8e09797-0973-4e73-9fdd-9df4695c02fb", "comment": "Malware payload", "value": "c9727dfa2194593cfdf16fc141e50bb9", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152608, "uuid": "ce092034-0ffb-4147-b200-bdf4d794d661", "comment": "Malware payload", "value": "fb1014e6aed7d7d17d8fb0bbbd7f4cea944c045d3215aedcffa80304a56ed20e", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152608, "uuid": "393e88c0-f9e5-4e4a-bfb4-44797dd73ff2", "comment": "Malware payload", "value": "c3a6fec75408f8ddec4af71b539cfafb09295c03", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777152608, "uuid": "3ba42ec2-4ccf-4443-be59-96616d11144b", "comment": "Malware payload", "value": "1ce869928223149499b60738fb237e61e194ed342aae34accbaebf0cfe81a4765d0b6a4c4a226888ea96a0e27296f360", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152608, "uuid": "7943acfb-a99a-41c9-b4da-f84c1f0efb69", "value": "T124C1561057F99608B6B36F05AABFA451493B7A6D9E3ADB4C0088C04D17F2A40DCA7F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152608, "uuid": "54a7b5cc-9c9c-42af-800d-31c75262ed9f", "value": "96:pZyEBs5sZ5YBfOOFlkTFwpODBkhsZ5SNHAHXvEllycT4SPRpdH6yHAIBADAKQ4QH:pZye2fJIqpcBRvE/ynEpRBehFjlfcm41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777152608, "uuid": "99a29b2c-c257-4909-aa14-739d197fe633", "value": 6034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777152608, "uuid": "c9315a75-b4bc-4a26-b57a-321e440f7597", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777152608, "uuid": "e3a79400-bf01-41c2-8208-eddb96ac507c", "value": "kchnx.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5908cc4c-4075-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777100817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777100817, "uuid": "c4222247-5f51-4cb0-ae03-29af7ac1964b", "comment": "Malware payload", "value": "2c8ddb20ac9cb8fbbcbec3ef81b3efd8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777100817, "uuid": "c164c81f-a637-4a5b-8332-6a0c9e9934df", "comment": "Malware payload", "value": "fc49196a541d193c9df666a8d4031da34d40752edc18503ac0adfd70044d3c5f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777100817, "uuid": "88464217-6ab9-4cfd-889a-8f21f7d4a303", "comment": "Malware payload", "value": "cbd3bfc19e079abb5cfe41b6ae6498ca41e709b6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777100817, "uuid": "54a4251b-eb64-45cf-b6f8-cc9175d9f2d9", "comment": "Malware payload", "value": "6153a0b4454199b3fad56d984cefad50ebfe9a9382a2abc365cd21245bf3f413e6a43440fabe1453221ec6b6e5653734", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777100817, "uuid": "d885e15d-ce15-4104-8c4e-9541e2af7378", "value": "T1181178D271A226B1B19FD03C225820C7AC6345F7C249FD24F0016F9D4E9F405795BD90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777100817, "uuid": "ed69a78c-5308-4b66-83cd-5bb01d188b8c", "value": "24:tRN25OdOuzzpqezVzgdTjDQTcBGmQxDhaNwpTQL4HmX:tbnOuzzpqGVzOTPvGmgDhcwpTXmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777100817, "uuid": "dce3166e-cc80-4003-9e1c-49a46c9976e8", "value": 967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777100817, "uuid": "e0068df2-245f-4b1a-9ae9-7c228d5692c3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777100817, "uuid": "11433b05-69b5-4c76-a166-ceb740a09e28", "value": "fc49196a541d193c9df666a8d4031da34d40752edc18503ac0adfd70044d3c5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6e5339-4082-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777106351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777106351, "uuid": "cbf728ee-9279-480b-ba5c-89fb4af450e9", "comment": "Malware payload", "value": "06195ed1e4ce5d1498c40d10beda332b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777106351, "uuid": "94970ec1-0936-4881-a373-496da40429a6", "comment": "Malware payload", "value": "fc528a935a59c424aa5c6e1b11324dada456af06d0bb2ef0333057346af40b83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777106351, "uuid": "fa33dc4a-6d34-49d9-b42d-e7ef505045f9", "comment": "Malware payload", "value": "d257de33561e1183db81f968ebe7b4fbd7e1a752", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777106351, "uuid": "a73561ca-a9b1-4cd4-8b53-e07a53aa4d77", "comment": "Malware