{ "Event": { "published": true, "date": "2025-06-30", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-06-30", "timestamp": 1751328181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "61f6bc48-5c7f-481f-9137-f9897860b186", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47378cbb-557e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Xorbot)", "timestamp": 1751266129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266129, "uuid": "1b9e2258-3612-418c-b8a9-13dd62364e31", "comment": "Malware payload (Xorbot)", "value": "dc6c0512d472ba5d8098097fb2fe2fda", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266129, "uuid": "a03f37be-3ea8-4882-b5d5-e924280e0c16", "comment": "Malware payload (Xorbot)", "value": "0000fac19e7f9d580064aced0ca79c7cf921c58281cec4b1919a0a4257011f52", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266129, "uuid": "1f78b397-2977-45a2-b2c6-db19caeada13", "comment": "Malware payload (Xorbot)", "value": "98c647ac4b84689a6e988c039d2f1f6fa576df6b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266129, "uuid": "79f23d4e-9993-4ef4-850a-8482a829f6f1", "comment": "Malware payload (Xorbot)", "value": "f5fa989bd281e7846a641a8b2a96598bbc410c39889f741607a62c45e140955ba569878c2fa2a3dea6bcd435f60b8bfa", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266129, "uuid": "00efd281-b95c-4e86-a41e-b934a8a6f014", "value": "T1DB22CECE05813310E9839E693AA895C4E15197C27CD637DCC5DC6CBD80CEB6BB488E79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266129, "uuid": "51d4ec21-f713-450a-9202-15962b7a30cc", "value": "192:CPreP3+wxLbZVyRxk9XvuvjPn9PreP3tZVyRxmXvuvjPe:2wxLbZVyRxk9XvuvjPneZVyRxmXvuvj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751266129, "uuid": "51a0b318-2f20-465b-8d74-410e254d584c", "value": 10578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751266129, "uuid": "4cff32c1-9033-4d86-96e8-3187de8e2d53", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266129, "uuid": "ff09d81d-2040-427a-86da-ea59e537979e", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be0eff1c-55b6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1751290380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290380, "uuid": "3e88f748-1553-4453-abe7-60e32fdc1f7c", "comment": "Malware payload (LummaStealer)", "value": "5aa4e01cb5798ca532918cc3ab683799", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290380, "uuid": "f1f19528-0681-4500-898f-91acf34e81a0", "comment": "Malware payload (LummaStealer)", "value": "00830cc23e2f3d4fc8946393b88b785aff9306b418e117d63cc65316435a7ead", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290380, "uuid": "5fd318c7-5c35-49d9-9da9-8a6c74f2c84d", "comment": "Malware payload (LummaStealer)", "value": "7eb1f591a47809ef158391f611151b831da5595f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290380, "uuid": "82989208-d731-4a32-b075-50824f508a9a", "comment": "Malware payload (LummaStealer)", "value": "baab599bfc6b0cb67957ffc3d52a4e91823f7ade82c4c3fb7978889320a3662f84cf48d788dac2966f7c900bca08b5b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290380, "uuid": "05a60031-ecfa-4ab9-ba1c-512e7e565950", "value": "T1C585338D7FB3FA4BE89803F7576F532A93585C1DEC3AD460564A02BCE78B703A186059", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290380, "uuid": "3dc18672-2e90-4de8-82b1-3e5c86aa725a", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290380, "uuid": "f034517c-8447-4959-8d18-281c43c4984b", "value": "49152:Ikp98QjeMPOHvrBiQsT1Lk4j6SE8z6mAZp1GKiIs:I8qrMPyTBiuBsAZyus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751290380, "uuid": "f589f3fe-2729-4d1f-969f-41ede402a932", "value": 1835520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751290380, "uuid": "5b8ada23-a864-41fa-9478-8c9032d7a7df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290380, "uuid": "d62ecfe3-30b6-47d1-b770-3f73b27ee25b", "value": "5aa4e01cb5798ca532918cc3ab683799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abeb12e2-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751291209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291209, "uuid": "7390bc11-4036-4f0a-8a8b-ec92a19b608a", "comment": "Malware payload (Mirai)", "value": "4a255c2d8c33fbfb959fb43594f2590f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291209, "uuid": "dd331c55-f4f2-466d-bdbf-a4fa18c54f6e", "comment": "Malware payload (Mirai)", "value": "0119256b781b638790d6c6847b821c273950bb2baba80ca3b14bf6154f0736e8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291209, "uuid": "0b03a4fd-9f93-4aca-b5c8-b14132bd8652", "comment": "Malware payload (Mirai)", "value": "f7558bda3b91663a83a25b9948b7a868ea14323b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291209, "uuid": "5bd32f25-aa4b-45b1-b31d-86779b257d51", "comment": "Malware payload (Mirai)", "value": "ac53d511c752e69c15571d5ae93af79ae25e5da6cbc06b824817219e2542dc338de3fb4b9b1c2ed289a7afd3511ce518", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291209, "uuid": "9134f496-07c7-41c8-97d3-17d66393e90f", "value": "T1224132CA14A219B83DA3AE57317E4AC53181DEDA90C65F1DD8DC78F540DDE08B060ABB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291209, "uuid": "2a43149d-ece6-40a0-9e78-2aeccff5bea5", "value": "48:vyvmv4sGja9aUosqRbOuTmcJ5sK6HmGi5:vyeGmU+qRSuTmm5sK6HmGi5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291209, "uuid": "93e55e7d-274d-40a2-a47c-beafc3693c32", "value": 2428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291209, "uuid": "31609dff-1523-48d0-b775-31f193164a9c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291209, "uuid": "f3a1067b-c121-4492-b218-ef58e6a6470a", "value": "asus.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b313e1b-558a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751271290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271290, "uuid": "74c01910-9191-4553-83fc-5e5fd2f95c4b", "comment": "Malware payload (Mirai)", "value": "c5c5ced5a380e81aa88450d9de152339", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271290, "uuid": "3d380af0-c811-4e97-ab06-8925913e3956", "comment": "Malware payload (Mirai)", "value": "0131188def8e446cfac867b35999aeb55a6c087c8595f7f5e0783f5be7a900e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271290, "uuid": "5bf87d0a-323a-407f-a9c9-6cbeef98e9c3", "comment": "Malware payload (Mirai)", "value": "d74bbb2259fe576a2b8266a5a0648efe744dd054", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271290, "uuid": "364d3205-235e-4d6c-a623-04b5ef561c2d", "comment": "Malware payload (Mirai)", "value": "e6828fc16db199f336b5f3c232282b9e2cf1c606b7abf5fb08b179798f7c63986765acbe8088096d8c94022cf2f798b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271290, "uuid": "e63972ea-fa6f-45b4-8f85-adbf2ec25549", "value": "T1C2F3885A2E228F6EF27C873047F74A25976D23D627E1D684D2ACC1141F6029E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271290, "uuid": "9d32630d-d4a1-4058-82e2-c48fc7aec1e2", "value": "3072:ZtVYv1HolzpE5XMbO0NVeEl/RJ/US/Zc5:7VYdIlcc6+eMMSBc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751271290, "uuid": "3e25d9d0-f8f0-4ae9-880c-88bcbb702186", "value": 169308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751271290, "uuid": "00dde688-53f5-4c67-8a76-50af6cce7b31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271290, "uuid": "a8c59e4b-3c9e-430b-94ad-0023a1de5ebb", "value": "cutemips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "442b246a-55f3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751316375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751316375, "uuid": "773ea8a4-df56-4bf7-9258-9ef62e913682", "comment": "Malware payload", "value": "0abd3d81f269bb9b9abebf21bfb991f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751316375, "uuid": "a77fd03f-a12a-424b-bb12-aa944e0a7c41", "comment": "Malware payload", "value": "01bb2106a745c2a2db9605eb250afd0065f7ff6604dc9338151a3cb18b140c5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751316375, "uuid": "bce9cc7a-4af9-4534-a9c3-c2c4e233ad78", "comment": "Malware payload", "value": "886807781eb919c797dc8a10ba700b1d45afe0d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751316375, "uuid": "d55aa21a-211c-4aa0-a9e0-a7db5eae4ed6", "comment": "Malware payload", "value": "0b65d3f8b4bca484a10c952da0df894795b3e796244140f90782ccedecaf0b2c4f4d588ca71069a61f84e9ad6d84c91a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751316375, "uuid": "2bdc27dc-88d5-4a13-8023-c6daa0951717", "value": "T131043A0577AC30A8F966B13C84E34B83E631B80C07B096AF039377A9AF1A795557FB51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751316375, "uuid": "406d8d9b-aa76-4afb-ae9f-071496627d5c", "value": "ef100d3ad307c938fcec27069a1962d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751316375, "uuid": "768dd485-0621-44d5-90f9-99331a659313", "value": "3072:C6EaPFpbvzczhlk2SwAiYixSltXCjqIvz2SHTCtB3iTC1enBdgxpEXrA:C6Atlk2SSYuSltXRIbHiB3ieUSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751316375, "uuid": "bfd1ea04-0679-4950-8a81-25c26cac2ef9", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751316375, "uuid": "39f8008d-b8ed-4b90-9bc1-45be2aa2cd53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751316375, "uuid": "07f9734d-052a-4d6f-a116-85288522adb0", "value": "MSI8FC0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b483ae-55d9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1751305296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751305296, "uuid": "f185b781-b92c-4519-8a00-6054e198bf08", "comment": "Malware payload (Formbook)", "value": "18898be335277e09bf21701197fcdd3c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751305296, "uuid": "2a670595-e7f9-47b3-8043-6a2cb3af1a53", "comment": "Malware payload (Formbook)", "value": "01d12781392070c3326fbbe214b0562ba6bf2f02521e017c41780289dcbd227f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751305296, "uuid": "5cf72492-8d20-44be-a8c8-9f6294555489", "comment": "Malware payload (Formbook)", "value": "cdabd7a5b9b33774f81d8c4d5aff6dbdafdf87a2", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751305296, "uuid": "339e5037-014e-40e4-837d-ffcf5ae28e60", "comment": "Malware payload (Formbook)", "value": "7249247534b58294ee3ff52de70734322f58609d2e614c79943f037bfa371361c042f1af5324336d640c812bb0e908a6", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751305296, "uuid": "76d89ea2-e493-4997-9900-22060b675ec9", "value": "T105A53362A781E19A5B87E6610FFBF16C4A16F8641C6F163234F784BD38F74D0901B62E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751305296, "uuid": "ed4c857d-3781-4dd3-b164-0d1ad5ac89cd", "value": "49152:zdrLdBTkPVCf6znc/epL5qo22tOvSW+SkxdmGjuik1ik:Jrp5kh7cGBco2VaxdmGju5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751305296, "uuid": "8f70e37f-1220-4a12-8a97-7bdfdf251b60", "value": 2131795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751305296, "uuid": "fbbe1caf-73a7-480b-af7a-93366029fd56", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751305296, "uuid": "aa5412e8-cdd4-44d5-9568-a4e3f9352d44", "value": "Ref_876534567.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fd8f857-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751243837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243837, "uuid": "2dfef010-b21d-4b3b-81a5-741af0a0bffb", "comment": "Malware payload (Mirai)", "value": "46718d7d45a01c4edf2bdc7e0ce57a17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243837, "uuid": "e970f598-896d-44c9-9d5e-060aa82bf155", "comment": "Malware payload (Mirai)", "value": "03236e6800a37fb3652381ae1511edbdf533e4d12e8aa2e907ce24b58cd05728", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243837, "uuid": "b0f81b64-39bb-4e78-8649-7e113b6bcae5", "comment": "Malware payload (Mirai)", "value": "b444b20aaaee8ef2eee279afa720217141cc3721", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243837, "uuid": "6f9e2cda-4f54-4909-9fd6-b682f7ba5654", "comment": "Malware payload (Mirai)", "value": "cf508c829118a3bcac0fed289d795a2ad0c646e24065b9b41a6fa6101c6866bafb5a4df1a052564ea8d67612e828a558", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243837, "uuid": "b2f29ffe-a943-41cc-85ea-6865848e94ad", "value": "T17EB39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8905F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243837, "uuid": "9b3033cf-b2bf-43d2-bef2-b244e9ce3913", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1D/LWy:c9sSyzz36YaWWgg1Dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243837, "uuid": "f7ad5d94-2438-4f2b-b02d-75c7b41441b0", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243837, "uuid": "0a78b213-81a2-460e-aeda-15778f9b0da7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243837, "uuid": "7b24b21f-b137-467f-aa9c-de1e9970bd3e", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "898bdc3a-55e6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (CoinMiner)", "timestamp": 1751310908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751310908, "uuid": "b7c404c9-65b7-4498-951e-28bf64c492d6", "comment": "Malware payload (CoinMiner)", "value": "34e5e291cbba3b121a3c6873822738bc", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751310908, "uuid": "4b28b9b2-598c-4568-a2e1-af13e4770208", "comment": "Malware payload (CoinMiner)", "value": "03873f6945d5f5a4a15da5c3b3f69f7fa93cfab69f2b7a60d6fe682945b26f15", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751310908, "uuid": "81901938-965b-4978-9f33-3c748622b53b", "comment": "Malware payload (CoinMiner)", "value": "a2327574e5e509786b7d59f4ba6a40780d49123a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751310908, "uuid": "89105681-52e0-4c87-a58b-4b966e2c28fe", "comment": "Malware payload (CoinMiner)", "value": "0e6462cff42db9165177a06069b179830a90ff6300d97e9a728c5b9f102dc8a6ca944e695cbb78b561ca3912ae8bad36", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751310908, "uuid": "0c89fd8c-696d-458b-8fc9-6b239f0552a7", "value": "T17A2522C43D830A0FC1074D30F35E6FD536BABC572C115BA6E929327756FD4A818A6EA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751310908, "uuid": "f930e3f4-4c94-4f79-bdd0-1bdaab13eff9", "value": "9165ea3e914e03bda3346f13edbd6ccd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751310908, "uuid": "4b86912c-454b-4cf5-83d6-2dbac0acd84a", "value": "24576:v1YZ2NZ1K8HRmhjRXYP/yWQksZYocGXI1ycZTTX/2LR:dNNZdydo3Yks+D0Lch/aR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751310908, "uuid": "320003b1-948b-4926-bb5b-aa8255fa8554", "value": 1029070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751310908, "uuid": "219c9543-60d2-4be5-af07-a225795af8ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751310908, "uuid": "c005b2e8-417d-4548-b2fe-044a00bb65ed", "value": "34e5e291cbba3b121a3c6873822738bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e901f295-5605-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751324383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324383, "uuid": "6af789fb-5815-4974-bcbc-38770d098c7a", "comment": "Malware payload (Mirai)", "value": "6750485f0944b120eee7bf409455f584", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324383, "uuid": "6a876fbd-b828-4ca0-8be3-7c74d11d1cf6", "comment": "Malware payload (Mirai)", "value": "03ac168cfb46dd6870882dae2cb1678a397b603a11bad4fe18b57e63294cc20f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324383, "uuid": "f1ef8322-66d2-4be0-8a16-3e05113f223d", "comment": "Malware payload (Mirai)", "value": "e5aa7dfb5e2c11bd18b8664b24f21b48064d3805", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324383, "uuid": "62040890-7944-43a8-ba90-5b27d4c39f4f", "comment": "Malware payload (Mirai)", "value": "857eff3f6fee89c9ebafc96a4bc9e0f3727354393c907b5fd7d599743a8f37d27f636d5ef8f01182035b597d068d3522", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324383, "uuid": "7d4c13ae-b808-4a5c-93a5-e9fb9c4a8328", "value": "T1B3F2E14BE2BACB98F47902329485314E4862D5BDBD01E1AABFD431271927B793D1C3E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324383, "uuid": "27840b48-3313-4bdf-aaa4-923ad602add1", "value": "768:Q8AYqxpRBjk0UqCBwPul07sOx+WTCUObCbsVG1Uw5nbcuyD7UHQRjv:Q8oksCiGqsOxBTDObGsVG1x5nouy8Hyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751324383, "uuid": "cd3dc424-e240-48ae-851b-e2c6d304a13e", "value": 36800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751324383, "uuid": "ae02e55e-7ca3-4b1a-9490-2e8b813f9d26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324383, "uuid": "bfe9fdea-909a-487e-8b63-0485a7442686", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f659caf-55d5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751303509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303509, "uuid": "128f5260-df36-4e4f-b010-bf030e794b56", "comment": "Malware payload (Mirai)", "value": "54135b7f9acfd5024c88ccc5429cf881", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303509, "uuid": "49b20f64-0faa-4785-bedb-8e98a896a6ea", "comment": "Malware payload (Mirai)", "value": "03d28e1ea53be7c0dca0bdfb24279824d49136d435ebe519cd4c4d6c8f13699a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303509, "uuid": "f6455fd7-9a17-4bd8-9f7a-32a1ca11e011", "comment": "Malware payload (Mirai)", "value": "ca94719aa048e4d6a0e87544411e72066c03f220", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303509, "uuid": "69517e47-5b50-4425-8bba-0d5cc589c64c", "comment": "Malware payload (Mirai)", "value": "411d94c1bcc8bf76864b1d7b2631283feaf045d82200fbda5f9db76b4022ac26ea4c95b6c75c422b77974b59fe95b9e9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751303509, "uuid": "ddc44952-8ed6-425b-87e3-617381a8b963", "value": "T146110DED005E7446AB3D9E31F03D6849E48086E035A4D781F04ED4B6F1A9A2B4336B93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751303509, "uuid": "b4ad5d4e-4b9a-4a54-a1e4-7ce0dffde40d", "value": "24:3J3+InIyIRGNINTInKLIpIwIG8I3hIaNI7I6f:/IREnvCnGj3qaWc6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751303509, "uuid": "167ebf9a-2c5c-4175-aeb7-c0c275a36e7b", "value": 979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751303509, "uuid": "f4b0a0db-171f-4317-bfca-5b369d33949e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751303509, "uuid": "d68a6769-2f97-4277-a4a0-b198eaf91538", "value": "curl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a73197f-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751291958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291958, "uuid": "1ffb2165-6246-412b-a517-c98d0d19170f", "comment": "Malware payload", "value": "8b123430c2e6a34bf2d4059a1c70cbb2", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291958, "uuid": "e97e4d79-de8c-48b0-b701-8f5bc465f202", "comment": "Malware payload", "value": "04255a91d1d96b568dc8a1827f0815fdb06f2da5bd2abdfa2c60c53b06518edf", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291958, "uuid": "db301342-0349-4fe7-bfaa-699f18b9f16c", "comment": "Malware payload", "value": "30c7d50f5100b4da038cb644dda8fc2440015480", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291958, "uuid": "cc36b441-bd42-470c-8447-1fa66528ecb0", "comment": "Malware payload", "value": "aba47f2e9aacce2662038e357bed955e611dae72fa0a94588e8a3332d6b33900f7a8a238cdb9ca726c0b8bab468a7081", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291958, "uuid": "38503fa8-53b3-4ad5-859a-814b5b6aba02", "value": "T11715E0DE7E4DA694884262FEA8158552F1DC87D1B309EB72FD7CC98073958B8C86B3C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291958, "uuid": "99252ec3-1919-4ae3-96ef-22233221ccc0", "value": "12288:5Bgrpg0Kt3b+WVlxJh/4w+OQvC2xBgrpg0Kt3b+WVlxJh/4w+OQvCA:5BgtHCyWVIaOBgtHCyWVIaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291958, "uuid": "588f8eb2-da41-4097-b794-eca5cc433222", "value": 923378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291958, "uuid": "025b72de-1fda-48e1-aaac-b867b311784c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291958, "uuid": "dbbf2262-3468-4c9c-9722-c623a20c4274", "value": "HealthUpdateCore.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "057d17b1-55e2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1751308969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308969, "uuid": "79df2097-d144-4f69-b91d-3ea658f52f81", "comment": "Malware payload (Formbook)", "value": "512dfb2af6bef3005f2bc07aaab78174", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308969, "uuid": "32c71607-30ea-4475-b306-d746d0dca545", "comment": "Malware payload (Formbook)", "value": "043ac7293202b1142c850106e891c5580c76403bfb84d35d11e831d9299e3046", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308969, "uuid": "f79f48d0-6b3d-4bda-a46b-16e73e21a75d", "comment": "Malware payload (Formbook)", "value": "454af3a45f486390fea2e2a1d7bdb4f15c0a35e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308969, "uuid": "4b9f96fa-2be6-4849-887a-859554a890e0", "comment": "Malware payload (Formbook)", "value": "96635b509b59a5b7c3cf59ac68df82078da7cfc8a2d0e1067dac55dcd49dcb678a4935b57c022f3b156c04274a84b955", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751308969, "uuid": "9c8c5eaf-d53a-471d-be1d-fbab6c79960b", "value": "T11145BF0273D1D062FFAB92334B5AF6215BBC79260123A61F13981DB9BD705B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751308969, "uuid": "99faece3-ce90-49a0-9b51-39b964ffc31c", "value": "0b768923437678ce375719e30b21693e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751308969, "uuid": "6194e88e-5698-4d6b-825e-07d9e2685671", "value": "24576:I5EmXFtKaL4/oFe5T9yyXYfP1ijXda6RHlK3Dj92x7f:IPVt/LZeJbInQRa6be92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751308969, "uuid": "1b6339bb-63f0-40ee-a107-9f31da2a7473", "value": 1191936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751308969, "uuid": "faf81ab5-fad1-4a41-860c-5003d4665d26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751308969, "uuid": "6ca3a52b-daf3-4ebb-a15d-cf673cc4cc2b", "value": "SecuriteInfo.com.Heur.15150.29656", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dcb182a-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751291883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291883, "uuid": "f434045c-6c6b-4f10-bde9-6e6ef7a8546c", "comment": "Malware payload", "value": "b170e415e3576e64c3b3fe9755223e19", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291883, "uuid": "54ac23da-af8b-46cb-bb6e-76bd03da4c01", "comment": "Malware payload", "value": "0459b7d38729bbe721710527beecff232343cccc17dcb24145981fd450ba882e", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291883, "uuid": "b0ddcee8-8e49-43c4-9aab-5d39d9e18826", "comment": "Malware payload", "value": "8cf8493a77bed3aae0a221ac4e0f70bd58b94b5c", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291883, "uuid": "867cc347-6074-4fc7-a0a1-66b700ddcc65", "comment": "Malware payload", "value": "4e6fe116b1ba25bcc5f2e9b57417f5e9919353dd921de8f838d9264f5d1d30bde3db3ed7322c05fddc4cfb9e1be7b0ac", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291883, "uuid": "8733d48e-eacd-409d-9717-62cf552d47d0", "value": "T10B31263426ED1325E3F54736ACF6A6269A3BB801F9364A1D4151424D2822F02AC69F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291883, "uuid": "c3c1b949-96c3-4bbc-91b6-5b5221fb80da", "value": "24:8EOJ93R+UUVFAY2++/cdpT2i+gaarP0I9YqVGQyLEab/cm:8PR+nuydp+2rMiBtyLEaTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291883, "uuid": "874bb673-e317-4746-b882-435d058a973f", "value": 1575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291883, "uuid": "4c256d21-328f-4933-8d1a-55a9a80ec2fd", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291883, "uuid": "817fb894-0e4b-43a1-8339-326cadeded1e", "value": "RE_0074837583821.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2be70c2-55b7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751290898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290898, "uuid": "eb046164-e8d4-48e6-979e-e7d2760c1f76", "comment": "Malware payload (Mirai)", "value": "2c3fa7d698f7329f96541feea9cd7e8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290898, "uuid": "d876c407-d3f8-45f7-939a-5a5544310eed", "comment": "Malware payload (Mirai)", "value": "04da58ad44822bf3da95766f4d615f6e16e492e0c15828e2dba8fa7b56ae0437", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290898, "uuid": "991f66a8-7dda-4325-9ca7-d04ff9a91ebd", "comment": "Malware payload (Mirai)", "value": "d84a626f2aff2d352e31626fca9c31ba5df23bb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290898, "uuid": "cb5605eb-5310-427c-9e59-95f0e4cd0703", "comment": "Malware payload (Mirai)", "value": "10be10c44a4b9aca2f4ca769c83e333d066fd66d40e13db4e261ba9d8a62886beeb767dc16ec8961d1a9a16f007e7387", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290898, "uuid": "e9c2896a-64e0-4875-bab6-97a27173740c", "value": "T102433A02762C0A47D1661EF0793F2BF0D3AEE99024E4B688254FDB468275E37158AF9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290898, "uuid": "718a7701-b768-4051-8fe5-b17a5c472f4c", "value": "768:s3Ojd+2D0Pq/BHSeRw6OJRkaDTjSSxjliAP/+UDcoNGjbqraZHMy+p6rfxaT2yI7:Y2DZoH6yz3OSxhiCQjbqmZsrGMTa7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751290898, "uuid": "5cafade5-992e-4fe7-bffc-ad9f3327a423", "value": 59808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751290898, "uuid": "08eab337-7b29-49d9-8168-f1f2e1ce90b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290898, "uuid": "0fe8837a-013e-4eac-b8be-c53363d84c79", "value": "mirai.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c28525-556f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751259652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259652, "uuid": "180470ea-363a-428e-9e3c-458e512558b9", "comment": "Malware payload", "value": "d1f4a98068c70d32c06e7f0833d64767", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259652, "uuid": "f9ea84c9-05f7-4fbb-b035-b92a112b246d", "comment": "Malware payload", "value": "0591a9243e7d35d66a6b8b09e2771e6c1163a57eac8be592437043c1576e110c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259652, "uuid": "8f209cc3-a010-4491-af86-91ba83ed8fe3", "comment": "Malware payload", "value": "be011568e6855b58556b51590fff2a36c1a58ec7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259652, "uuid": "ea75bbb6-ea39-4b72-9912-bb6420fe5f6b", "comment": "Malware payload", "value": "2547770d7feaa362dbee50c1f390df918a5d387cd39d8868758e1b2838ada30edfe03715c04d9b29e9121357249cc00e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751259652, "uuid": "94b33021-816d-4732-9907-d74cf5be479a", "value": "T1D0E4F1037308A756DF4BA83A82CBFD31B7C2799153D096627A80E29F8775726CF0D649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751259652, "uuid": "57b39319-d963-4fa4-b280-42ab2981a988", "value": "12288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751259652, "uuid": "f966a753-3f67-4ca8-bd18-bddf9d9f1b0d", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751259652, "uuid": "7a0e890d-9572-4d92-8d44-15aa24d2ac44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751259652, "uuid": "2080790f-9bd9-49a8-9fb0-2825587acf4d", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad7336a-5580-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RedLineStealer)", "timestamp": 1751266967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266967, "uuid": "4fbf6e6d-58d2-4c37-adba-aa7273e045c3", "comment": "Malware payload (RedLineStealer)", "value": "ee61dba3703e5effa98d85eb9c5f5de8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266967, "uuid": "361270af-9ea5-4d5d-a6e8-91567b05b1df", "comment": "Malware payload (RedLineStealer)", "value": "05c6177fef106f3786e12e1fe8c361021194a07ca8e728e4f4b1449dc0bb6ada", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266967, "uuid": "b3bc0a09-af12-4b69-b923-5c2aaae1fd47", "comment": "Malware payload (RedLineStealer)", "value": "d862b0386c9a38dd4bae66779d890de39d58cce1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266967, "uuid": "4dc29ea3-5a8a-4574-a555-1dff3b896fbd", "comment": "Malware payload (RedLineStealer)", "value": "fd7c1d8cb57939c5bea89f23eec3df795199760e0fdf77bf86710e1a1d3a6912c00444ffbad4fabbaaae974b91aa3066", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266967, "uuid": "29df6972-78b4-46ba-be4d-15454e5acd24", "value": "T16245BF027391D062FFAB92334F56F6115BBC7A260123A62F13A81D79BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266967, "uuid": "530d6a42-1ccb-4f2c-87f4-d2db0b7dd084", "value": "0b768923437678ce375719e30b21693e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266967, "uuid": "b02c8256-0305-4c47-b95d-6b173b5ebde1", "value": "24576:05EmXFtKaL4/oFe5T9yyXYfP1ijXdaW9PPvWz7PJN+ePs:0PVt/LZeJbInQRaWB2P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751266967, "uuid": "ef5fbbb9-ce14-4db7-a659-d92d04cffaef", "value": 1214464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751266967, "uuid": "24e38df4-0296-472b-b842-414f27e6c81a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266967, "uuid": "c8529aed-546e-4f7a-8d70-e649a38cdcba", "value": "DEPOSIT PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "456bfab1-55b1-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751288031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751288031, "uuid": "475532db-d535-4bdb-a2fc-c10e022435b8", "comment": "Malware payload", "value": "077070fba25a669b0b546a5a1ad51b3c", "object_relation": "md5", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751288031, "uuid": "ea183444-9077-49f5-a79f-c5239c1d8404", "comment": "Malware payload", "value": "064506daf99bee68e101d78ebd8b4ee02c816509739eceb120439c3a46cc833a", "object_relation": "sha256", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751288031, "uuid": "1eeb7d00-95a7-4b84-a583-7df819d2abcd", "comment": "Malware payload", "value": "b8230f0396ef689ef5a251d1a36665cd137bd1aa", "object_relation": "sha1", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751288031, "uuid": "97eac260-fa5f-46f7-bc93-18a8e6bac092", "comment": "Malware payload", "value": "7e4fa2a88d49625532ea46f7a65a23bd1ce4e07994a84e4e4d27b017e26aa5b691ee65c1497cdea5da94ed9cc8a22363", "object_relation": "sha3-384", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751288031, "uuid": "e0410179-dc7b-44e0-9c2f-aac9c60fc012", "value": "T123F312A6212E31D17A311FEADFBB5A70CE5CEEF00A1851D1C93EA36BE5285F91900177", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751288031, "uuid": "234b4363-ef81-40e4-82a9-ed74e78cff45", "value": "3072:9qYNn6RuECRaUpqzbX+/mMoSJTZxZxVqmG50T6WbMARAza8D9q4hFfb0TPG+v4q4:nNn6RuECRaes7+/noaZ9QmJTjbHSZqIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751288031, "uuid": "8a6db20f-8e0d-41d0-a578-5fbcff566ed2", "value": 167972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751288031, "uuid": "45500f3e-1240-4db5-a76b-0028a55f5ebd", "value": "application/x-xz", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751288031, "uuid": "09720baa-1348-40ca-a160-fb03bb2e8161", "value": "d0c52d4c9620e0a004674f9ab150c294b24e876a1b11c0b5f55f3fbc39271d08.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d8a9ddd-55d8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1751304714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304714, "uuid": "5010a80f-be17-425e-96f4-4dc60a396f39", "comment": "Malware payload (LummaStealer)", "value": "443e0f684c5ecc8ec8d273cd3b1b1255", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304714, "uuid": "353876d1-4f32-4b50-9452-b8e705136ff0", "comment": "Malware payload (LummaStealer)", "value": "068727179d56e16245a84b2238f79e5edae45446e17ede66664ef9c43f479996", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304714, "uuid": "14751bae-45c8-46a6-96f0-f83e8d24f882", "comment": "Malware payload (LummaStealer)", "value": "126c28b1e54c1846e127695a1f3ab00983c586dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304714, "uuid": "890497b1-ca3a-41b4-932b-e0cbcf65d6b0", "comment": "Malware payload (LummaStealer)", "value": "5b241c468c718c804e40c10114d170ef8f489515ca857530caa9f17600a490e47bc482b0f41e7a421cdb992e8e46a789", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751304714, "uuid": "bca7b3ba-27dd-440b-91a4-8e1fd5d3f953", "value": "T1AA8533A261237313EEF4873980EF6B079F350F59058F2666260C4726BF2F678165A5B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751304714, "uuid": "493d4384-8512-4584-abff-b1e3021e95f1", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751304714, "uuid": "ff49878d-4221-4b42-a080-0ada6621bc2b", "value": "49152:4RbJ/V6Ri1xYYEZAB+utZYkNR6tuCtuQo:YbB08sutykNRsu3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751304714, "uuid": "a79c506f-07aa-4982-b333-a6d7653da6ef", "value": 1871872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751304714, "uuid": "b75592cf-89b5-49b2-9433-69f338f038aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751304714, "uuid": "da335c30-1f25-4e18-aa2c-78c8572554fe", "value": "443e0f684c5ecc8ec8d273cd3b1b1255.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a045de93-55b5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1751289901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751289901, "uuid": "8da4c525-cb16-4fce-890d-146476ea9fac", "comment": "Malware payload (Formbook)", "value": "b51e7a123fa443d7ff515aa55dbbfd4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751289901, "uuid": "0675406d-affe-4cab-874a-942b33d8970f", "comment": "Malware payload (Formbook)", "value": "06ac36befe640325c35db775f1628e54299498f9699bd4e0bf1b0a1b1db3890c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751289901, "uuid": "519532c1-52c7-4e3b-94a0-907581f0dd8c", "comment": "Malware payload (Formbook)", "value": "a52182234f6082c9ea3389f43d68c1578102fb10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751289901, "uuid": "b8c129e1-ae29-431a-a684-bcf12b341429", "comment": "Malware payload (Formbook)", "value": "25d6302049cd812441af048574e18162428b0ce8b712e1ff634a59eff3c203bcbc9d95766c92d4d7cc6ac12b1f306068", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751289901, "uuid": "0dfd2d85-ffad-4247-94e4-be8130a97cf9", "value": "T16E55CF0273C1C062FFAB96334B5AF6115ABC79260123A62F13981DB9FD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751289901, "uuid": "1e9f5728-eb9c-40a0-a3e2-4134889c6a1a", "value": "0b768923437678ce375719e30b21693e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751289901, "uuid": "29dd6b27-69e7-482b-9f40-0ec5f0df9c3a", "value": "24576:f5EmXFtKaL4/oFe5T9yyXYfP1ijXda+SsDfwaFwlo:fPVt/LZeJbInQRa+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751289901, "uuid": "70c425a7-c008-4d01-a041-ede4d933e228", "value": 1299456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751289901, "uuid": "f0b40fe6-25a5-40a0-9659-944e7b1d1a12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751289901, "uuid": "b1c495ba-229b-418f-a44b-584fd9b4197f", "value": "TNT AWB TRACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "479b27d9-5563-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1751254533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751254533, "uuid": "f585fac7-e516-412d-af2c-daa9573556d1", "comment": "Malware payload (Formbook)", "value": "cd7b01183c1e16fe719681e231ea393e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751254533, "uuid": "04ef4d25-ca86-4031-a1bb-0a4f083b6651", "comment": "Malware payload (Formbook)", "value": "07897be894f90e837ac00edd367ff159c9f9153749743aa699e471a7d07f7ce4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751254533, "uuid": "84925b0d-b3e5-43d3-95fd-60bf316eeb5a", "comment": "Malware payload (Formbook)", "value": "9f4a241725690db793aca8bf22674ed53b378862", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751254533, "uuid": "9f72f3b4-b5b7-4cb3-9644-39bcf5f2341b", "comment": "Malware payload (Formbook)", "value": "2256d2449bf9f4d93b72ec7352bb52567ce2438b194c6068b5a814b7e00d26d37016a6f8e930139725156b3ff0d3dec2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751254533, "uuid": "e7fc379b-6b9f-4798-b0d7-c11d23c1cde8", "value": "T1F845CF2363DE8365C3B25273BA257701AEBF782506A5F56B2FD4093DED20122521EB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751254533, "uuid": "96ec6733-3daa-46f5-95de-e4ddcf64fb02", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751254533, "uuid": "89600b96-c865-4504-aff3-4c23c18f2fb7", "value": "24576:1tb20pkaCqT5TBWgNQ7aLVMaKMdF1oGWUp6A:mVg5tQ7aLVMLEF1oGWo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751254533, "uuid": "c9498d96-3397-4205-a733-f65a550b7de5", "value": 1193984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751254533, "uuid": "6ff07d34-66a8-4820-9d44-d71a1db975c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751254533, "uuid": "81bb4dd9-3a7c-4837-b2d4-1bd8139594d5", "value": "(AL DHAFRA) AL JABER - SUPPLY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcae080f-5589-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751271104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271104, "uuid": "b1a34d28-3adb-4f52-a110-a9714cb62312", "comment": "Malware payload", "value": "4d970d5b048a57859509f9c18c6e3d5b", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "CITIC Securities", "colour": "#BF146B", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271104, "uuid": "6090f933-7c69-4eb4-8237-9674038a8ca0", "comment": "Malware payload", "value": "088cb59978c66e293a21d7ebb110e7679c34f4dc3b6b0bb20d779d477e934f33", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "CITIC Securities", "colour": "#BF146B", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271104, "uuid": "0bdba75e-63ca-4c1c-8aff-a2aa25b8e9e6", "comment": "Malware payload", "value": "318ab248b21c0261f41ce66bae4d176c5313f004", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "CITIC Securities", "colour": "#BF146B", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271104, "uuid": "7ad6c4a4-0f66-40f8-9995-a61fc92cb9a3", "comment": "Malware payload", "value": "09bfb75d1a4d1bf61525d0e7008d8319062cf6acad3c4c8d5d61c2615dc81d23106ec655ce4ef04dc553bfa1947e1ed4", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "CITIC Securities", "colour": "#BF146B", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271104, "uuid": "90b974a7-1d30-48b8-a8c2-799a8ae260c4", "value": "T1B49512A7BB9188A9C8A3523098269701132BDC259ED7E3D70E54F12C4D739D8DF5EEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271104, "uuid": "d2aa4d32-46e3-490c-8d27-d81ba455efbc", "value": "49152:ypk7/AtqNHoPT6uzjYYMhMSKmb31M93lE6:b7/AINIPXjYPSSf1M9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751271104, "uuid": "b9b75c9f-bcd5-40c6-b785-f811a3d2b1ba", "value": 1985373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751271104, "uuid": "5470616e-a935-4889-8015-d6f6d3bc2e9a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271104, "uuid": "ff9d851a-bc8a-472e-972b-ed32b859fcce", "value": "app (3).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52314070-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751243814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243814, "uuid": "f2b089e2-e3c4-4891-8e05-7a36e6a8dba2", "comment": "Malware payload (Mirai)", "value": "9529257346686201ebe50e4fa8450d57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243814, "uuid": "32bde35d-4fdf-4660-8776-dc2ab2aac015", "comment": "Malware payload (Mirai)", "value": "093ff0e9d88bb73446bab820f739921b088133a4bc79371493ca4ce45459d7f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243814, "uuid": "e964d61f-7cc3-4353-8d96-f89af9da9e0b", "comment": "Malware payload (Mirai)", "value": "186ed6b283c0cf6e256deb6d7a3bd289f5fa8e1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243814, "uuid": "c71862af-017d-469c-a9e8-0e846e6d028d", "comment": "Malware payload (Mirai)", "value": "22ba4861e09690a177be83c730a921805a872bb0223c87307818dae0168d70ba88e09d5c7c1049a88e7f47ab77ef1cb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243814, "uuid": "914122c7-407b-48d2-a94d-2c1a441c4c8a", "value": "T1CCB2C0CCD8D83489CB8D6C3E779D82610E6D1291B6CEAFAED310DD99B1B8E0B3415076", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243814, "uuid": "372cb75e-2693-4cc5-bf4f-21883982c59c", "value": "768:cfrQlS07dEv0UXqUhvQE+CXtn5zYW6v7PkNZqCWv0l:oQlS07FUXqIYSX/zvSCqMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243814, "uuid": "ffc7d4ae-6208-4925-83ba-a871e3c858a9", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243814, "uuid": "5be258f7-e6e8-45d0-9ee7-b699d578ab04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243814, "uuid": "29d006e9-953d-4346-b67d-0dd491e9b103", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e84b9d37-559c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1751279284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279284, "uuid": "2fe20498-31e9-4654-84fe-1dc2533654ff", "comment": "Malware payload (Gafgyt)", "value": "8a797c80aa8d1568d51886f21d985b8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279284, "uuid": "271a3f9d-7874-446e-be31-45c037b54573", "comment": "Malware payload (Gafgyt)", "value": "09c8874da26ded7492d98d1cd423084a480409432adf6e4dc2e9397aa49dc26c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279284, "uuid": "a6327ad3-a6b5-4564-973c-0200afce6d60", "comment": "Malware payload (Gafgyt)", "value": "e3bd8c19484ec40506c4ba7af6da64ae28e51a2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279284, "uuid": "05687f8d-346a-47c5-a20a-bb9932786870", "comment": "Malware payload (Gafgyt)", "value": "80fee3c86e13839b2693935cfc058b17b3373059210bd2c0339756038c8d8394c45fad81f7958fc899d9a235eb6a1ddd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279284, "uuid": "4d602b98-6370-4a7f-8c9e-a5a267ff1c14", "value": "T105747D17F59084F7C4838AB22BDBA2B29C22F57E07723147B3947F696F08995265DBC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279284, "uuid": "f3cf0d94-cf9d-44eb-a35d-2f67c93f2a6e", "value": "6144:IML7xGRzlg1sCG3TG1Pp5ghpwUPtwy8Q4m5CYviSdS5Zj7FwtWSMuCOq7Ig0lD:IM58lKsCG3y1spwWtwO5JdS5Zj7FwtWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751279284, "uuid": "88dd571a-015e-450b-ace6-ba1c856980e1", "value": 346581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751279284, "uuid": "38d75487-60a2-4d30-b6f7-b08c57954ada", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279284, "uuid": "cffaaf14-34cd-49b5-acc7-f15e91649363", "value": "x-8.6-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a785e4ad-5604-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751323843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751323843, "uuid": "efdd7b8c-93f2-4cfb-bdb8-3a4981f5ca90", "comment": "Malware payload", "value": "fcf74e1d040ce26ad3afb39a4518e406", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751323843, "uuid": "5e6275ae-916e-45c1-a461-74e7ff9ecd7c", "comment": "Malware payload", "value": "09e7ed72fd4418855fa78f14d803724f0a45786a794e856508a0cdfaaad837ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751323843, "uuid": "273d4995-4b30-4298-b573-b4876d5869f0", "comment": "Malware payload", "value": "11a42465b19c7fbc9c5bd09a29fe54e8b89b7481", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751323843, "uuid": "25f24d8e-0e6d-49b8-b9f7-da130f90e62e", "comment": "Malware payload", "value": "95c46c457ef35d436280b245e8457ceb805c3c8bc5a7fd64d85882da4d17f9c39cd3aff8ddd215b28f1ac713e6dc9670", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751323843, "uuid": "de2b9172-375a-4c1c-9c68-2ecbc1a5a4d1", "value": "T1A1E4F1037308A756DF4BA83A82CBFD31B7C2799153D096627A80E29F8775726CF0D649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751323843, "uuid": "c9a4283b-6d38-42be-b13a-e1bb7516cf88", "value": "12288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751323843, "uuid": "852180b8-1657-41d6-aeaa-a36a8693606c", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751323843, "uuid": "33647f6f-43cc-45be-8738-b11a5a830c7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751323843, "uuid": "5ad2fdf3-d818-4b0d-9a03-7a254a2e61f7", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187aba9c-55b6-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751290103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290103, "uuid": "22bc8d12-3e8f-441e-a76d-5e6a104c8f63", "comment": "Malware payload", "value": "b4d9fbe0465cf9086dacdf90738b0017", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "Yakes", "colour": "#D5E68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290103, "uuid": "2d0a9ff2-b297-476e-856d-c9b50543911a", "comment": "Malware payload", "value": "0a711cc0e9a8c69b422e63e571966b0f2b86d62bd67f65c65a18c51496bb4fb0", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "Yakes", "colour": "#D5E68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290103, "uuid": "ef46af58-d8b5-40b9-8d47-9ad935259ce5", "comment": "Malware payload", "value": "9ce5287b2717b8d6f1ee6fdcc78f1b34d556112a", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "Yakes", "colour": "#D5E68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290103, "uuid": "d96e8a2c-d601-4657-b89a-9f5b65df9ad9", "comment": "Malware payload", "value": "415d3e95353c49153c5d0b30c22c243b993f31305f954e7e362e0655fdc76b6cbaa2d765d37307752901c503f9719929", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "Yakes", "colour": "#D5E68C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290103, "uuid": "31f78775-665f-4aff-917c-393e4617e439", "value": "T16693AE62BC05A298E03E48B24732D87A2657AC25DB8447E333C47F2B09759D15D3ABDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290103, "uuid": "bbd1e1e0-a1f2-4045-b675-adb8d28d1d04", "value": "850f3f109adb0dd163551ff4db9275d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290103, "uuid": "ca61d606-ba9b-4e11-83d0-99d58c1192cf", "value": "1536:MpcFWbtsOXLjbjTXNe2oP2U0pM13PTDvElbAi6JV2y/ybc0:5FWRsOXLjXjNZo/0pCDvElbAi6X5abc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751290103, "uuid": "e169cc5a-191f-4ea4-bc5c-7fe534dff5b8", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751290103, "uuid": "f6374821-a408-4a9c-ab16-1095132911c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290103, "uuid": "4f30afcc-408c-4f0b-b6fa-54f97557e17d", "value": "WinTools.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feaabfbe-55c4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (QuasarRAT)", "timestamp": 1751296502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751296502, "uuid": "e3b4f00b-23b1-4455-aae9-cfaef60f6803", "comment": "Malware payload (QuasarRAT)", "value": "69748e46a3a9b4e7be9c00d88b423444", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751296502, "uuid": "305e05fd-264d-4b81-ab11-5b7441ab7a2b", "comment": "Malware payload (QuasarRAT)", "value": "0ab63154ebadf443e91e45299cfc6fbcc07fffe8692744a493e3e8d67765aeae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751296502, "uuid": "4b7887f5-4429-451e-8efa-5670215874c7", "comment": "Malware payload (QuasarRAT)", "value": "b36f558e0374a0cb79073a6b408143be06fc8cd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751296502, "uuid": "6c08838f-a633-4324-87a2-b100d227bcc6", "comment": "Malware payload (QuasarRAT)", "value": "e8ba4965f1254c5a30535c40b85b33e093356a9ea746a149ac7ee3e7868b477c70ae9f4eca2db63ea3092ee7e10e60ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751296502, "uuid": "e5092d1b-3f1f-4b0e-9d76-17c453e5051f", "value": "T10726232DE25693E5FD6B90B440906588B5327636C2342FFF53A0E2339F172C49E2EB65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751296502, "uuid": "63eace54-cdd0-4a43-93a1-810067d2798c", "value": "a466125a9d0f2613cec3e55975386798", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751296502, "uuid": "ccb99b13-783e-4e3d-9417-3d3e3f3c5bb4", "value": "98304:cpccKr30UzppOFCeH7LF6RsL7VbHcKr30UzppOFCeH7LF6RsL7Vbb:cp1SRHzeH7LIIiSRHzeH7LIIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751296502, "uuid": "d4cbdfd9-c918-492b-9677-5fe3215b61be", "value": 4449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751296502, "uuid": "8df8ba23-5f45-422a-bb0d-d63fbb6a316a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751296502, "uuid": "fe10df99-3328-40cf-b2bc-228d1d20d4ce", "value": "SecuriteInfo.com.Win64.MalwareX-gen.31132.6240", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e715cb2-5601-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751322352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322352, "uuid": "4801eab3-851f-40b0-a5d8-c5d8c1264ec3", "comment": "Malware payload", "value": "df1c063f7e850636ea5fb1d9d675ab16", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322352, "uuid": "d558ca73-0f8c-469f-a749-394425725b33", "comment": "Malware payload", "value": "0c27d5c7d9dece98604098d407b9f61593648541f4ccf452dce34cb6b208de24", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322352, "uuid": "fcb9ded3-3317-418a-83ae-de87a5b35dd1", "comment": "Malware payload", "value": "d849a8a9b2550ad63aa9dda4777480e964072e83", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322352, "uuid": "fd052433-a07b-4ffd-8b63-61f27860bb40", "comment": "Malware payload", "value": "957caf3603b14cce14c8072ecbe7dc5832905ce7620ec61151fa3be8dce66cdbd92f05a223eb31cc629048b76851e4b8", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322352, "uuid": "0fbacb43-f289-4fa0-bdb8-4a636f371d2d", "value": "T10742DA4A55E3616228DB206A3BFB7204327940036105DD55BE9CE9C4AFD6AD7C4F37CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322352, "uuid": "d29141bc-3dbb-4740-b71a-cf9f20108d12", "value": "192:ZWte/5hF5GPRmiJTCR9UE45C0npYxKLZ9O4m9k4Dmuz7Awmi96Yo/bO2VeMa1ysH:XBhF5GPqR9UEiC0npYALOZHF0m9wm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751322352, "uuid": "b3fda99f-3277-45f4-95ed-f420f0af9816", "value": 12299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751322352, "uuid": "c57fef58-a901-429d-a59e-e6ae1c877d1c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322352, "uuid": "3a7ded93-f66c-4aee-8d63-9e4f4b2af6d6", "value": "Rogers Xfinity app.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1606a913-55dd-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1751306849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306849, "uuid": "be6c11df-0445-46f4-bc1f-21aedfcd4a74", "comment": "Malware payload (LummaStealer)", "value": "249c97401ac3a7ab4aea71e2f32d0761", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306849, "uuid": "15bfbc8b-fc5a-469d-be45-bf7839a92a5b", "comment": "Malware payload (LummaStealer)", "value": "0c68a33ec52bb0165ac0fe888ea29dd0f1cf9317dd209f2855a88b9a67b2a8ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306849, "uuid": "1d644125-58e0-4906-8197-e3e523ecff49", "comment": "Malware payload (LummaStealer)", "value": "28be877ba3063c32272d2fa272621dbc221c058f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306849, "uuid": "7471e786-b2ff-4f5a-aa3e-defdec8e648e", "comment": "Malware payload (LummaStealer)", "value": "cf647ba78db5fe70ef54e93b111450451e32d7577029e43c4130831230095c309a59a404d142b16ae1a3332c8fb74439", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306849, "uuid": "81c807b7-af8b-47ea-95fd-d9d3c7f9c33c", "value": "T12A853342B711F12FEE79403F0BE2FA1BBC545A969827AC6D9D1E26F0DB47BD9480C052", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306849, "uuid": "0d1ca6a1-25ca-4d22-8c96-be73e7efe0c8", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306849, "uuid": "0c9c2a92-b3ae-4163-86aa-ea96030a1d7d", "value": "49152:QxblJTZC5DXBHzt3JPWQObVuAZAFp1gafED0CLVi:QtvZC/TtZPWQOpIFpyrBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751306849, "uuid": "8e9d5d29-7059-43ab-a56c-05be563813b2", "value": 1846272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751306849, "uuid": "ba92b05e-450d-4ebc-a61a-9827df99f131", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306849, "uuid": "882d0d34-c296-4bef-ac9d-f0e32effa744", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c243d9-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751291217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291217, "uuid": "03aa2cd0-aadc-4903-af60-704e473879fb", "comment": "Malware payload (Mirai)", "value": "8e4b58bbef1f80565827f2143eddee3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291217, "uuid": "e19837a4-f792-449d-a7a5-7f487248188d", "comment": "Malware payload (Mirai)", "value": "0ca8a691e45cd68ffaac75e6c534192c249b407508b33c9df9022db792bb4844", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291217, "uuid": "0fb54067-f974-4cff-a01d-d8d5bef32b90", "comment": "Malware payload (Mirai)", "value": "536ca10ca02e58ed4ba588eeefbe98e303fe0a53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291217, "uuid": "605f3c59-7688-49c4-90bb-538c8a0fe95a", "comment": "Malware payload (Mirai)", "value": "f6e084e21d208c189af63ea2b46a0e37bc5a451365a9fb119ba798d1dc69f07c366b711bddf0e3e06771e3736be3ffd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291217, "uuid": "4fd085a4-d755-4487-bf90-07fdd813a0ed", "value": "T185334A01761C0A57E1964EF4393F5BE483BAE9A020F8F98C254ECE5A46B5E33454AFCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291217, "uuid": "a4c5454a-282b-47e1-b3a5-48293b1934b7", "value": "768:jE4mQlBLpyBCNVvPP0PtMRhcPhUv9Fu/EaKph2IwtSvVRsGmiE0wQKVT6YQb1E+/:jZpyYFP0lMw5Uv9Fu/qEGmXN5VT6j7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291217, "uuid": "ae36cffc-5262-465d-9b00-edd7574e0953", "value": 52872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291217, "uuid": "319457b3-5cc9-4fe9-ad2d-406c370527bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291217, "uuid": "e059e76d-c029-4247-b35b-0c4683adb8da", "value": "miraint.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "208aa581-557b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Stealc)", "timestamp": 1751264776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751264776, "uuid": "bbf5226d-79c6-434b-ab7a-ee1f2640fda4", "comment": "Malware payload (Stealc)", "value": "536b2f1d958927f1f02943b506953d3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751264776, "uuid": "e36bdc34-55d5-4211-b59a-1b78e5b26f39", "comment": "Malware payload (Stealc)", "value": "0d015d268579e35d78d97507be026748c63b9a91f4e5ff89474f13ae342a81a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751264776, "uuid": "7aa3f5b3-9a80-4b1e-af28-a0c334192e9e", "comment": "Malware payload (Stealc)", "value": "ec959fca2fe9addd4c5e972f501469edba086166", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751264776, "uuid": "eed6de7c-a1b8-4323-bbe2-c93edf3627a4", "comment": "Malware payload (Stealc)", "value": "7b77f22190aaf36779bac53af29246db97751186d3b7b984bbf6adda5d4783bdbf62134104dbb08ca8f1350a98c860e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751264776, "uuid": "3abde38c-2e2c-44ca-b790-76bf81835840", "value": "T1D3554A6C7290B8FEC1B5A030014ADB33A932B548150A947F1691DDE57B31A7E2FBDE27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751264776, "uuid": "613f593c-25dd-4151-837d-be81a0b61c65", "value": "458ce7e621e980abe5a894d55bd6f21e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751264776, "uuid": "c920f671-17df-43ea-a5d3-afd886a69e5c", "value": "24576:BkhgrbX7t5xhiPmdmwEtB7r4xdv2j3gCy14Q9VeWhyr5q0Ph5TLwmmW+NQGJRg5:yhvtxsxdv2sCy1bpoh5A3WMJJRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751264776, "uuid": "a0fd11b0-2ae7-468f-8a7e-c775bbb53cb6", "value": 1376768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751264776, "uuid": "726f738e-5a8d-4293-aef1-e0ea00794a09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751264776, "uuid": "0681e567-c86f-4fe3-9211-97bb66f67fa7", "value": "SecuriteInfo.com.Variant.Tedy.779917.18624.383", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "667a8386-5603-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751323305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751323305, "uuid": "53e6b404-4f6b-4186-a3d7-8fe70e1c9c0a", "comment": "Malware payload", "value": "87cac632953ad20bf7bfb0018db2917c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751323305, "uuid": "387104a2-faec-47ac-99ab-beee4739c0dc", "comment": "Malware payload", "value": "0d8cdcfb7876979025fbfcbd0ebe9d1b736e96e2be407af6b1b26a025421ea28", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751323305, "uuid": "0b7e9927-cc26-4217-b862-8c592f9fedf7", "comment": "Malware payload", "value": "28ff9622165fe42672dac2a887d7f3805a94be9e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751323305, "uuid": "5cb90b9b-8e74-42f4-bbd4-122bd4a30030", "comment": "Malware payload", "value": "e6e857e59207478519b804aaa6ee99d876ea78c2f9b65c3af79924308aa69df4f2883908c6e7bc92eeaf99207587f22c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751323305, "uuid": "34e7a718-562e-461f-8757-2dc4102757ad", "value": "T14441DB87578609B03F55AAAB762B884431D1915F1697FFD2AFCC32A8C0CDF4431A05CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751323305, "uuid": "f25de5a0-39f2-47f3-ad98-5dd04c7a375c", "value": "48:vsCTr+ssCkrXssC8rxlssC2rlS8ssCrrrqssCjrXussCtrMssCnjvrnjbF0ssCjy:vsWs4sFesPSRsSrsyvsesUnbFZsyrsKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751323305, "uuid": "aff0f9e1-85ff-442f-9a88-21fc4395187e", "value": 2113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751323305, "uuid": "d9e7e135-af78-4ed7-b6d1-c96023866eae", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751323305, "uuid": "321589d8-92e5-4247-bd17-2d3ac93120af", "value": "machine", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50d0b665-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751243812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243812, "uuid": "8271769b-8f75-4c36-b51f-a3b68298454a", "comment": "Malware payload (Mirai)", "value": "9ee69161e3a8dc8d0873f64fe2a3aded", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243812, "uuid": "17c93dc8-b4ae-4114-9a13-f1629e7df57d", "comment": "Malware payload (Mirai)", "value": "0db02954ce3b758204a8afac26eea800b9aaf195936323b2196007d8bc38732b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243812, "uuid": "803b8aca-cf86-497b-a98b-825bfb12831f", "comment": "Malware payload (Mirai)", "value": "ac663b5b695b3035139f0337c2d4427a307a2e28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243812, "uuid": "9490e042-c371-46e5-9eee-7081d5d500d8", "comment": "Malware payload (Mirai)", "value": "f5a6f35515f08bb563b8e0b60d79e51b9ade1cda0e8e9b1950606666e1c082b14dc89940fc89c042860999ae0f5ce86a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243812, "uuid": "abab743f-d767-4d4b-b198-0ddb0cb4761f", "value": "T149336C36E029DED0C6560234A4E88F751F13F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243812, "uuid": "708af0b5-fef5-4280-b665-707727e52dce", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243812, "uuid": "63acda7b-975b-4f34-b2b1-41984d1d64b7", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243812, "uuid": "9ee93e61-3296-4cb2-9e57-5c03dcbd80e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243812, "uuid": "5e62f64c-6582-4a1f-9cef-be426bfaccd6", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eae2652-55f0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751315078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315078, "uuid": "73c719ac-ecb3-483c-b698-ddb214f25d9d", "comment": "Malware payload (Mirai)", "value": "359344d140e5b77d1022bb5134396ca4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315078, "uuid": "869876d8-6f79-46c3-8eee-072ba93df724", "comment": "Malware payload (Mirai)", "value": "0e1abec6e6e3f556eb0145d3e1725ce021e3eee34f16c5533c69dbc9b6d54276", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315078, "uuid": "e1a70763-e951-4a7b-b5dd-b210b2f742cd", "comment": "Malware payload (Mirai)", "value": "4a62f5d6106fc07e20ca3087e313d5e3077b87cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315078, "uuid": "428a5697-83b2-4381-ade8-47f16df86d0d", "comment": "Malware payload (Mirai)", "value": "90cbd6136c9cce2839913703156963113e0ae63ab252d59baa17fae6f504326330279600c1c5382eef7d1539c9f3f6d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315078, "uuid": "d2d56ba8-0074-48b3-8918-9e86bf0e8644", "value": "T13BA3C84D6E218FBCFB98C23447B39E25A75933D636E1C684D2ACD6011E7064E245FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315078, "uuid": "f4d36e6c-dac7-4157-ba3c-e9c21b83712c", "value": "1536:cxvENPhx5PJOwkLyCUnH+ua+PzdbF9te+xReYVgcj4:uENPhxewqyCUeua+PBbReergx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751315078, "uuid": "7e24fdaf-7215-4d4b-ac87-e8cdaa31b199", "value": 101712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751315078, "uuid": "3fa9c534-d5d7-4e77-a2aa-ffefc93da0a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315078, "uuid": "a9c29bc5-b1ca-4ace-8f3f-2763f50460f3", "value": "SecuriteInfo.com.Linux.Siggen.9999.18280.31633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1f722cd-559a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751278388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278388, "uuid": "61b62a01-8351-4a59-89f0-70e4cf69a5af", "comment": "Malware payload (Mirai)", "value": "77b2bdcd78275bd64609a0e381daf1a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278388, "uuid": "9b5f0581-a85b-464f-b7f2-e82eb3b82f19", "comment": "Malware payload (Mirai)", "value": "0f514bd1571c0c23c126069ebcac062a0f1cbd050e0aeb6df118da3af36519b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278388, "uuid": "2c475432-5a7f-463e-a21d-da2deaea9841", "comment": "Malware payload (Mirai)", "value": "17ed02fcefe4cdc2f9e087f41eeae4b8c1dfa1f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278388, "uuid": "1f67c672-3f5e-46b5-9ad2-d522331ca7c3", "comment": "Malware payload (Mirai)", "value": "8bfd25beda2a1171f82b89c61ab6d6985408ebf01fbf14eed949771ecd76145a417fa2bbd756cfb12447339769dd9e99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278388, "uuid": "daeeaef1-7552-4aab-80b5-8ff7cb447662", "value": "T113744C04E9404F6BC6E12BBAFB9E438E73374BA8A7D771258D384EB033C1759263A551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278388, "uuid": "559e6829-59f3-4824-9249-0f9fdcf4fef9", "value": "6144:lwjDX4i2XgRv+qfJf9a0p6xY31Zy6Io2Q/4+/UIa5w+twifILjultL/CTZpfSmNd:i/4nrqfJf9a0yY31Zy6Lv/UIa5w+twzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751278388, "uuid": "82e2ee0d-5d45-4579-b457-0e735ee1e6ef", "value": 345098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751278388, "uuid": "ba2fa448-e3f6-4e8e-a3bd-dea4705476a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278388, "uuid": "320bd650-f7a7-41b7-9860-71f7033122dc", "value": "a-r.m-7.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "391fbf9b-5580-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1751266965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266965, "uuid": "cf0d45ca-2979-4e00-a90d-f59e95f2129c", "comment": "Malware payload (AgentTesla)", "value": "58761f1e54b62c228fdb5d6e9d32d439", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266965, "uuid": "b32514c8-5a1a-4f26-b1eb-bbfde043800e", "comment": "Malware payload (AgentTesla)", "value": "0fa72c5a3e33e04c1964cf0fe59d75340136b94a8452be3247fc5e2f54e8bd16", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266965, "uuid": "93beb70d-641a-4352-b894-57f49d315153", "comment": "Malware payload (AgentTesla)", "value": "27db028bc81350d64530dae33707ffc0a71664ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266965, "uuid": "48fa4b1c-8195-49c3-893b-f3a6ff22062e", "comment": "Malware payload (AgentTesla)", "value": "8f7c08eade72f96c16137c9e053ce074a809a9a8612c973a5cd4181b114f2350522b16c2d76894a6bd99297ca03a9ad0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266965, "uuid": "af1ec175-f594-45b2-bd3f-5177b5f2aff5", "value": "T19163DB9D726072DFC857D472DEA82CA8EA6074BB931F4213A46315ED9E4D89BCF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266965, "uuid": "5857be3d-fe49-4151-becc-76b87a50e493", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266965, "uuid": "1ffcb15e-74c9-4543-8781-30caf987e139", "value": "768:X6lHoTmpVmnroSC9DmlrRohO05NVJNxjZkCNYTjUxOmpAZyoHoNR0:qoapxSC9yLo/VJNxKCc+NprR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751266965, "uuid": "9e5c756c-b71b-4b2a-b124-5328e5b3e040", "value": 72704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751266965, "uuid": "2f00562f-14f5-46b3-bd47-30864d75217e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266965, "uuid": "153b960c-49ea-477e-826c-3944e4edf150", "value": "BZXCGAD0987678POOOH3.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c467fdaf-559d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751279654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279654, "uuid": "6d9d3d21-000a-44ed-9097-c305122e2847", "comment": "Malware payload", "value": "0370c951d6423d704141b88bbe941483", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Tesco", "colour": "#9F7CA7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279654, "uuid": "33e37d04-d0e5-4863-b17a-d45dfb7e3fbe", "comment": "Malware payload", "value": "0fad716dfb636e95feaf6b54f018d3b3337542970da77f7ef63de473fceaaf96", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Tesco", "colour": "#9F7CA7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279654, "uuid": "2aba9930-464f-4fa3-bf82-f0f455e778c9", "comment": "Malware payload", "value": "8f08919ba42c221f84aa20cdcc93f300a9be715a", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Tesco", "colour": "#9F7CA7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279654, "uuid": "0d6f67b5-6baa-4f4b-afc3-758acda83b8c", "comment": "Malware payload", "value": "63f0158ba94d5f52c9ce552e16107b8a59c44b95601d7468056b5fb512248b505a7427fd24705469a000415cc7b4d2ae", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Tesco", "colour": "#9F7CA7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279654, "uuid": "a182a97a-3fbc-43d3-8aca-79c7d0f4c117", "value": "T1DEC5CF8AFB45D8AEC0F7E6328275466A5917CC558B42E3874A59F23C0CB79D08B47ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279654, "uuid": "46f16ab8-a805-492f-b5c6-4e9aaa4bd51b", "value": "49152:NvxWvbQQq6fabmPITgxsShvaQmU9IL003WM/0Al7kHmEj6tD:KTtzSb2xRvFT9zYWMl7kGEj6tD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751279654, "uuid": "ed37fd3e-94fe-4613-9171-1b5b04524976", "value": 2734989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751279654, "uuid": "4cfd502e-c6f6-4a04-b069-4c624f30d7ee", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279654, "uuid": "deba88bf-0a7a-40e2-86c6-8aa1c1e03e96", "value": "app (6).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1cb0569-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751243947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243947, "uuid": "126806d9-5183-4610-8c60-dcba1dcebcdd", "comment": "Malware payload (Mirai)", "value": "b73ff3cccb79f62897498420b8582e0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243947, "uuid": "47e6f360-ae09-4664-91d4-1efa4aed484e", "comment": "Malware payload (Mirai)", "value": "0fff242411a906ef28960fa1393af6c9597ed888725a4331aaebec444cf4afff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243947, "uuid": "ed9592ee-b50b-4a4c-80d7-7c3882d3e99f", "comment": "Malware payload (Mirai)", "value": "a82897b86534e506448686c6c0641fab69300a56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243947, "uuid": "61fcb004-e5f5-47f6-94e4-b55e9318f39d", "comment": "Malware payload (Mirai)", "value": "2c690a6fac48965216e8c16e25d179563e298a26818bc4f9da354055a36cba07d4d7b4648e24d046fa916a1161b8262f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243947, "uuid": "62b9dbfe-74d6-4575-87f8-151df2d7c66f", "value": "T1CF5309D6F810DDBDF80EE77B84970809B231E79206831A3627A77967AD752D40933F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243947, "uuid": "1ff82426-8d17-4875-b1ac-26dbd06bc465", "value": "1536:AnODknzKIXnmWN+j82KPcPm+1CiVseFvfgYc6qCdYxy:AOqXmWN+YC/xWedLeg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243947, "uuid": "061685f7-ceb2-4c70-9d88-cfac4fdfba98", "value": 63392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243947, "uuid": "5b417ef6-06c0-4e13-bf5d-15039170a808", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243947, "uuid": "57a525e4-52fa-4a06-80a0-7e8f20af0f85", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f799357-5596-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751276532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751276532, "uuid": "ab656fd3-ad84-4cb7-8c1f-3c74ba32dbac", "comment": "Malware payload", "value": "092668aa97159774361585d44fffe239", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trust", "colour": "#F1EEAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751276532, "uuid": "10bc9152-1419-44fe-85c5-bf945a1085f4", "comment": "Malware payload", "value": "100fcbf67cdf58729e28ce8554ed7b0ff28d5555df9a9f0648b5c0ae97eec853", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trust", "colour": "#F1EEAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751276532, "uuid": "1f5cf0e7-6bba-4e6a-a19f-e2e10a6e58e1", "comment": "Malware payload", "value": "9416215608d4bde980044998ee13992b6a346bd4", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trust", "colour": "#F1EEAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751276532, "uuid": "495bb3a7-cff0-4783-b3cb-7acfeb7ddcf0", "comment": "Malware payload", "value": "b1a77f085781c2a8a13626babcfff408c41c2e97ea23f830580893ef3ed7ed6f23591a3dc9bc5100b7ef46f6d75fd64b", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trust", "colour": "#F1EEAE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751276532, "uuid": "11483203-60aa-4898-a9b3-c70258fb240d", "value": "T133E5D08AFB0598AAC4E7D63346B542264517CC668A43E6835A55F27C0DB7DC08F8BFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751276532, "uuid": "7dcfc8b5-622b-4b7e-b6a9-434ba429e283", "value": "49152:u4taMhINn29MhINcYUxi1XlIg51YKBT4tIIYlAa7/A3qpI2AUFIO0AY7kCDfvF5w:u2aMhIlCMhIwxiV6g51Yxtpw2qyr3x7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751276532, "uuid": "97f6d7ea-e095-4378-8397-264882c26e28", "value": 3052876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751276532, "uuid": "6032d317-479b-4e03-a308-5459a34dda75", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751276532, "uuid": "28a18fdc-aca5-4f2f-b98c-fc4f66aaad34", "value": "Trust.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55a9ed81-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751243820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243820, "uuid": "cbb804f7-415f-441b-91de-d8ac4ca9a8e2", "comment": "Malware payload (Mirai)", "value": "1594593c2341ad4d7a4796692e87f3c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243820, "uuid": "8d97bbc1-33c3-4940-a650-b113f178312b", "comment": "Malware payload (Mirai)", "value": "110b710722c16f2a4f31ff763542f9a1c3933ced5d0526ac7114a04f36285257", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243820, "uuid": "165f2656-6c74-49d3-8a50-0558fdde0e37", "comment": "Malware payload (Mirai)", "value": "400697af94ee08a0a3f8948991a9c4c33ec148ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243820, "uuid": "76594a0f-2c32-4609-bc69-f3626c31f21a", "comment": "Malware payload (Mirai)", "value": "9f6e4fdddbaa3e6591d9e8b765c3dd2af2572d05e498b337f8b68fd191d5b581feaff4a8667bff2295f88b7ad1b57995", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243820, "uuid": "d0b1afa7-bf77-4612-a2e9-435d74a03d66", "value": "T1FC434B02730C0947C2A36D70373F13D5D7AAEAD012E4D584795EEA8ED2B2E721686ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243820, "uuid": "c1c3e8c3-2d04-40f0-a6bc-f7cec3c386fa", "value": "768:s0RFYVfpaAkXX8omCPBfN+Dg6IOn9Ne0Go/NltLnI/CxF5stza+55IB:tRxA4XpP9NbZO9Ne1wNLnIatsxB55G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243820, "uuid": "bfa58abb-cd75-4797-a223-04c0496159a4", "value": 55388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243820, "uuid": "294ef3ab-0a03-4ba4-8352-81fec4e2e129", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243820, "uuid": "7dde831c-3982-4bf2-a12f-a437981a0e35", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c1d95e-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751291205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291205, "uuid": "f4418ec1-6478-4e67-a262-f618c9bfb7f1", "comment": "Malware payload", "value": "0edecc8c7a96f7e10dfc9b51a139c631", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291205, "uuid": "10cd2b8b-f8cb-4e37-8490-55adcf0cf5c5", "comment": "Malware payload", "value": "114164b85e0ca633a06b5b49a8d008a01b5724e2c28bcb01d636bf368ce52679", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291205, "uuid": "e2a58063-361a-4275-a0b7-0f495ac976af", "comment": "Malware payload", "value": "e1477d6fb62748b734099e17f7191c99a5f04b74", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291205, "uuid": "b980ea6d-768e-4933-bf76-783ea5e8dfa9", "comment": "Malware payload", "value": "ecd765bae01640477b78815a25b4b9a081fcab98524d294aa1140b05d55727fa2ef30e0e39a817a582695139fce0e350", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291205, "uuid": "1ac146b5-90da-4cf1-825c-87c8ed076a49", "value": "T1CE41C89657534CB13EA96E2B731A880934E0D58F178AEFE6DECC31B490DDE0835919C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291205, "uuid": "2343105e-394b-4e8f-936e-d896efbef233", "value": "48:vsCxrEssCFrossCwrzssCCUrCdssCwrDssCArG+ZssCFrbr0ssCUrvekssCW5rWU:vsisis8smsksssqrZsCJscfsgsfoAf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291205, "uuid": "d8227cbf-e963-4280-a227-411e47c77aa2", "value": 2113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291205, "uuid": "f367219b-9ca5-464e-90d7-7b924751dce6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291205, "uuid": "1ffec516-e0b9-4588-8615-567f09170646", "value": "machine", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51cbef02-55ae-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1751286763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751286763, "uuid": "4b19dd98-cffc-4d54-82c3-363356b48ad3", "comment": "Malware payload (LummaStealer)", "value": "55180734655a81f0d4691668481b45ab", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751286763, "uuid": "68dd80f1-9d37-43fc-bbac-19aa93c3b166", "comment": "Malware payload (LummaStealer)", "value": "1192a819c03b0b987d793304112eca75987bc8785410a6648e970f63f0676282", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751286763, "uuid": "daafc2a7-e79c-4f62-b827-eed11e7488d8", "comment": "Malware payload (LummaStealer)", "value": "5e4c23d00dfa6b57133ead0fd89631cb9dc19c93", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751286763, "uuid": "93256628-12d7-48ae-bd68-1f845dcf4581", "comment": "Malware payload (LummaStealer)", "value": "5a897482971765daef7ba550e172adc9efc10e35a7cedbf5b368b6740156d9274d8c6c37e3cd56fccc5721a50eae5771", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751286763, "uuid": "38a65f7e-a9c0-4701-a0c0-df5fd6bf75e4", "value": "T10A17332EB258FAD4D9E05B57370484C77F73106323E32D9171ACBA9FAA10DDB2993A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751286763, "uuid": "cf91e96e-f84f-47ec-b2d9-d2a0ed004b8b", "value": "393216:6qSTJWaeCtPq2IN5iRvxFRO+Edo6Ydg5l59+zXmDrToOW:6aaNy2A5iOzTY8l59NI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751286763, "uuid": "dd08ec10-59ad-4690-83ea-9818e41d8388", "value": 18600738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751286763, "uuid": "f408055b-ad6c-48c8-a17a-e431d0907bc6", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751286763, "uuid": "4eed8998-6f0d-4316-9a7e-4fea8fe3d49e", "value": "\ud83d\udcbe \ud835\udcd8\ud835\udcf7\ud835\udcfc\ud835\udcfd\ud835\udcea\ud835\udcf5\ud835\udcf5 \u2022 \ud835\udce4\ud835\udcf7\ud835\udcf5\ud835\udcf8\ud835\udcec\ud835\udcf4\ud835\udcee\ud835\udced \u2022 \ud835\udcdb@\ud835\udcfd3\ud835\udcfc\ud835\udcfd \u2022 \ud835\udce2\ud835\udcee\ud835\udcfd\ud835\udcfe\ud835\udcf9 \ud83d\udcbe.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2677ad5a-558b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751271658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271658, "uuid": "1f0d8620-de26-4e28-b35f-e5822ecc4ccf", "comment": "Malware payload (Mirai)", "value": "cffe3baf880a16c9f2187d8f893cce6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271658, "uuid": "b43bd095-3794-4dc9-be02-97af788aa56c", "comment": "Malware payload (Mirai)", "value": "120db0b7f880498bc6a4169056a86a77d3f6723d2b4e22089467e738ef1f707e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271658, "uuid": "f1854636-5db8-4c74-a40b-3e81d8420c60", "comment": "Malware payload (Mirai)", "value": "03e5c18627b3f5fd9e1205b613afbcc51b0b8c10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271658, "uuid": "811597e7-b4a2-44a1-aa0e-9821c02a9ee1", "comment": "Malware payload (Mirai)", "value": "7cae79a4bcbc761074f78bb24c50a00d38806cbeace46e7e89016fe485933c3a1eb8c1c6bc3217e1d2e8a6c54b049e8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271658, "uuid": "793a4de3-7576-4b35-a1a7-6ba4dd802f55", "value": "T18CC34B1774C181FDC8DEC1B44FEEE136EA72B46D1238B11E67C4AA261E8DE205F6DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271658, "uuid": "abfa6d4f-f9f0-43d5-815f-1a025cd5787a", "value": "1536:z962YHEa8AO4Xv0pW/yvzLoJljX9Bf/JbudFvExenZY2YooNEA336Si:HYIQXT/MOlj3f/JbuHcQZTYZ5ng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751271658, "uuid": "e00396c7-d4f6-4e31-aaf2-f335a6db6dc5", "value": 126744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751271658, "uuid": "620fffae-d93b-423a-88a6-70546e4379ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271658, "uuid": "9f30e632-6ae7-41ed-8649-ba5498b4a193", "value": "cutex86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb940a2f-5571-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751260848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260848, "uuid": "f135140a-be20-4dfe-bda3-42b92b7b487b", "comment": "Malware payload (Mirai)", "value": "79dfe9858b96233e017c402480ccc644", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260848, "uuid": "766d6acf-c055-44bf-965f-1ee4263401c9", "comment": "Malware payload (Mirai)", "value": "121cdb9db8f95d8825bd9946099d64a01592011252fe89a85f3808c0708b707a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260848, "uuid": "8d559177-ff6b-49d8-a502-a3f2129a1b75", "comment": "Malware payload (Mirai)", "value": "29236040ade98406bd56ebcce97a1b259cedc400", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260848, "uuid": "f4fd2dbd-f695-4e75-938e-b38361ebc0cb", "comment": "Malware payload (Mirai)", "value": "a1926ba1ee5873f818109b4297eda752c70f80c8830d374d57acb6cc93ef931d95b61b903941436c9e3122c27225087b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751260848, "uuid": "701bc080-862a-4012-9647-b6716745ee13", "value": "T18BC31866AA419B10C5D725BFFA1F958973234768E3FF31029E294F3417DB92B0EBA101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751260848, "uuid": "d3bd7ac1-4d8a-42bf-91e9-80ec2748b349", "value": "3072:qmcXYMIxhMq10LO/TUB43/MXayDhOZcfB5JLalPUalb:VcXYM+hMq1kO3EXayDhOZyBfahU0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751260848, "uuid": "e2c36a63-2c7c-4a4d-ad65-2a80c7198c43", "value": 126124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751260848, "uuid": "9766e009-60dc-435c-9ed1-489c6345c7f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751260848, "uuid": "916d9e5b-4f3b-43ee-a533-fb6074e8f2fd", "value": "rondo.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f1d986-55dd-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ExelaStealer)", "timestamp": 1751306825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306825, "uuid": "22923c04-3902-45a5-85aa-5da14afe0587", "comment": "Malware payload (ExelaStealer)", "value": "aa13892db6c19256c1f75537f9e30dbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ExelaStealer", "colour": "#4DB216", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306825, "uuid": "b19d1934-2999-4cf9-a86b-8a7d6463cada", "comment": "Malware payload (ExelaStealer)", "value": "126d168549578cad4d37c87fbe0d85f5516c0449e82f19314c5c07bace902797", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ExelaStealer", "colour": "#4DB216", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306825, "uuid": "8a4b8c67-3cb1-42e2-9d8f-8785100e4815", "comment": "Malware payload (ExelaStealer)", "value": "0ec3f9812d4b461abffeb3263f0803f781c3e4d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ExelaStealer", "colour": "#4DB216", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306825, "uuid": "9e37c057-bb23-454c-85e5-88bcdd9ded39", "comment": "Malware payload (ExelaStealer)", "value": "0b528c7ae3f764e32ef79e74a2186bb64e0d423449b28dfcd9183bb7a825550a7ab038b4e56aa909664f7c5a880822e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ExelaStealer", "colour": "#4DB216", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306825, "uuid": "417a8dfa-e3b6-4ac6-94de-8196e2f297d6", "value": "T13F17BB7A869DEA2E8078F76AC42725D2174CAF27B1501B705CE5C3E11DB92D0B38F762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306825, "uuid": "6b1aa58a-e138-44c4-8fa0-bb5b893cbd78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306825, "uuid": "a0eda9e1-9260-4355-b247-f11a143148cb", "value": "196608:yqf68sncSvyM52wMdW/gW++B5zgpQoB+WWVMBRJY/n/GHlCz8eZoVwbGbNjcx0q8:lfRshRsjdWrX9MfWy5W/n5Zwyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751306825, "uuid": "4a975d0b-7105-427b-8bb5-60e281d75aef", "value": 19040256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751306825, "uuid": "4404336c-0d6c-44db-a149-f2bc75d7e809", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306825, "uuid": "5e61a320-2f53-419f-895a-ab6573a186f6", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1fd9d1e-55b7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751290897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290897, "uuid": "eb1b3737-7c59-4b5e-a3da-e283c2be15f9", "comment": "Malware payload (Mirai)", "value": "7830b446e57a302aea91f4030ff074cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290897, "uuid": "c7590128-279f-4d64-826d-e892200d63c6", "comment": "Malware payload (Mirai)", "value": "138007d8f4108716b76597e10da389508af7d7d31d3b03c897c4bcc3243b2056", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290897, "uuid": "8f098bc4-6e31-4b19-a7d1-79ee2a7cbd2c", "comment": "Malware payload (Mirai)", "value": "b16dba0a3939549f546c111453dcbaab8a0cb3e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290897, "uuid": "675360a0-0b50-47c9-9f6c-f205c49d24b5", "comment": "Malware payload (Mirai)", "value": "b92f690cada78f241040ed43ef516d677a824a0799e0557ec160a84943edb5cabb3040b64f155de509f32c507b792587", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290897, "uuid": "cdfb4b81-1826-4779-852f-9d7a418bd496", "value": "T1145318C1F98B81F5D80B4D3061ABF63FDB31D539407586AEDF5AAE35DAA360152032CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290897, "uuid": "66095f1b-7362-4aea-8910-4edb9fe14122", "value": "1536:Mj3wzNKy8oMIuLVnOpYIcm5nwtlUgtv6GUX1Ub3lci8pDDDDDDDDDDDDDDX5DDDg:MjS8oXuZnOpYIf5wn9p6GUFUb1c9pDDu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751290897, "uuid": "7d2e8020-acde-44f3-b51c-810067c57301", "value": 63268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751290897, "uuid": "e348d2bd-1f3f-4e73-b44d-c65fbf4cf9a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290897, "uuid": "5637efab-b17d-40e0-b4d3-43a22e8b1c88", "value": "mirai.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "131df40f-560a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751326171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751326171, "uuid": "7af08454-732b-4736-b5bd-a64c2b7d089e", "comment": "Malware payload (Mirai)", "value": "2fb8be6645e9c41ded581d5afdb5464e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751326171, "uuid": "f503e2d3-110d-4dae-baee-f77063a373f4", "comment": "Malware payload (Mirai)", "value": "1410ad8f8f0a5e85c3f64172115591f8899bdf25263b71997efaeb3ae5e49dbc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751326171, "uuid": "c7260785-2525-4494-b60c-e71c3a6ddf01", "comment": "Malware payload (Mirai)", "value": "c71f0228d11e8a45db6edb91b096bfc9dc039e6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751326171, "uuid": "b5f0f090-31bf-43f9-b0c2-ade9b5008fbe", "comment": "Malware payload (Mirai)", "value": "4851da26773f0142ccbc8a9ee8d3b66c0989e69b970f736ec246f2dc1667e3d189aeac37ba09a6ec64dbfaa8248a3c42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751326171, "uuid": "b7be6266-cdfb-46c6-9a44-a3bad05aa9b3", "value": "T1D8F2F242FEE69B1BD36D10BA4C7A7B4F8C30B4644A5B9DC0C593B18BD654330BD15B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751326171, "uuid": "0983a4f0-a27d-4cea-99a4-620c9ac4b124", "value": "768:H3IA1SKI0E2MjTLBQelQVqdb+01tmS7hjgXDHTUeozZnVC0gnbcuyD7UHQRjd:X1I52MPHQojboU9CFnouy8Hyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751326171, "uuid": "a776c230-3a49-479c-91b3-ef74bfb246df", "value": 37376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751326171, "uuid": "c6f89761-cfb6-4d5d-a16b-a7a8eb3bc569", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751326171, "uuid": "bc710fa4-4935-4c33-8f19-30a4d93a511b", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87338089-55e1-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751308757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308757, "uuid": "a957dc58-1d43-4f4c-9ecf-41c453e9a528", "comment": "Malware payload", "value": "bf635af5869f788dec9b161396629a60", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Wisdom", "colour": "#175048", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308757, "uuid": "d9680314-68d0-4f72-ac4f-5c4a13bea764", "comment": "Malware payload", "value": "1641a9e4d764822922bba03acbf909c14396e9a15c69326e45f694939d0d5612", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Wisdom", "colour": "#175048", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308757, "uuid": "c44683df-ec5a-4c84-8dc9-e82b17f2a3e2", "comment": "Malware payload", "value": "1fabb91c402bf820ea85126d2a5a7cebfb427562", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Wisdom", "colour": "#175048", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308757, "uuid": "006a4872-6589-4c07-89e3-73faf0a19e09", "comment": "Malware payload", "value": "2a355f98d1811020b6d63671a3dd2b067875e7af0a9146b043931f239d5164fc7f68f8e419c9374542a3f5e7360a1a12", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Wisdom", "colour": "#175048", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751308757, "uuid": "2226eefb-a2c4-43b0-9cc1-03f3db81aa38", "value": "T1EA6602DAF7E89A2FC47710B28C6A52B1165B4C12C7479F576A08331C787B6E80F49BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751308757, "uuid": "a9d5d1f7-7207-4555-a71a-9a7a00467de5", "value": "196608:dDcwjp0Im02uhNzex7DKRo/7usBbchNovwWSI:dldHOONSQRo/nBwNovMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751308757, "uuid": "c8344e3c-c6b9-4329-b7d0-d67dfcac3be0", "value": 6536894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751308757, "uuid": "8957081b-5c68-4a4b-9aa1-7ef40bdfde3c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751308757, "uuid": "174d9165-f038-41b5-8539-7206e2de2f77", "value": "Wisdom.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1441775-556e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751259408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259408, "uuid": "3a25d068-fe98-47d2-8fa2-18e8a659f293", "comment": "Malware payload", "value": "2a72cda0eb0d09c96225cc296ea75a81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259408, "uuid": "f3d210d2-bf68-48ff-b15a-d06575765cf4", "comment": "Malware payload", "value": "1727385ac1b3f95faf325b622c1e8d5cb184d1f476f52486b2e02fa785596523", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259408, "uuid": "34854a3a-122d-4dc3-bad9-43a9a3cbf0f3", "comment": "Malware payload", "value": "3dc4ca2d30eb3b2366d099b44f37ff4ddb3474b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259408, "uuid": "b9cc9d33-6af4-41ba-809a-e863c7beb4a2", "comment": "Malware payload", "value": "34334bc81828abedffc4ab2e96eaa08a0f92617a3da755ffae515847d27a4d5b24e9b6fccbc1336b6129d5b2c98aa266", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751259408, "uuid": "ac090e8d-92f2-46e2-9d19-a44155879493", "value": "T1E8B402018F881F8BC5AFCD750A2E167311AEDD9F46CA643E807CDD48B6A6D0D6783C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751259408, "uuid": "102f6623-4739-45fc-810a-8b81b6f91276", "value": "12288:7A84JF9Qc8GgZxTM6m1U3snB6NnVuqnAtSyBpywBdlEykR6LkV6N0L8AXwtZJHZz:/M6m1U3rVuqAtSySwY1gEIZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751259408, "uuid": "cfde64eb-be0b-4b17-af40-de5856f36d02", "value": 509272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751259408, "uuid": "ba2796c0-c0ed-45a9-8f6a-9dafc6c367a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751259408, "uuid": "906fc53a-9112-4691-af73-7e27faab3678", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56552c1a-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751243821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243821, "uuid": "6d9ffb0a-7b0b-4148-90c1-abd6f8597b24", "comment": "Malware payload (Mirai)", "value": "84cbde8b71cb37f7413af17a729f750e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243821, "uuid": "63642f7a-e535-4ade-b478-a9c8e814cbf6", "comment": "Malware payload (Mirai)", "value": "172ccf3d6e862a650f5d3859e99862c3a498aa74b74049bbea8744e303be49ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243821, "uuid": "7796b701-33e8-49b0-91b4-1c6840c9b669", "comment": "Malware payload (Mirai)", "value": "fb37abfe509d5579f133f7ce9f87ae392070bdd2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243821, "uuid": "31ebd7cb-e429-4f70-8e20-c950844b8b16", "comment": "Malware payload (Mirai)", "value": "b02384e14463a4026f5365bd7d7cb3b3cafed46f789e4b7a6cedb9e0fa8c1e85af4425d65b558027b8b2580471517c23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243821, "uuid": "9054693f-a1d8-4cae-a28d-e241fc094342", "value": "T18AA2D021BDD61A26E779283CC6268161A75B1BFC91F8307724101A30CACE76A1F35FA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243821, "uuid": "6ed1b485-c356-4df3-b123-9befd26e9144", "value": "384:TvtIoZxrSniaXs+qx+bwqPXoeB0QhAkYlCQTeLE3bGvAzwhymdGUop5hq:TvQn4j+SeL25lCo1bsAzws3Uoz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243821, "uuid": "7485a510-f383-4638-9d6f-aaf2240cf11f", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243821, "uuid": "89e04e79-7315-49e8-bc07-2afc09c9e56e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243821, "uuid": "31ca8d41-bc52-4f4b-bbe0-128cdf6a8ac4", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fec34dd-559d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751279485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279485, "uuid": "d841c520-d103-42e8-bec3-8248525425f5", "comment": "Malware payload", "value": "035907bd93ad36100a484d157b47f2cf", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279485, "uuid": "f52aea4a-78fe-478a-a5d6-5ae8bc3ccbc1", "comment": "Malware payload", "value": "17574320d84b8449039f50df5ac81a32df59ad8edf7b766e5b507af2de63a6ff", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279485, "uuid": "3be36290-5cd8-4839-aa17-3f2abb5fe86f", "comment": "Malware payload", "value": "0ac47c0e9889c09619959a22dc9568089ce0f3ea", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279485, "uuid": "5baec5de-40b6-4f84-981b-87b9d9b63d64", "comment": "Malware payload", "value": "c88184eb58743af1142657bb2a3bb020de8c0d2f1c803c2b47e75ffe03f100c2868005dbef7d3496fc9b555b80f78701", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279485, "uuid": "d1e85f13-e6c4-46fd-852b-f981180d85ff", "value": "T1C227339BF64AFA26F4F3D7319336068B5A088D95C543EB071B49B22C1DB79C05B89F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279485, "uuid": "c3087ff2-dbc5-46a4-a514-ff535d01f361", "value": "393216:zKWhw+iAencs0qW2k3IY0Mm5MsoaaWdSsp2zBN66eECaxoHJUNtKLZNh0a8YzeLP:J6chqTk3L5aaWdSwkAAqiNtKLrhGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751279485, "uuid": "f83cb5de-3da8-40b8-9a87-389fdb561d29", "value": 20623863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751279485, "uuid": "cb4eb559-294c-4849-848f-e1d7672c03ac", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279485, "uuid": "5da060c8-297d-4b10-a4f7-0199d72f5884", "value": "TikTok Shop.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d9ab186-5590-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1751273871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273871, "uuid": "d4c36b72-e91c-4b7f-8b0d-2535413b4cb3", "comment": "Malware payload (Formbook)", "value": "4970215f74474d6ab4581f0bbee63012", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273871, "uuid": "6eeb6df8-671a-4a43-bf93-3b0ea7ce98bb", "comment": "Malware payload (Formbook)", "value": "17fe773bae9caedb3226b513661ca9bb4e217de47206f40e929b67bc202b5c5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273871, "uuid": "bc1b03c7-8b75-4283-9d00-3c605534bdd4", "comment": "Malware payload (Formbook)", "value": "61c89334d75243eb69b599a3bbe219eb210ac857", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273871, "uuid": "a1465803-5915-40e4-80d1-e6c87614c413", "comment": "Malware payload (Formbook)", "value": "bdb6bd601a09d827a90716c9a4b920da0470a71b3ff9eb6ac5069281cfdbaf52d655bffcab47f35c104109c6ac103ba7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273871, "uuid": "902d0f39-be30-4c61-831c-f844a2c84fd8", "value": "T11455AE3273818362FF9B9D32CB5EF21D567C6D260123A51FD35C2B79B9F00A1462E662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273871, "uuid": "ae0082e6-0eb1-4476-8232-ce50c8a8e44d", "value": "0b768923437678ce375719e30b21693e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273871, "uuid": "923ded9f-d06f-41b6-bd25-056688a783d8", "value": "24576:K5EmXFtKaL4/oFe5T9yyXYfP1ijXdaW4dEDDT/+55TwtZT3kDVlfuRy7T:KPVt/LZeJbInQRaWEEDHm5UzT3kSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751273871, "uuid": "a4a28658-ab03-4e49-a550-391b5b5a4a91", "value": 1348096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751273871, "uuid": "4cc700af-d4c0-4034-acb8-b90eee2399bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273871, "uuid": "cc1fbfd6-d628-4ef9-91f0-0a8db4de368e", "value": "PAYMENT SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1aaf46-559f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751280393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280393, "uuid": "ec518f4d-7800-479b-bd88-c2b28b99a959", "comment": "Malware payload (Mirai)", "value": "525230605ddf6d479cdbbfd3b65d4b58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280393, "uuid": "3fbaf66d-13ee-42c6-8d57-724154a808f1", "comment": "Malware payload (Mirai)", "value": "18041126d0a7acd4d15503786777b3de56b2ae10cb23448c7014b453aa2450f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280393, "uuid": "f2d2f6e9-95e6-49b0-bbc4-c13b67177718", "comment": "Malware payload (Mirai)", "value": "4590479249248c8144ef653bfb8a3b04a52b20ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280393, "uuid": "c1e1304a-f5ba-4a6d-bc13-08295c5fdab6", "comment": "Malware payload (Mirai)", "value": "01780cb076a8ac812099ada1d19cfde710b30ad502897a64d9c310a16600a4a9d10b84f02e16dd6472b7fb8c1bf74c77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280393, "uuid": "49e561bc-5ba5-4151-80d3-06955172e1aa", "value": "T1BB743A05EC004F6BC7D16BBBFB9E43CD363A5BA897DB721299255DB027C2B49223D190", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280393, "uuid": "696907f6-58a3-4d22-a959-027539798d3c", "value": "6144:ksOry4qrk7gI9ebm4yjQHairblB47uy5w+twifIQ7aFMOUT0KSvjjnK8sLHcZ6+y:faCrJm4U+947uy5w+twYKYTPSvjjnK8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751280393, "uuid": "b9820cf1-35a8-40ab-a7af-03d03fddeec6", "value": 368845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751280393, "uuid": "007110b6-3f58-43d9-9b45-0aeb91f19f4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280393, "uuid": "f6888369-ba06-4dba-b78c-c1be2f602f2e", "value": "a-r.m-4.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2361fdaa-55d6-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751303865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303865, "uuid": "65b6bd74-3e9d-4ab4-b077-1aed629f931e", "comment": "Malware payload", "value": "78bdda706a1d99802fa3c9c3d19460d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303865, "uuid": "9e9d06a0-75fc-44f1-9f95-4a80824af64a", "comment": "Malware payload", "value": "1821cb62914a9f3bc33840abf1f93c768701df52c400105ee01c258a06dfe7a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303865, "uuid": "e3a4bbfb-90c8-4bfd-b913-92453772a3a5", "comment": "Malware payload", "value": "f7a6e6c2987ab281cc75c8d033e2b99617a05692", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303865, "uuid": "3f589311-09ae-4ea7-89b2-5623bdbc3599", "comment": "Malware payload", "value": "a2f7c57ee0a04641ff7f433cf34a7da6490289ab77dfd5c7985f1d86596e7832aa855b00a8953d03be718b5daed5676c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751303865, "uuid": "824891d6-73d1-4387-9125-0116c039a7a7", "value": "T131C4F1A377204F90C35195B209F389335AF6199706F39982537DEE107F20A68386BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751303865, "uuid": "5b529a61-74d5-43e9-8e97-dd260ea83335", "value": "12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7zD:W7v+mrY2xzf03yvZ/YIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751303865, "uuid": "3a5a2266-8c8f-455b-9fd8-d8c2a6c6d155", "value": 592688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751303865, "uuid": "ffe02d4e-d80d-4735-8c90-5518bfeb4761", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751303865, "uuid": "62f434f8-f328-4143-8f10-b57b3b23e237", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dba4af15-55bb-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751292578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292578, "uuid": "31af4152-46f9-4ccf-a8d0-b21dc46c9ccf", "comment": "Malware payload (Mirai)", "value": "f9a9c6c71e31c14e77922e43a2fd5b11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292578, "uuid": "dfe0ae44-0620-47ef-ab66-a2ae4327b67d", "comment": "Malware payload (Mirai)", "value": "1834ccdfb7b36380d7f44853939fd1686dafdd47e8279aa096de04c568b1ac77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292578, "uuid": "3053d077-66d8-43bd-bac1-6f254a297e66", "comment": "Malware payload (Mirai)", "value": "08cbe8d8ab75122c1db49d370d55df4f67074570", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292578, "uuid": "34dd314b-4d2a-4a7e-a355-f3d380c25d42", "comment": "Malware payload (Mirai)", "value": "31c80910c5344fe982ea91075138f68f3bebb6d54313c91c27a4071f0f088735ac8b53d161fc4d2f6ea89dd8934368e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292578, "uuid": "a9c2f8f0-449f-401a-a786-16b5fd7d570b", "value": "T1CCB3D709BF611EFBE85FDC370AA9070624CD695A22A93B797534D818F24F24F16E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292578, "uuid": "a45c9100-b90a-4dd7-8cc5-e332411e570e", "value": "1536:g5anyQpqfd33r2A7MfvfJj8BXyTWr1AbtIbJa2RS9ZzAGGzGhb9vrXaAmfN:maPSd33r2A70E4ObJa2I9gGHwfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751292578, "uuid": "60d5cb05-b232-464b-9201-71ff25bf3886", "value": 113860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751292578, "uuid": "d1b56036-0a3c-4c29-86cc-19fd9fe70654", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292578, "uuid": "59bab6b3-81dc-49b6-81a8-943b4b707965", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d559c8-557e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751266016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266016, "uuid": "62823e80-bc57-441d-acf0-82a2276a6af2", "comment": "Malware payload", "value": "dd3ae5676ba02fa5837854d4a9d7c875", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266016, "uuid": "5625230d-3c1e-43d7-a775-90e7eadb272b", "comment": "Malware payload", "value": "1835752dc8c104758c25cf9857f9218cb293d1c59a8f39f01115c1217288ca0a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266016, "uuid": "c7a9c0be-d40d-462e-8ee0-c8714b191f7a", "comment": "Malware payload", "value": "f16bb44bedaaaa1306eb3f707e6d525eaa6a0bb1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266016, "uuid": "d1299f93-6e33-4bf0-994b-dffc00e4b6c4", "comment": "Malware payload", "value": "f48b5fb8ff1cdeee7ea2cc3bb70f732f65d547f6680e1f38b102ed9987ef6121890e997a7d23239a023687b2b2f62c80", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266016, "uuid": "6c7aa9e7-35c7-43e7-ae6b-732a26ed7e4e", "value": "T1E874AE227BC08472D87614726835A766593DBC300F25DAE7A3E43A2EDE306C2D736767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266016, "uuid": "a1b743e3-2bdb-4b28-a4b7-d4c59ce5b18e", "value": "1a63cea75197fbe9cc550ab772692134", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266016, "uuid": "d119a754-7a4f-4dbb-9a25-f3a373449db6", "value": "6144:lEFPyaUuQSTxR63Arln1QH/07BYYQeN5bsigfv5q6LPlLAydxy3:yPLU2TxCArd1QH/0lYYTngfvJZLpdxy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751266016, "uuid": "b595d1da-2677-4ac6-bbe9-cf3f1d40ad71", "value": 340516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751266016, "uuid": "289c1fdf-caa9-4bd1-84ee-76619ca6b31f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266016, "uuid": "4ad087e3-dc0f-4f70-913e-50187aad95c4", "value": "ChaseTheSkies_JavaSkins.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c44a45da-55b6-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751290391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290391, "uuid": "c047bcb3-ffb9-4ae2-91e8-4e17e8054af2", "comment": "Malware payload", "value": "6111717a1a15db2d374e41c96d288dfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290391, "uuid": "3dba4b66-80a0-4638-8d1d-3a747f5fe1f1", "comment": "Malware payload", "value": "183a542c732b8940e140199fd8e849bd1c87e424af7128b6387edbc6c7770ed0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290391, "uuid": "72718678-86fb-4d79-8fba-d01e07e485d0", "comment": "Malware payload", "value": "cc06024b69e939c79f0816cf74619600fb53895a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290391, "uuid": "89632ccf-8e5c-44d0-8767-f4a46e473f82", "comment": "Malware payload", "value": "2024a9a81768cb80cbf398fefe0e3beb001e3f4f84fc274016804280dae5747f3cc0a52ad7e444d6ba53301c241c8ff0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290391, "uuid": "225f9b6e-ef40-4007-89c7-d771952c734d", "value": "T163E55DE4371AE6EFE3490475E0038E7BE53927A78F45B112D806B8FC6362E05F686749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290391, "uuid": "730e9ab9-f8c7-44ff-841b-1a9826321f73", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290391, "uuid": "0d4464a9-0c73-412c-88e4-ca7709890ca3", "value": "49152:pYiKF5DpR1oMU44wNSR01OYy2GzTzetDxtTHC2:SpF5Dpr644wNS+1OYmzTzexxtTHC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751290391, "uuid": "5220fd4b-403a-4996-86a3-b7b3b56d15b4", "value": 3131904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751290391, "uuid": "f5f133ce-c524-4c57-af81-d1c55de7db2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290391, "uuid": "4949bf00-8205-417e-835d-f7f27755d85f", "value": "6111717a1a15db2d374e41c96d288dfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3337cfed-5580-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751266955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266955, "uuid": "3ddff207-de3f-4759-8282-e20379abe026", "comment": "Malware payload", "value": "e6d7bbc53b718217b2de1b43a9193786", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266955, "uuid": "a2c8c5d9-df97-41a4-baa3-0be6aef05df9", "comment": "Malware payload", "value": "18afce420c39b188d83f60cd3482e32cc579695e73b7fb5e5d21ca51498c471f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266955, "uuid": "92af30a7-0bb9-4fa2-92a9-6dd9e988e2e4", "comment": "Malware payload", "value": "3fbb008a4454a05aff3688c04380f98b214c34c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266955, "uuid": "241cb9ef-cb7a-4ecb-a1b4-1f82a153d1f2", "comment": "Malware payload", "value": "a2b93dde041c6e87f9a8e14d98cc162e81dd350b03d4b4865eb1e17d8e3297d3938901b62f3829f7d338a2d927953258", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266955, "uuid": "095b8f49-a113-4032-ad0d-f7039e48d14b", "value": "T13EB44C05DBF94916D1FE27B5E8BE9B10CBB1F4AAB2A1D74F4444A5F86C02B05AC1033B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266955, "uuid": "7e5ed1da-c846-4f9b-8d34-23e0dcaec26d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266955, "uuid": "b65c20ee-02fd-470d-9cbb-c65b14602647", "value": "6144:q7j0VpVjTTLh6UuN1TkF4i44B2BKBBqB9Bhb4nNXN9VB/4Eo0CoG2R77bjXyOQDt:wOpZLh6d1ToJLE2R/yG/I0WqZAGyATb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751266955, "uuid": "7ba3d436-3b27-4a2a-a403-8d561a4ceca3", "value": 498688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751266955, "uuid": "aa19f118-a129-4026-867c-aa054b4461d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266955, "uuid": "388c69b3-3623-45fd-b1f4-ddfbcce24eea", "value": "10000GND10023-NNVB83777477100325.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91eff33a-559c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751279140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279140, "uuid": "ee0014a8-0371-4eab-8dc8-0e0097d49738", "comment": "Malware payload (Mirai)", "value": "fafc32ec667415b833103b6d563909d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279140, "uuid": "aed3dedd-3e63-488e-a354-037d4cefaac4", "comment": "Malware payload (Mirai)", "value": "18c3c243c39f09f3ff6caea44607cf9cdf18c113c97574b29eb0dec2648d9a75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279140, "uuid": "826a0e24-be6e-4be0-89db-721aa90020e7", "comment": "Malware payload (Mirai)", "value": "e76e720806628645fed10feafc8b988f6a0765e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279140, "uuid": "6c3022c1-ed98-40f6-8a01-1833bdcb576b", "comment": "Malware payload (Mirai)", "value": "a3b5cf5b9341e6a834f92605139d5b9d4f90f6489eec6452db0e01c5d4f1fe2bdd2cc052e3fea6617ec95900fcb10a8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279140, "uuid": "c56b8f3a-10ea-4b1e-b1c7-5b975006d81c", "value": "T113D30A46F8819B12D5C111BAFE1E124E37231B7CE2DE72029D246B747B8B97F0E3A905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279140, "uuid": "b6cf2414-0c97-4378-b2a5-1ce2ffd8dd6e", "value": "3072:KvtB244ziKuX51C7YaQVw3iM3eyfwmjSBR:ototzYXjCkagw3i6QmjSBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751279140, "uuid": "ccbc87da-91ac-4ad8-91c0-8c5786025424", "value": 133980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751279140, "uuid": "6994e51a-dd55-4c77-9d2e-f65a52cd76f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279140, "uuid": "e619a5cb-60b9-4082-b3ad-37c33a26e9d2", "value": "cutearm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ae235d-55d6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1751304194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304194, "uuid": "b129cb0c-1c2f-43dd-a735-fcfef3a1f6c6", "comment": "Malware payload (AsyncRAT)", "value": "d02578bfb8c0388da9e6d992a4da5313", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304194, "uuid": "0a852254-7a73-49e0-a93f-5840ec058ac4", "comment": "Malware payload (AsyncRAT)", "value": "190f302203118ec4de2492a02741a411a934200ecb54576ca35d8a7e1488b15c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304194, "uuid": "d1e49d55-1690-4a9e-bb26-428215406f92", "comment": "Malware payload (AsyncRAT)", "value": "3a752701e46dffeb5645cbf9e09746c77fbcb3fa", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304194, "uuid": "bfa9eba9-eddd-4387-af95-6e326dd38622", "comment": "Malware payload (AsyncRAT)", "value": "95690ba398b03186c35a771c3c75ca02d3404bebbfa213d74a3e906de9f76dcdf0bb177959a542969e4513e468dc0636", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751304194, "uuid": "00bdb136-5bf8-4e97-8b86-e05817e7c607", "value": "T1AC03C795B612F76593E3A940001A2C09FE598D330DB4F0A0A3E8C6DA32B467759F7B77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751304194, "uuid": "72cfdc91-a982-4a24-bafa-ed18b4e5efce", "value": "384:94CBHDG3qO3MBHLPm9f6RUJ2Dmtkuxf2Fa23yzLEacHbs+TC0ym00TY8FfLy8z/G:94mH8qO3MBHLPuzQ5sVsY8VO1522Ke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751304194, "uuid": "e5607431-c29e-4710-9bd3-9fa5719beadb", "value": 38028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751304194, "uuid": "5edbe4d3-be2a-4f49-821b-209a93ffb0a5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751304194, "uuid": "881f3a33-6e4d-4b9f-96e0-98880773d639", "value": "Payment_7266338449.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bd97b13-5600-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751321864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751321864, "uuid": "16b6fce4-f8cf-4b61-b8d4-785919be1a12", "comment": "Malware payload", "value": "11f21eab78d1c9a09d2b6eeee520d282", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751321864, "uuid": "77e17d96-1744-4bb2-980c-ace554819f92", "comment": "Malware payload", "value": "198a6a9a0008f0dc19e394394fcc3d603ee4d4be26faddafc7d04b2a662e88ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751321864, "uuid": "221d1d7a-7222-4bd0-980e-f39d1d1f4923", "comment": "Malware payload", "value": "1b0fae9ddefda7265c6f25c646c15b29f8e6f636", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751321864, "uuid": "164a5388-05b3-4d54-9556-046ddb8f3f0c", "comment": "Malware payload", "value": "c7019e187d83004e2c1d8d2b8a69674f7cbf69a34fa9c844179a322c3b39c145ef1fdf724af4d551a7c6bbd3aaf5b92b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751321864, "uuid": "33a5e24f-0e3a-4eee-8ab0-cb8933840c19", "value": "T1ECB41228EE4E38C1F3D1E378DA0A4BB1B05B79D0D166C1B2BA41E25D95EDEDEC5D0212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751321864, "uuid": "2deec4ca-b4e1-41c8-b83b-54879d565354", "value": "6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751321864, "uuid": "a3bd044c-25c6-4b83-ad26-75a5a235e9f4", "value": 509896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751321864, "uuid": "ea63710d-2136-4bbb-b9b0-bccd679e1d81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751321864, "uuid": "9295d31e-bfbd-4ff4-9b68-3c9c5c2ef0fc", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b6b2da5-5608-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751325461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751325461, "uuid": "02f02006-863c-4a4b-b7ac-dfb866417c67", "comment": "Malware payload (Mirai)", "value": "548271f2cf9bac459104d01a2ae73491", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751325461, "uuid": "8a09ec85-ac50-40fa-8ac7-76834147d140", "comment": "Malware payload (Mirai)", "value": "19e842db10dafc39f97052f123c55e33b64c18cdbd609fbf44333bb772d84ecb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751325461, "uuid": "bcd9c510-17e5-471c-b437-dc7f0589ae8b", "comment": "Malware payload (Mirai)", "value": "0f0cc95ca782fb976c38d7b87322fb7abff3ef8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751325461, "uuid": "8a4e2e49-a8af-4b35-bbb0-11ec57b48770", "comment": "Malware payload (Mirai)", "value": "8ee877d6add62d74325d10a9130dc0fa20a4be244e4044b21fe4671c7ab8546d4b90012802d965fef0e806bbabf60ac9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751325461, "uuid": "4bc34d1e-b82b-4017-adfc-5976b55dce64", "value": "T1BA63AE23CDA12D98C58981B472A0CE3A6363D914A4972EF755ABC7369043FEDF9093F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751325461, "uuid": "51c5c2df-105a-46cd-96fc-245d7775a968", "value": "768:M/VChwa1WHLJ5Icom8uyof5DP2pypZwkXC8ju1mK+zQh/GaoomIxmNsCvYQZpfLl:M/YSauLKuJDP2Yp39K+zQ3HmpCCvzPv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751325461, "uuid": "63dac113-8a11-4d5f-a875-681311f9589d", "value": 71296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751325461, "uuid": "5c9f7f28-d9c5-4b15-bb12-cf14a6cb7359", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751325461, "uuid": "abb9f214-f4c8-4fc4-b7e1-27e435874cca", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f550e3-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751243818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243818, "uuid": "47d4a1b1-85e6-4153-9deb-394b3d12ab35", "comment": "Malware payload (Mirai)", "value": "675d56c19b23a0c5abe8941fb1b2acd9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243818, "uuid": "38eaabf5-1b08-4f78-a305-e92ad7df6601", "comment": "Malware payload (Mirai)", "value": "1ade2de7d7053c511d25c88917a179fc2d7ef4c6aecc4ba14e1e2a4fe99de737", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243818, "uuid": "91a6d6b6-b6d9-41b4-b906-91ec8c5ea51b", "comment": "Malware payload (Mirai)", "value": "9d0942cb044da127cf633983e60d1709613288a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243818, "uuid": "40122fae-d4fb-4b9f-ab5d-2455ab9cd25b", "comment": "Malware payload (Mirai)", "value": "71f1ec90a44114d806b206cf97a940de1ad1fbaa4ce9c490513b473fb91d665c80cd6e22369e944f0ec18aa3b6c63c15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243818, "uuid": "be50aa8e-ef26-40a1-a93b-61596b2c826f", "value": "T18673E80AFF614EBBD86FDD3306AD070134CC695722B97B3A7534D918B60A64B1AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243818, "uuid": "a0c3e988-63ef-42f1-93d1-d47646d59e11", "value": "1536:G8kMykFsZjkUR5fKgNEGpHjPqZBqYOI6EO1V+:G8kMyk6ZJLp7qqb1V+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243818, "uuid": "e5fe17a7-0fa0-4331-8e93-ce478069ef3b", "value": 76716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243818, "uuid": "cdbf3c26-95d4-4faf-921b-6c9ecfe8e9ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243818, "uuid": "1d8aa70f-c80d-4356-9a6a-79a89e1e310a", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11f22a9b-554b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751244136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244136, "uuid": "da0e96ef-20da-4034-8c06-92fee0d0c956", "comment": "Malware payload (Mirai)", "value": "d95dd3d774d7fef6a66fe14b702f6ebe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244136, "uuid": "0ec76af8-5172-4d16-8d90-96134799bd69", "comment": "Malware payload (Mirai)", "value": "1b37775cf43ed144c4f73cb1e6c25071cd440d8bbf8880d283ce813ac8cecfef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244136, "uuid": "00001568-cb3c-485f-a834-d33a770e57bf", "comment": "Malware payload (Mirai)", "value": "a81dc52a2cb8ec589fb24549fe5e0860c6498eb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244136, "uuid": "206dcade-bc6a-40db-9e02-88c271a0b1bf", "comment": "Malware payload (Mirai)", "value": "697d786c58415bda94a21595ffc9d6a4885b9be515276d72471170b092c78ee4880b7ab6083b1bb65fef9e4e42cf6b81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244136, "uuid": "6bba8ff0-fb83-4f2b-8a8e-69935c88eeb9", "value": "T153230791BC819A2BC2D41379F5BE998E3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244136, "uuid": "6bfb66ca-acaf-44ee-8149-60c8888bc8fc", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THX:5DmKF7Gxyk8cqoHAmWurAufse5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751244136, "uuid": "cf6589c8-6c97-409b-bb42-afc350923bfd", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751244136, "uuid": "e0fe889b-9810-4162-9c45-dda2a75f0f25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244136, "uuid": "c008df16-7a04-4d90-890c-a7065c263ccc", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e4396df-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751291965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291965, "uuid": "495d3820-0be6-4be3-8e5e-c680dcd67f54", "comment": "Malware payload", "value": "dce22f4f3211196fb42a0f4f5dcea1d0", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291965, "uuid": "02eea4b3-d16e-4816-84f9-0172269cadf3", "comment": "Malware payload", "value": "1bbe72db7edc9646e243e57b06a23d0d00bcf72413c719f87a9131cf1968afdf", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291965, "uuid": "932aed95-7ed1-465b-a9a0-2e2abc814541", "comment": "Malware payload", "value": "fc03135833d8887b01ed24f17266eca685f7d0e4", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291965, "uuid": "32669df4-5023-449a-a162-b96e7a2e93ea", "comment": "Malware payload", "value": "6e282a1cb132d9d0813cc1a039a46a553b65450193ba11bc3803e0101473e0a0bb925f3e56b4ae89193d9ea54f502b23", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291965, "uuid": "cc652c99-848c-46bb-a1d4-e95c34fc21ca", "value": "T1BBD4E0DE7E4A96D4884262FEA9158552F1CC87D2B305EB72FD7CC98033A58B8C56B3C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291965, "uuid": "c5a68169-de3c-492f-a666-d84a8512a655", "value": "12288:5Bgrpg0Kt3b+WVlxJh/4w+OQvC1DQTw5/H+:5BgtHCyWVIa5QTwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291965, "uuid": "e0ff3309-de13-469e-8eca-14a48fc55ac7", "value": 634822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291965, "uuid": "66ccde70-d40f-4616-a76a-45a0b70a5425", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291965, "uuid": "3b331c2c-8051-439e-aa07-532d23bdba03", "value": "WMIEventLog.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4f896b-55ce-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751300440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300440, "uuid": "5ed1519c-24e8-492b-a840-4c2af2d8dca4", "comment": "Malware payload (Mirai)", "value": "42278aa3a2e73a1034ad0ece2ac21b5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300440, "uuid": "13228f09-c827-4518-b6b9-c8b47346d0a2", "comment": "Malware payload (Mirai)", "value": "1bc137841445a32184b981463f26cf92cd5faee96c6530b71788322f6e02b74c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300440, "uuid": "4989ae22-bd38-45bd-b774-c777cf5cdfaa", "comment": "Malware payload (Mirai)", "value": "99d7b12dd545dcd288137d66c68a3602b387f3dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300440, "uuid": "ed70d8a7-00b8-44ef-b0fc-d88860741746", "comment": "Malware payload (Mirai)", "value": "f631c56920c80562745bdb517d66b75ae9d3e98b9c896c81789ace64402dc581e7e4bf9a49ecde0ad34ba41d50cd4ed4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300440, "uuid": "58af81c7-89d2-4e34-90b0-3596f702a1a4", "value": "T1C8C31945FC415B63C6C212B7FB4E428C3B2A17E8D3EE720399256F60378B46B0E36546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300440, "uuid": "0c019a4e-32b1-466a-9ebf-ad098f5c4535", "value": "1536:RRT4Te15ubNXEuRu2Ro14Vp+ZsTgX5EsiNVM2/TWdklcJCwywLFKNRQoSntVtqKG:RRAx3RuF4WSMX5EsiT7WhGZDbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751300440, "uuid": "7ebf35e5-8605-4807-b946-6625d82d40b4", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751300440, "uuid": "e6599f93-499e-48e3-84b9-64f53bcde136", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300440, "uuid": "bc3c294a-1d83-4b25-ba55-3864c6ba8d84", "value": "cutearm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8052f9a5-5605-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751324207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324207, "uuid": "5f02a2a9-0325-4ec3-8a26-d982d24f66fd", "comment": "Malware payload", "value": "3f7ab424e78244d80a880305791dd3e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324207, "uuid": "4830d604-acbe-4677-b34d-c5a860b3530a", "comment": "Malware payload", "value": "1bd8bbe6a415a5be693a66f17d914c4a4a13ba5ab135857ce3527ac5d1d902be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324207, "uuid": "17591364-e9f0-4bee-a94d-1e0af5514037", "comment": "Malware payload", "value": "d46f731650552733d595e27f711b34233c13991c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324207, "uuid": "1f170d91-3fcd-48ff-912b-7133aecc607d", "comment": "Malware payload", "value": "f0a3f625f5eefcc4a435e9dd616faef21f2d9e05fa687da0e3f79b51de4687282af49133c15ef936c151cfc272998411", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324207, "uuid": "47a57f91-00d3-4fce-aa17-4633bcfabe0f", "value": "T12AC42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6DB42F661EDB1B42469E66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324207, "uuid": "c88bdb4c-e05a-4aeb-bb7d-efb9932e3ad3", "value": "12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751324207, "uuid": "0ad1d912-f198-4aaa-b428-53f470578df4", "value": 587764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751324207, "uuid": "b8049c1d-6a9a-4c2c-ad9c-4180cd1e57d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324207, "uuid": "723fb727-a86e-43e1-8e20-dd6ce1ffc812", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6815f14d-55cf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SkuldStealer)", "timestamp": 1751300974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300974, "uuid": "a849ddd8-feb7-4d05-a1bb-7f5d381a1164", "comment": "Malware payload (SkuldStealer)", "value": "31743965a151ea7f85bb222e1f49b3b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SkuldStealer", "colour": "#CCA511", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300974, "uuid": "332362ca-5591-46e7-8f5f-77d55a9bed66", "comment": "Malware payload (SkuldStealer)", "value": "1be1474e493ffae0a7b65aab0e6e3f4d3bbb7dbb2d3648ced517d94d13ecee30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SkuldStealer", "colour": "#CCA511", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300974, "uuid": "319462fd-f76a-4353-9912-e67cebac6270", "comment": "Malware payload (SkuldStealer)", "value": "ae5202591fd1c685f7004da798bfca45dcfa508a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SkuldStealer", "colour": "#CCA511", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300974, "uuid": "238ee93a-d71c-45e4-8a1f-5e7937e403bf", "comment": "Malware payload (SkuldStealer)", "value": "fa555b2931a290b99bdd4e5b3dcc06b6ee186da69e9bcd3695712b99186e4fd65d8d88dd262469f172e9b5fdc9a31c32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SkuldStealer", "colour": "#CCA511", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300974, "uuid": "e34d7d38-3733-439d-8ba2-5ab3f686af87", "value": "T178B64A4BE8A545E4C0EA9576CA729253BA717C884F3163D72B50FB342F73BD06AB6700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300974, "uuid": "54f6736a-42bc-4670-aae5-eae8da477e69", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300974, "uuid": "aa632bce-e3e6-47df-ad38-ddff6cfa75d3", "value": "98304:/90JORHh/oI8hgH5qLiDSxdscCt1KsEBBATA9tZekkU7YLD:CaH2I8hgk9xdsck1KFBnLZ0LD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751300974, "uuid": "c1468edb-04cd-47e8-b22d-f9e6c7c16b2a", "value": 10641920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751300974, "uuid": "e4f5935a-d83d-46b0-9d83-f14f2237637d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300974, "uuid": "df9bb191-4951-4f7b-a99f-7f34b84aa928", "value": "MissWorld.png.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582e30ef-5606-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751324569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324569, "uuid": "c96b77ff-48fa-47c7-ae9f-a244e8039d09", "comment": "Malware payload (Mirai)", "value": "9dc7cdd26466dd513c3b017d9e4ea23b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324569, "uuid": "6e2e3ac0-9618-4799-b996-bfe58f8dd835", "comment": "Malware payload (Mirai)", "value": "1c87a927af3b1138cc9d9b0853418cbdbd716460806ad192a941f383c13bbb23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324569, "uuid": "1d87974e-6a87-45f4-9d9e-2b7c1f6b6b43", "comment": "Malware payload (Mirai)", "value": "eef9841520552450830256f2687d49c554855a89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324569, "uuid": "2d8c61ed-86a1-435c-b42e-24fcfd6da794", "comment": "Malware payload (Mirai)", "value": "32b6121805c8c86e7323de6c9f4b0d8920a3d412f3179f2291511cb4c2e83c224877e12ea1447b20ca91c84b6fc1f1c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324569, "uuid": "36a8f75a-fe1e-4f29-a09a-f3cc5ebbc705", "value": "T1F93309C1B58BCCF9C407893050A7F33FDB31D829417296AFEF5AAE35DA676428216249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324569, "uuid": "85ca086c-4cdc-4511-a059-3ba4328c18d0", "value": "1536:oe0WSI6EByvY9IFvGDR1z2Pi+lDmtMRAEY:oe0Wx6EovY9Ig916Pi+JnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751324569, "uuid": "e108719b-89b6-4335-bd76-14adaef03eba", "value": 51344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751324569, "uuid": "d08d994e-1622-4888-86a6-1bf161687662", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324569, "uuid": "c949238f-c159-4fd3-9edb-18b8452c1a46", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb24ca04-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751291235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291235, "uuid": "4259a1c4-1fb0-4e82-acfc-b583f3671f42", "comment": "Malware payload (Mirai)", "value": "d1bcb4052c0830cf5f58a1d625a856cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291235, "uuid": "73ec7f3e-db63-4014-b120-0cafd145624f", "comment": "Malware payload (Mirai)", "value": "1cacdf8f4ac2a2d7947205103d3e4d5efcfaa2e117343bfc0979174b1e8ae4ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291235, "uuid": "a2db0ab9-8115-4fc4-b889-253fec43701d", "comment": "Malware payload (Mirai)", "value": "b3da04f2c937cb526b67c296b646baddb5df5f26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291235, "uuid": "b30423ea-2685-4d60-88e9-2cad9e350236", "comment": "Malware payload (Mirai)", "value": "dd503214884d361be18eff13136808fc47fc1643a44de17fb31848f7c7b7c5e79ec463c5f69106e0698e3a2fb072ac55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291235, "uuid": "55f25d8b-3d5e-4ee5-89b9-f1cf10a18d34", "value": "T16073E94AFD828F02D4D622BAFA6E418D33136BA9E3EE7111DD205F5063C999F0E77512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291235, "uuid": "6ad62d81-7089-4f4a-862e-97b8c460bdf1", "value": "1536:w/tnVIGvN5Z2NQAf+LGqkrjxrdVdHSYOd8SMXbuX91B97rNlR5iUSju7qW:w31VRA0lCjxrdVdHFSMXbuX91B7LSjEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291235, "uuid": "73a2ba22-7501-4612-8d45-59204428c014", "value": 80688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291235, "uuid": "7f2d5f2d-da9d-4822-ab6e-1718d4c75b72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291235, "uuid": "e3e42ac5-6f0c-4cbe-9f50-3a5ccae12cac", "value": "miraint.arm7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "202e2606-55d1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751301712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301712, "uuid": "4b6b801c-4d20-45d8-882f-ef66eb50be8b", "comment": "Malware payload (Mirai)", "value": "00154be5c07ab8ba4c3dd719c7ba5cf1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301712, "uuid": "1aed7897-a21f-4231-ad24-84f2d88f16e3", "comment": "Malware payload (Mirai)", "value": "1d7c1cf868a753537c94c6f3f8fc374311b370ad42c8efcab33703d2a1408fc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301712, "uuid": "0f7b15f4-2841-415d-8c02-bac40c8106cb", "comment": "Malware payload (Mirai)", "value": "b3084769fd2b34b23b11d37282bb995798a3da19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301712, "uuid": "a9996e3b-b4e6-4cce-b6d0-de40d147c8ff", "comment": "Malware payload (Mirai)", "value": "8544c85490f973906318c24bf07d4c72612ff50824a2c0398a6943dc895c69d841ff317686e9c388fc967c2279a939b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301712, "uuid": "2311fe61-82c6-4541-b957-44a9270ba1d2", "value": "T1AF530267B3306A674C785D31CC2D8A4E516947CAE1A939739462B8C94FAFA01B7783F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301712, "uuid": "74c7e106-834a-4863-873d-0c2c4165bc3b", "value": "1536:XQRomY+hLD9GHV7AmP61oMVUkWq+L6oQuPSU6/yd:ASmxhLD9EV7Ami1Niq+L6o4U6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751301712, "uuid": "a44a704b-6e13-44c4-b820-6754696cdc22", "value": 66660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751301712, "uuid": "d49acdc7-6924-4cca-b87e-0a40a8095440", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301712, "uuid": "b2d3e862-d7c4-4730-b7c3-930b5b4f7188", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a42b403-55e3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751309433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309433, "uuid": "ac72b4d2-52ef-4ccf-a5c4-05e5691f6f51", "comment": "Malware payload", "value": "268294c0839a26236b7ed18cd0ea2226", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "Hashkey", "colour": "#7AE3A0", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309433, "uuid": "80da3ffc-8310-4d02-9388-d8207f3c2544", "comment": "Malware payload", "value": "1da17ebc326c3a093a1afd7565184950a741a3527a5ec86d45a8cbc3193b7406", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "Hashkey", "colour": "#7AE3A0", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309433, "uuid": "300f332a-9711-4ea7-a082-ac275442edb4", "comment": "Malware payload", "value": "0ac702300d765f10e6db100459e4582180c46f0a", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "Hashkey", "colour": "#7AE3A0", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309433, "uuid": "e965d2e4-637e-4168-9d41-f91bea7623ef", "comment": "Malware payload", "value": "b1d80fabcb6160f9b19b522676a9a302fea23368c425a6dd40f74e92fd8cdbefb1b004889e023da7853676141e8c38cd", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "Hashkey", "colour": "#7AE3A0", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309433, "uuid": "61d417f4-cd0e-4d9c-9cde-decbe5d988f0", "value": "T14DE633CB02673B3BD584B4B04EAF7DE5B19141D2E82698FA61367DD1C0F86E9C91CB06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309433, "uuid": "7120b51c-7b79-4a55-9acc-fd787418bbe3", "value": "196608:tYlO4WeS77RYYKKYlO4WeS77RYYKmYlO4WeS77RYYKjYlO4WeS77RYYKgYlO4We9:aWeSpqLWeSpqPWeSpqAWeSpqxWeSpq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751309433, "uuid": "e583772e-c548-4483-9266-68cc4184cb15", "value": 14983862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751309433, "uuid": "a01e840d-903d-40dc-9d31-2c6ab0f6a736", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309433, "uuid": "967b9658-1b0d-421c-bf76-97698d0838c3", "value": "HashKey218.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5885332-55d2-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751302419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302419, "uuid": "6eadb17e-279d-49d4-9d54-2f3e5a6bfc18", "comment": "Malware payload", "value": "00dabb9f6f16055797c55e5d49cefbc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302419, "uuid": "8997b778-7f15-491b-89c7-1b99482aebb8", "comment": "Malware payload", "value": "1e0e01610ddeaf08fb21bd84ea13eaf7dc1860259d6f285601e5778d1948f5f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302419, "uuid": "efaf96ac-ec4e-4176-89b0-df502865cdfe", "comment": "Malware payload", "value": "44d578bd565899861c9c322e52a2c18b106eb13e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302419, "uuid": "501146ec-64a8-47ad-90c9-97bb4d54e32b", "comment": "Malware payload", "value": "8addfa94b0396db421cb1d5713b4ff348988e04be9b83c9b308eee5ed9816ebada6a1b2d7aec59d9b99a9ab3fa6f94fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751302419, "uuid": "e1cf4003-d403-40e7-8911-38bc65ea5ef9", "value": "T16AE4F1037308A756DF4BAC3A82CBFD31B7C27991539096627A80E29F8775726CF0D649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751302419, "uuid": "6596bed4-89fa-45e5-a0dc-646575e6e6c0", "value": "12288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751302419, "uuid": "20632ad1-b887-48e3-8414-ff4141ac4999", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751302419, "uuid": "2a300afe-7a0c-4a5a-84c3-1dc0d028cea9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751302419, "uuid": "b116fbda-c1b6-4808-bf39-bbdb6284179f", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e36640f-559c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751278919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278919, "uuid": "3f6fb829-8318-4831-82bc-d48c8eb4e569", "comment": "Malware payload", "value": "338d2f80bdc1ddb0f7b99c47ccbf12a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278919, "uuid": "1c1314f1-f450-4969-afe3-53420ed4ad67", "comment": "Malware payload", "value": "1f5823734e47720858f9d49060cde39c3a7313d99198c65dca70d67b2b1eff0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278919, "uuid": "b10aedd3-4f45-4783-a928-3d48adaae26c", "comment": "Malware payload", "value": "9e0b823ddad5363ddb47d5f35ae47df2edb4df3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278919, "uuid": "e5815115-e03c-4c76-8124-625e8c1e3fa9", "comment": "Malware payload", "value": "928242e3e5649fe9a40952c684a334481656f978730ba16be1e5d14be3dbf5c4e1c0f354e4d5249f5e85a50fe0768f12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278919, "uuid": "8b03878b-a06b-4435-8a56-f0d0a46554be", "value": "T1682833405584D80BDD951BBE61A003F0D7AE7D4BEECBACE396107D662C323499F7A29C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278919, "uuid": "73ff9f2c-20a5-4750-872f-e208b75f46f4", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278919, "uuid": "74a6d88a-f6aa-482f-bc06-bf0f969e047c", "value": "1572864:YaYrKPwiTBf6nDCgiYbPJUVQGjvUGcvoDVF/JHOC7HMuTGNpoz6Im6rIylQ18:YaY2T6HPAQGomFZOCzHTv6UrIyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751278919, "uuid": "403b51df-9e44-4de5-b3f7-72fe7a8cc6d9", "value": 96904216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751278919, "uuid": "b4c8b360-e633-4ebf-b60b-d0d32229c5d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278919, "uuid": "64870568-ad52-429c-957d-9b11d4381ee6", "value": "TribeWars Setup 10.2.27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec4f6a0-559b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751278893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278893, "uuid": "95708696-69e8-48ea-a5fe-fcd7504a8653", "comment": "Malware payload", "value": "de7b8c659415ecb029156ce6161f54bd", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278893, "uuid": "71e14284-f481-46fe-a966-96794b9b6c44", "comment": "Malware payload", "value": "1f7f03b4b9da4544ee14377dab133098d5f57251413f5f3999782108447b6c0a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278893, "uuid": "85fd8a7d-8b94-4f97-bfd5-09516bde9b96", "comment": "Malware payload", "value": "bfbf56941626870bb036b0be01255c0f2b530dcd", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278893, "uuid": "9f6c7fba-0496-42b4-81b4-728630736d6b", "comment": "Malware payload", "value": "afb2e3d1651e4a914688d9cd2d831567e1b64330f173c7a61529ca980c29671a215c682a05602fb779e770607442c206", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278893, "uuid": "d12204f6-a99c-4a90-833a-21cb21ca15a5", "value": "T138D5C08AFB45D8AAC0E7D6328679453A551BCC558B43D2875A6AF13C0DB3DC08B87ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278893, "uuid": "745fcc87-6d6e-436d-91c3-311987cbe2a9", "value": "49152:aSK4FSXxi1XlIg51YKBT4tIIYlAa7/A3qpI2AUFIA0AP7kXD3REjyRj:JFWxiV6g51Yxtpw2qyr3m7kXDhEjyRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751278893, "uuid": "a98034fc-539b-4729-9efb-e8f714a6c711", "value": 2855643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751278893, "uuid": "98ca9e15-ec38-4e09-b3e9-fb0a3a78ed80", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278893, "uuid": "c22a0eaa-6814-4491-af36-2ebc659d1e48", "value": "88fdb1bcc437c0a4b986a1c5e5597cad.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41a68ae3-5578-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751263543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751263543, "uuid": "0ce081cc-f4ad-4498-8cca-bf0688ebe1ea", "comment": "Malware payload", "value": "6c690a152005f5fa5bb2e2e23044a664", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ms-g4-com", "colour": "#3B11CB", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751263543, "uuid": "9e553699-57d2-42ed-a037-7976094b1d42", "comment": "Malware payload", "value": "1fb4233de6647fb013e875798153ef6f2b325b1296efafc767cc9ecb0591945c", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ms-g4-com", "colour": "#3B11CB", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751263543, "uuid": "3629ef8a-35b0-41f0-a41e-978a596f78a2", "comment": "Malware payload", "value": "dacbf4b31807432d3dd68f725970f609a281ee70", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ms-g4-com", "colour": "#3B11CB", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751263543, "uuid": "597ce198-758c-46a8-a8c6-5f82f78bf360", "comment": "Malware payload", "value": "38812a9050396c977a758bec621642652aa09dc37d8d1c0ffd3d5d8236d77cd2f879e55220ef15afe64c60dc2cd655a4", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ms-g4-com", "colour": "#3B11CB", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751263543, "uuid": "2235414e-ab59-4062-adce-5b7f94a4e4a2", "value": "T1412195017B23020391B0CFB1FCEA496AEB54814F02198861777C46DA1F3860FD4E6A5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751263543, "uuid": "366dd5e9-a7d2-4106-bc3f-e8d79fce8322", "value": "24:TUu+R8hAlK1Xw9ZUQjnXKEpaX49lDSA8u9N7KYawHM6drz/HTkUX:wz851g9myXKEpaX2l/h7h/dfAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751263543, "uuid": "97a8d2d2-4002-46eb-b02b-c787186740e9", "value": 1220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751263543, "uuid": "45eb7d27-b96a-4038-96d0-253186151956", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751263543, "uuid": "46469177-509e-4d0e-ba07-2259c57245eb", "value": "ms-g4.com.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8abd23-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1751291989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291989, "uuid": "33459e1b-c2e1-4ef4-ad25-1690db139010", "comment": "Malware payload (RemcosRAT)", "value": "961b8b82ea557c09ae45059742f6d680", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291989, "uuid": "7bed58ff-a3ab-49f9-be8e-4f1572800b64", "comment": "Malware payload (RemcosRAT)", "value": "2005d77fb4d262df9186d26732bdae3569fd726084658d763ed68cc60875ea57", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291989, "uuid": "2e93e9d9-7e8a-43cb-be77-61bdd947ac15", "comment": "Malware payload (RemcosRAT)", "value": "1716f5a86f85e6d4f36e5d5d104f4b92385bcb68", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291989, "uuid": "b623adce-9f0d-4412-84fe-f00dd0c51edb", "comment": "Malware payload (RemcosRAT)", "value": "cca07cc67f017e91a49b18fa864134b3e5a445f656b666db9bfca9f0a8c704112be999c9f1eee450eb6024749846181a", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291989, "uuid": "dd036c9c-6862-4a44-b65f-d6b8f41cc745", "value": "T1F9C5BF5D94B05D926024FE34AAC5F793CCEA17851A174B930FE5E2A67202C43FF6B362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291989, "uuid": "f531f805-b68b-483b-a14a-574da8e776e8", "value": "24576:BiQ9UFoYEEES+dcp9azDLXAYNWIs6tH4NgH:nfrTsQ4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291989, "uuid": "b8399c03-48a2-46f5-b187-7d8b1c059c06", "value": 2622310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291989, "uuid": "050c4570-ed7c-49c7-9c85-c776fd4413c2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291989, "uuid": "9399d953-7cfa-4e7e-9d79-a92fc98ef056", "value": "USD_SWIFT_Transanction_pdf.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba644583-55a0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751280925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280925, "uuid": "bddf7f35-97e1-48a5-856c-6bbbc58655f7", "comment": "Malware payload (Mirai)", "value": "6111b5eb2b457a48bb851c7b3bb82cc4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280925, "uuid": "271a808a-9dd3-4871-bd0f-138df893e741", "comment": "Malware payload (Mirai)", "value": "203ada79ef8f5edc318273d3502e09de9625df97f6d4c257740a77dd0502829d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280925, "uuid": "5243d5d3-2d0e-4455-a1c1-2833e8058422", "comment": "Malware payload (Mirai)", "value": "fd4c5d7a5fe22c9ccfc3ea7eca9b22c384030c46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280925, "uuid": "ea437985-c004-4f4b-a942-a223fc266706", "comment": "Malware payload (Mirai)", "value": "170a835972166f0c0b516151a197ee7e7d9c076239aaee3e0c2da221a775ba13391c9b8a3b4f3112d7d7157b714ef6fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280925, "uuid": "a9d213ef-c70b-4ee5-8d0b-e4ffa8613ef3", "value": "T17B933A91F68684F9DC8708BC41AB763FDF30EA2581208945EF5F8E6ACF37945671324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280925, "uuid": "420fa44a-110f-45a4-8ab7-ba7d8d0e5d2f", "value": "1536:im5+gp95WiPJXK3yQN5MNOnjh4KFESzmR8I9irLdd6bVW1fiAPd/WHgvd68bJBV2:8ghrRXqN5GOjICg9irZobSfiAAAvd680", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751280925, "uuid": "ce01c8eb-8285-449d-b00f-291d13c427f2", "value": 95812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751280925, "uuid": "793fdc2c-86c7-4959-b965-aa8f5e477376", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280925, "uuid": "88523882-ef66-4461-b90b-7744a070def7", "value": "rondo.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48a85cbf-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1751291042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291042, "uuid": "446d0ba2-f6ab-4a73-a379-04d92ffeaa58", "comment": "Malware payload (LummaStealer)", "value": "3f06ad48c1fe3881b234429025233e5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291042, "uuid": "bf81cd6b-f24c-4b00-9b79-bb80df71a3e5", "comment": "Malware payload (LummaStealer)", "value": "21d6033160bd6d53c059f341b2fd8fc2f55718fc70970ee0cec315baabe19409", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291042, "uuid": "d5603bfb-20a1-497f-89aa-59aaf791702a", "comment": "Malware payload (LummaStealer)", "value": "ec8dc2c326f75d32b582511a70839c98843e57f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291042, "uuid": "674b8605-de23-4796-9e8d-c892f969306d", "comment": "Malware payload (LummaStealer)", "value": "02402edfe667179b0e4eb8e2e09cd678700b62ea0df86dc3ec247cad3fde7c8d740f11268f6cb4d5106b2a978349229e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291042, "uuid": "e2876be6-f7ef-4272-89c1-fba638dc2eab", "value": "T160853324BD71AEB8FD211A391A5D13457D627E134DADDBE2012B902CB647C3BC8D87E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291042, "uuid": "08e82bc0-b367-4935-8b38-62b6ea7909b7", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291042, "uuid": "a39a506c-df4e-4e79-84cb-bab7dfead42e", "value": "24576:+xuWgfILaZIUqsFuntdTXWv90Ytx5u3iCKRsERHb/YEljAOiJRPjuVexOfcXdxiB:uBLEYtovVsRoBjYElMBJ9jErfcoNfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291042, "uuid": "46179f41-0875-40c1-a9ed-bf26dafa56fc", "value": 1857024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291042, "uuid": "5bc841ab-6fb5-4881-888d-732c574de1da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291042, "uuid": "dca99e71-43d3-411d-afdb-4a6f885c21f4", "value": "3f06ad48c1fe3881b234429025233e5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b534f9-5583-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1751268435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751268435, "uuid": "a525d3c2-4402-4151-b1a4-fb7400e072e4", "comment": "Malware payload (AgentTesla)", "value": "e2ef9d7a5a08566bf325e7c05f224109", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751268435, "uuid": "93d68d08-98bd-4f95-b8fb-d8566c7201bc", "comment": "Malware payload (AgentTesla)", "value": "2218994e51c15b1b3b403073b062c895bae9704a3255347fcd07d5a0dc4f217a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751268435, "uuid": "e1eda898-3c09-42c3-bb55-81a7af0be730", "comment": "Malware payload (AgentTesla)", "value": "072a7928b001469947f33aa4c475a4ae248a2382", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751268435, "uuid": "c7c2a094-00d0-4309-a76e-10a987e3f5e5", "comment": "Malware payload (AgentTesla)", "value": "2ea794fad6d0b63a676c18e296f7e271241094f13a6627eac12ae061e56a0900418641bb617110ed2301a93686b70b02", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751268435, "uuid": "171051ce-72a1-486e-91ec-569bca5d45e3", "value": "T17DD402067A299417D4BB1BF90C61C2B413F8AEDEAA11EBC72FC62DDBB0D17142581B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751268435, "uuid": "0743356f-db4c-4b6f-a030-9106e8bbd506", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751268435, "uuid": "b25451df-b3db-4e79-9655-af8b08c116ed", "value": "12288:iIjszM2rVG1gIGC9wplhX10c6jEYrqOYJ5AW5MDe9Gf+tfXsajb:gM6wgFCiplhX134qO0bCeE2tfsajb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751268435, "uuid": "a8f08796-dc79-43bd-b934-0fb97024d2d2", "value": 602624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751268435, "uuid": "9e8162be-6c2a-4d38-817b-efdf7d4c9b05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751268435, "uuid": "84f861f2-f23d-48ee-8fff-1f3a3060bdcb", "value": "SecuriteInfo.com.Trojan.PackedNET.3358.14077.29866", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "430f4cdc-559c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751279007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279007, "uuid": "53ffb806-5ef7-4e62-a6fc-697402a44d24", "comment": "Malware payload", "value": "5920b41653980cf7a385d3ac12e1f8ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279007, "uuid": "04b896d7-2a20-4655-bdb5-b91862b37f13", "comment": "Malware payload", "value": "22683b1c7014e9ef8f38f0b409a639cdf31287f306c5a46bb4cda62ffb7c346a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279007, "uuid": "3a482126-724e-478b-adb8-c1766f11da3c", "comment": "Malware payload", "value": "4479416e966fb76f55d55d953a414cc02e45041a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279007, "uuid": "6c90780e-c33e-41fb-acaf-93d60e3a7ef0", "comment": "Malware payload", "value": "efff489acf7b61f43db63557690927efc7c1855aa29e714dfb2b4091152c7004a812737b6b2372d6cbe7b15a274eb73f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279007, "uuid": "8cf26b37-c529-4279-ba60-a2f9bae74def", "value": "T148B41228EE4E3891F3D1E3B8DA0A4BB1B05B7DD0C166C1B2BA41E25D95EDDDEC5D0212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279007, "uuid": "690fafef-9f63-4e83-ba65-5dd17be79215", "value": "6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751279007, "uuid": "0d27c207-c8cf-4b3d-8dc2-69a4eaef40d7", "value": 509896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751279007, "uuid": "1217c985-e1da-48ed-b062-fd692616e1b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279007, "uuid": "c7568724-51a6-4414-aeb6-93f59035c440", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49fc87df-5580-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1751266993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266993, "uuid": "d6a60f24-8c07-4dda-b8b5-442b9ecb77ef", "comment": "Malware payload (Formbook)", "value": "1856c98e3eae587cf0c7d004ab63245f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266993, "uuid": "fdd9de17-2bad-49f2-bcf5-3c4e6d62f940", "comment": "Malware payload (Formbook)", "value": "22dbe128971859d5b82e39d31a4683850ed4352d691e311d93786a9013eb6105", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266993, "uuid": "8f3e7b9c-e4a1-4c1b-ab4f-8caf9be4f616", "comment": "Malware payload (Formbook)", "value": "14bc1f699680aafd6c5630cb67ce0aecb50ed92b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266993, "uuid": "45f03d96-8374-46d4-b3e2-56ce25859b1b", "comment": "Malware payload (Formbook)", "value": "44f94ba9973130cd2410634c41d33986c599ee674ca5e2b88b868090c51a1398a7a091de7e3b29b4a20bd78cd5236a50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266993, "uuid": "f79463f0-41ec-41d3-ade7-22b31c5534b1", "value": "T11755BF0273C1C062FFAB96734F5AF6115ABC79260123A62F13981D7ABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266993, "uuid": "676e8e43-0833-4a89-ac0e-bc62da389c03", "value": "0b768923437678ce375719e30b21693e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266993, "uuid": "234c227f-d69d-4afe-9ba9-78405e3ece5f", "value": "24576:R5EmXFtKaL4/oFe5T9yyXYfP1ijXda10cIekFxICWzaDK8cs:RPVt/LZeJbInQRa183US", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751266993, "uuid": "aae09af7-0dba-4215-895d-18a8eac88d6f", "value": 1305600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751266993, "uuid": "07d06c86-da4d-4f3c-b5d0-dc6d2b71e0bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266993, "uuid": "8d4a30c5-f575-4c8f-807d-8c43ee6b906e", "value": "Porfolio Noemi\u0301 Bravo Garci\u0301a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3087b43-559a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751278417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278417, "uuid": "7fb2d3fc-31b7-4b74-a402-2b1525e0df2e", "comment": "Malware payload", "value": "c07914381c71e75880fe4a6106d27876", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278417, "uuid": "640245d7-ac1f-44cb-8b7b-b2c16cd9b202", "comment": "Malware payload", "value": "2317e7ad2c8a9819446a76716b9f129d2fdd870c659942b6ba638eb8403d6e59", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278417, "uuid": "be681366-6bcf-40ef-89df-6d061787be07", "comment": "Malware payload", "value": "d4478bad2df4d3e2cf95fa0ace1ca760125234c7", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278417, "uuid": "c6ce5c42-dbb5-47e3-97f9-5cb2c12b6595", "comment": "Malware payload", "value": "14216b7553569f22e9310da0afb2204854838426f3bf7ba7151ff552b39b1eb63c736d0218a0bbca38302df61d7d0386", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278417, "uuid": "593f9ddf-8e90-43dc-9595-ab764242f122", "value": "T1BDB73346EB11C877F462413676520A435A560DB33141EE42ABE7705E1E73FF0AEBAF84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278417, "uuid": "61b3d7f5-8818-44c3-848d-c1ee0e191e8a", "value": "786432:d2lFzYiEneXCKqkSGqSJip9iJ0Pgfx7oib0FMpyS7p71KaWdSwkACAliNtKLrhs:olNYPfxGwp9iJOgJ1Nprp5DwbC6LW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751278417, "uuid": "3e5494bf-b81d-45e1-8068-dc5ecc3ac591", "value": 48814127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751278417, "uuid": "75a2de7f-970b-4df0-958a-18240e2509b7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278417, "uuid": "fe46e834-c976-4c67-b04e-f55d768771c6", "value": "app (9).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f71cdb1-554b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751244131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244131, "uuid": "b2de6d04-5444-4165-82fe-365a2e7f9b75", "comment": "Malware payload (Mirai)", "value": "de01ef15cf716773e311ea63f705e260", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244131, "uuid": "0da199fa-ce1d-46c9-a3ec-467cb6937bbd", "comment": "Malware payload (Mirai)", "value": "232747837801ccdacc442bd159770893ce51e83580f756479bd1ec025a04be55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244131, "uuid": "cdd8b358-4f9b-411f-a074-8db776e59be7", "comment": "Malware payload (Mirai)", "value": "19e1be294061f915a88327090a1590f2bb880ecf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244131, "uuid": "8bbefb39-260a-4caf-b8cf-09dfbceb351c", "comment": "Malware payload (Mirai)", "value": "23d82ef63950f864dbe9dd860ac9ad80598085b82a75c1d5e4a7838f6f4517622fbe36b5a3ee5fac5ddb35d75844c7e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244131, "uuid": "99805939-d567-42ac-9e18-eb051bf75ec2", "value": "T13E431891BC819A23C5D4137AF56E56CD372033E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244131, "uuid": "ee6d07b9-f7c1-4659-a9e7-81ceb25a546b", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9Th:/M99jmL8BZp9IFUoWKdYuvQ5CIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751244131, "uuid": "f33f497e-7acd-4309-b46a-0b5b4e6fdb2b", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751244131, "uuid": "9e5c02da-bae4-4974-aca6-312b5d1465ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244131, "uuid": "93a71ed9-6d54-4723-af1f-b56eec10a696", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec57965-5597-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XRed)", "timestamp": 1751277175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277175, "uuid": "013b2b8d-0eac-4586-8acf-3e5623513659", "comment": "Malware payload (XRed)", "value": "eb74c8a3b4d3e507ec3692a8bcd03025", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Comet", "colour": "#BD9E01", "exportable": true, "hide_tag": false }, { "name": "DarkKomet", "colour": "#A9FEE3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false }, { "name": "Zorex", "colour": "#CD2DC1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277175, "uuid": "95844617-c1de-4a9a-835b-f7f722613663", "comment": "Malware payload (XRed)", "value": "236b01dc22681ee1828a55826b2749af2613e580e04718b5f1e07f7d407ad9f4", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Comet", "colour": "#BD9E01", "exportable": true, "hide_tag": false }, { "name": "DarkKomet", "colour": "#A9FEE3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false }, { "name": "Zorex", "colour": "#CD2DC1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277175, "uuid": "b39db17a-d49d-461b-9b40-e83448cc4bc6", "comment": "Malware payload (XRed)", "value": "68bd447d99a64447f10f3ec08ab6b11054f8163f", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Comet", "colour": "#BD9E01", "exportable": true, "hide_tag": false }, { "name": "DarkKomet", "colour": "#A9FEE3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false }, { "name": "Zorex", "colour": "#CD2DC1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277175, "uuid": "49fd8651-50db-450a-9df0-990fd6462665", "comment": "Malware payload (XRed)", "value": "e327270a1e66a73409903e0e370baf1ec4f1249e3cda30e079fd972e6b209e4e330865733a34dd48cad7d06f23b24394", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Comet", "colour": "#BD9E01", "exportable": true, "hide_tag": false }, { "name": "DarkKomet", "colour": "#A9FEE3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false }, { "name": "Zorex", "colour": "#CD2DC1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277175, "uuid": "fdf04a1f-41ab-430c-8136-1bbb31f95fce", "value": "T142F63332F2D14077D5230A3D8C5B9275A83ABF516F28754B3BE92E4C8E3E78128751A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277175, "uuid": "4d467db4-78eb-4ace-bffd-bafdad37d0a0", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277175, "uuid": "f3ff4c2f-1883-4179-8d3f-4118a91bfe86", "value": "393216:xaEJFF2nGwGbYKzcKtIx23MrWVzoGuW3du3:zFsG1bYkcKzcaiGLdu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751277175, "uuid": "f3055936-b1b0-4589-a669-3394c190c4e9", "value": 16083307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751277175, "uuid": "f1dd20bd-daf1-49f5-a0fb-106664e87e6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277175, "uuid": "427edcce-1eda-4254-85ea-3d90114085b5", "value": "setup_recortado.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba6d80d3-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751291233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291233, "uuid": "96f68812-84a3-41ea-abb1-87f5946c0802", "comment": "Malware payload (Mirai)", "value": "108ab50db2aeb9916e915e2b82e6d44a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291233, "uuid": "a53998a4-df88-4e00-b91e-0d53be99b8f8", "comment": "Malware payload (Mirai)", "value": "2373304ea2ea37b3af2fbf273a431888ba07bf5f54eec4bff136cc279f61878d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291233, "uuid": "78a95bd1-2824-4ab3-b691-25e384ae1faa", "comment": "Malware payload (Mirai)", "value": "e8a8c49c2e2c43bacf961ea4a56022d38b9b2c8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291233, "uuid": "40fc3540-fd89-484e-a959-1c299b8431df", "comment": "Malware payload (Mirai)", "value": "cc18d4a397d33d33692a650aabc52a2bbe4e3e62cd0876e8da6619d7efd8b84c6fda7da4a502157d9e4dae5b94aaf594", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291233, "uuid": "c5e1f933-6c27-458d-8dff-23b73df4a313", "value": "T14D239E63D829ACD4C5494674BA248EBC2B63E10056833FF6A786C5668047FECF50D3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291233, "uuid": "cabfbf09-3eb8-43ae-9d19-9c9d89ac9ff8", "value": "768:2C1dNJK5yj1HDwtNpZz1n5LShf28RoY+OCDjRu7976dQg3EoAhwCMNHE:2C1dTeIDwtNN5uhf2iorRBQ4cwCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291233, "uuid": "7b9e8667-7893-479f-9b07-315525dab697", "value": 49992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291233, "uuid": "de0f7230-5979-40ab-9bff-0ccc01eadfa3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291233, "uuid": "7b40285c-b193-41e2-94e9-14a20f541383", "value": "miraint.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bcedab2-55f0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751315019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315019, "uuid": "26576711-0c92-48f7-b98e-ee471e2a93bb", "comment": "Malware payload (Mirai)", "value": "f99589e54183c5725d31d6d6cd4626e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315019, "uuid": "1640bd6e-15e6-4ba9-9e70-ce93cc25412e", "comment": "Malware payload (Mirai)", "value": "237476e05e6c03df03daa343b981a333078fdc9fb09fdd2ac21d14fd5fd972cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315019, "uuid": "c2c54f78-7d56-4bbd-a90c-a313ce109f51", "comment": "Malware payload (Mirai)", "value": "12e7bac619673c2f7d2f2093dd82f6e1fcc1c0bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315019, "uuid": "47bbfc02-ee3c-499f-88fc-934f425adfd2", "comment": "Malware payload (Mirai)", "value": "b39a55c31de331fd629b8464897a8592f4926e9e932c9b820413b39484e62fce7592e3439bb7b61c022941fe831747a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315019, "uuid": "3f69d695-da54-4d5b-936e-f46639569082", "value": "T13403E1AA81118CCACB7F517F13410F201D200B95BAC3DC2E3679D677DCAB6E8B98264D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315019, "uuid": "6ffca549-3ecc-431d-9966-4e83be50f781", "value": "768:EVNL5KlLiA8unX/mUeEiw/wVu7SVGNAJayZoFf1d+OGTCPPrQnOI0Z0QVnJgGlzB:EVN1K1iA3Xq96wU7SVk0aAatEjKPr4Ot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751315019, "uuid": "039dfe32-e2d9-4ac5-b274-d58b4fe3d782", "value": 38372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751315019, "uuid": "fef78bfa-97ac-4dd4-9750-cd33fc472a2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315019, "uuid": "0c06688c-134d-4f30-a048-a44ad5084619", "value": "SecuriteInfo.com.Linux.Siggen.9999.18280.31633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a59b20d-55f0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751315017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315017, "uuid": "233b3636-0d3a-408e-