payload", "value": "21faaf0dd904a6a26d04f02bc05c45d75d45f25dc430e38548e98bdad7909d2913c19aeca1d85e4b385005b509bb743f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777106351, "uuid": "38c94dd0-9e03-4174-8e05-23244e9bdaf6", "value": "T1EF85B054BBE92CDCCA447AF14706CACB0079597A4F1199A069BC0CEFFCB52C19DF2A49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777106351, "uuid": "ff68924f-e10c-4eab-b374-61109544710c", "value": "4a66de3e8d132708eb41ffa0ee63c649", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777106351, "uuid": "8c892992-5938-417a-90bd-4577c852bab7", "value": "24576:xFfD1z8oBkBXgyZpWiV6BZQSyXUhFDuIvFmGYxPGGkiF3qBI1SW3:4g78Slf93itl1B3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777106351, "uuid": "4832825d-afe2-4676-bbf6-767a7c6aefc3", "value": 1804320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777106351, "uuid": "b4dff3ad-e7c0-4be5-b1ed-a1f4753e9367", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777106351, "uuid": "583077cc-dfe9-46a6-a5b9-a062f8ee7f59", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30772e6a-4045-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777080133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080133, "uuid": "2f28123c-7f3c-48f8-a90b-64bb040d3134", "comment": "Malware payload", "value": "2ba1969c21464af7fb05187106302fa7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080133, "uuid": "4c7762e9-a3fa-4af0-b6c5-940faa78cb16", "comment": "Malware payload", "value": "fcab45add5c8a09571fdb0feba974488d5316254b6875e643866366e2212d832", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080133, "uuid": "4737a48a-5a3b-40fb-803c-30c3666354d4", "comment": "Malware payload", "value": "9eb11f7f1d869e1f64c3c5bcb503c4fee6447b10", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777080133, "uuid": "870e6839-fc52-46fb-9cc5-496c3cbb112a", "comment": "Malware payload", "value": "1b3c4db806b5061246d38c797119a62ddb6e9e37a6ca77b06719857d1d81eeb71b4e3f9dbf2b19f8e934042dc3d75a74", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777080133, "uuid": "cc23e6f2-17c5-41b9-8c16-6922ebc0539f", "value": "T150744326ED875CA383D3DB63D2E3D31CBEA554EC910B5EC4B5B8C2825861D6A0789F1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777080133, "uuid": "8e16caf0-f22d-4e96-9e08-82914a21798f", "value": "1536:D6EGYhvemD6bevcg1AexJOsRFMFGHY/QEW:2Etvei6bevcgiePOsRFMFGH4QEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777080133, "uuid": "1733725f-650f-48d5-b1f8-4ceaf3b7b05a", "value": 348888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777080133, "uuid": "cfdba003-bf6f-4abc-8f9b-99a78be4124f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777080133, "uuid": "8aec66b6-6c2d-49a0-8e87-8d4035294a6c", "value": "telegram.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d89c6534-408b-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1777110480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110480, "uuid": "795906be-6d7a-4f0d-b1e8-eaf900fda745", "comment": "Malware payload (CoinMiner)", "value": "6005086f0213db0179b57c1c21763362", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110480, "uuid": "20788922-3415-477e-9420-8ebb22106f89", "comment": "Malware payload (CoinMiner)", "value": "fdb14707de0539a58c200f31ae6dbd43d34465d10c8ea60e332dfc122c4cd635", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110480, "uuid": "88b6d403-111b-4ec1-9f06-6d30cb98229a", "comment": "Malware payload (CoinMiner)", "value": "d680362da65a6e1dd803f3eef2c7716680703d3b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777110480, "uuid": "41e32c28-bf6a-4eda-8357-ab1a1786db37", "comment": "Malware payload (CoinMiner)", "value": "f6e15f35029322e81c9bd68dc737c599137794bf4e354169fdb2f997aae9aaa612927e7cb5de632002f59b8d59504e74", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110480, "uuid": "99d35b6b-101a-4e3e-bfe5-8ec81ad3fe5e", "value": "T187E0F1520C8726703B5518828744112C84017EEBC3E43C91F20E37B65CDCB15B312BCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110480, "uuid": "7118ec84-3904-47f2-848a-9ed2b41bcf0d", "value": "6:4bMv+KEVdg6jwtHod40WqdSjrZ31xKtNZGaa+ZjNFf5IDu3FFA54IFtRRAuWNIAp:2KE7wWdyqdSjrZ3ECYjX1Fu4IFjuWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777110480, "uuid": "2089558d-da19-4209-8feb-38252cf8e726", "value": 389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777110480, "uuid": "25b624f2-b0bb-4ab1-836e-4f2f6f80dc97", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777110480, "uuid": "9796c96d-2071-4543-a609-e887f3fcde29", "value": "i.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee7f3f77-40e0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777147024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147024, "uuid": "bb5b4485-df2e-4400-9054-29c5d9b6cebc", "comment": "Malware payload", "value": "fc867b671e76ef2ac9c6fc0254512b24", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147024, "uuid": "941f4083-4c26-45eb-ad97-6c3e9f4c9162", "comment": "Malware payload", "value": "fdde7fa1dde042ba96b0b5fa15c730c00f3d4b388d446e8bfcf1052541d61e15", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147024, "uuid": "3f6a246f-8572-4448-8454-9872bc97d0d2", "comment": "Malware payload", "value": "68f597b9cdea2bd17c9d2a3ec2f7f7fa4959bda1", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777147024, "uuid": "130df1f3-b39f-4178-af0f-218a218efef5", "comment": "Malware payload", "value": "f17f6d0e7c5520a9fa96220bdd002ab97a4d606c70e4486d194b0e0038ddb303a844d0f8243611fbacacf9e7c850d00e", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147024, "uuid": "f3cb7e91-fcf8-446b-a7f2-c90ac669fb3a", "value": "T13E653324DDDA3975536CF3A101366FDF5EB28B919815D28B4BE6285B036BB09C2F780C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147024, "uuid": "c42bf97c-a229-4420-af42-b9cede536a9f", "value": "24576:vIU+WJxI4CmK5f+xdgzgDQFooyLFH/WKx2ehZyoYAF1waNCdy:UBtq8/y1/WGgezp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777147024, "uuid": "e18dc6bb-04b7-44a1-a91a-9fa2ed60b3a4", "value": 1536567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777147024, "uuid": "e5f02606-8d2a-4bae-889f-8ab431d634b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777147024, "uuid": "988b2668-3acc-4920-8ac8-d3eff006178b", "value": "ps_8vqxeUDRhcrJ_1776330226089.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce021127-4082-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1777106597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777106597, "uuid": "bec8a28f-306f-4e0c-8429-cc4ccbfa723e", "comment": "Malware payload (Vidar)", "value": "3432ef7208fcf8c749de9b292a995b95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777106597, "uuid": "112479f6-e592-4973-87f8-ba384135f8fe", "comment": "Malware payload (Vidar)", "value": "fe4cdb7e9b8b4aa7c8abf39dc27f585360edb40af7bc2aa70bb453da56d22975", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777106597, "uuid": "bd39967f-1f05-40ec-ba90-b3bf6c922a63", "comment": "Malware payload (Vidar)", "value": "acf232b8574d917477c4a83cd1947a591d8ccb12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777106597, "uuid": "cafc00d4-4fb1-4657-9596-185f92770d82", "comment": "Malware payload (Vidar)", "value": "3e23f7fc1c6e5c63a772544d0a7bd53447fe9eba6d7ac9adbe134340b704c756410d27003bbaa0fdcc08c3672b0b5cdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777106597, "uuid": "091d1343-08de-4fda-8291-c47176ee3309", "value": "T1B9358E3ABF9F49EED82CF27D4042E093DEE05A2C629845DE5BE0311BDC79DB21978146", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777106597, "uuid": "9009e0a5-ad84-48b2-b76c-a3496be4568a", "value": "9b41fbb4f681bd50e69d6f0a1ba2802c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777106597, "uuid": "bfc12958-1fe3-4ed6-8d8d-3169d429e1d3", "value": "24576:ZBF357s5jcukbOEsel7REJ3dchXgs+mmot2+NG4759oi1HwYoxBFEdzyZQaWBfUw:lN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777106597, "uuid": "f73ea1b0-bbd1-489a-b846-3aaf929bbfea", "value": 1103360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777106597, "uuid": "6788f8fc-6034-4103-b0d8-76c891d3cf88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777106597, "uuid": "7e43092c-e652-4fdd-80d4-a56e9d29084c", "value": "cmutil.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a1d0363-4072-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777099450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777099450, "uuid": "705b5d19-d6f6-4066-acfc-75fb60d7f051", "comment": "Malware payload (Mirai)", "value": "b48ffaae6f0e9ecd84be83adea17c576", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777099450, "uuid": "9391f435-41b3-4178-9d3e-842e2091b440", "comment": "Malware payload (Mirai)", "value": "ff0df55891a794ea9dae7bdd1ce6933d62515992159d00f5d98df07f10a4fa96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777099450, "uuid": "78c652b0-d77b-4a76-945a-7ea47821c6ef", "comment": "Malware payload (Mirai)", "value": "f0a24cf6b05694128208b239fc262f79ea4e990b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777099450, "uuid": "87390a9d-cd77-4eac-8fcd-30b8fabaf4e0", "comment": "Malware payload (Mirai)", "value": "931e048f94b3d4e2edd81e7932b45e0c05c8c43115b81aac03c741cff7b4c786586560e4b2aa37e355f04fb624e4518d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777099450, "uuid": "19000d51-1d9b-453f-86c9-52d630169e0b", "value": "T168A43A51BD419B26C7D06ABBFFAD828C331327B8D2DE7112DD064B3136DB95A0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777099450, "uuid": "55fc4704-bff4-46c4-a6bc-93cfda491338", "value": "12288:2eROXoDy8MmKHKdXQT3vo8nmsUho8R9RZmZop37zmcf/WzCNt1cc7WinzsMnasEp:5FrkC+GIMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777099450, "uuid": "42a90902-4b70-4792-9bbe-c41797641401", "value": 467220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777099450, "uuid": "2c973aa2-3752-4747-b936-0d0bdba4693b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777099450, "uuid": "0fc2bd82-f303-4064-85ea-82cca182c2d5", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fdf500e-40b3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777127350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127350, "uuid": "8fdb2b13-6859-470c-9c91-b3c5a9391a79", "comment": "Malware payload", "value": "c8bc2e9e8a21353af70789fcea799b0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127350, "uuid": "8a7bcaac-b2ce-43cd-a1b9-52d50a5c214e", "comment": "Malware payload", "value": "ff0e0482032d942abb43d7517c61e996013ab2a56c938f87ca2381fe0c3622ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127350, "uuid": "4050878a-2fd1-41d9-bbd7-4f01f165bde0", "comment": "Malware payload", "value": "844e474d3b0897b7326fe6a041062b7a373bae04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777127350, "uuid": "8625d72d-cd77-4001-9d98-98a83012c57c", "comment": "Malware payload", "value": "1e24aa2ed0de891ed70e5074a2b5cd27526ecae7d3aa2588638960126a5d00c8e189343a83f5b614392736df90bdad98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777127350, "uuid": "8e864b04-3a5e-49f2-a20e-cc1c3cdca872", "value": "T1D1D623ED90E522E4D4D34A80B68B53DD71D1669995FC5C2C39DB1C426F02CAF220FEAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777127350, "uuid": "4f881266-d3a3-4d76-96b8-d2f280bc554a", "value": "68c80431c75c5580fdcfd125e7f2c7e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777127350, "uuid": "40a6837f-e5df-49a7-a22d-90c701ffae9f", "value": "196608:nZ5G/ruiEtlp3o13HIZRGgUZ3e2eKHzK+RcONqJ+ZybuDa6HU23EKVZDW:Z5G/rGLpydV3iKTK+SJ+f3EKVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777127350, "uuid": "f6627d88-040e-40f3-a285-63836cffdce6", "value": 13541304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777127350, "uuid": "b7c24af6-347a-4555-8435-c3e18a349eeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777127350, "uuid": "ca06e223-f6a1-4d26-baa0-b0db6134abbb", "value": "Whisone.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "240a150e-4072-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777099440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777099440, "uuid": "f6da4683-98cc-4c0d-b9d7-5aeeca97ad37", "comment": "Malware payload (Mirai)", "value": "69725f6dfbca73df8709610c6aefcf16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777099440, "uuid": "56e90aad-660e-402b-8b30-e195800d37f1", "comment": "Malware payload (Mirai)", "value": "ffaa38e9df2a763b35f92c563f71ae029bc6d8e48e6415150e31681af6affaf8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777099440, "uuid": "2c2a298f-4f4f-4d3a-a5b1-8f99f0502c1a", "comment": "Malware payload (Mirai)", "value": "3e01be3482e278395150944eec3a31deddfb5273", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777099440, "uuid": "f42df878-24e8-4643-8992-37e6dad3063d", "comment": "Malware payload (Mirai)", "value": "dc1d940313e0c9b40069f45ea39db0f74c868f0cab33667b5798e7dbe4546d3a9efbafa5c9e94a0e811f68ef64c062e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777099440, "uuid": "adab0cff-b2c1-4646-91cd-98440c9d03dc", "value": "T1C5A43B65BC419B51D6D02ABEFF6E828933132BB8F3DE7122DD055B3167CB84A0E3A541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777099440, "uuid": "23dd74a8-0c03-4ed2-941a-6d91d449c90d", "value": "12288:5zs+/fifEzAPPEs9VHT5dlo5hUPNTzsKptdP9ZCFRtaD1b5e9Pf0nsL+a8oN0TT5:zuyS3lo0EJfeMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777099440, "uuid": "01a8526a-0b67-4495-bf7a-e2746684a68e", "value": 457824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777099440, "uuid": "78247eae-8443-4b69-84b8-f03ee99f15b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777099440, "uuid": "dbb78c2f-e4a3-439a-aebb-c27162937b3c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }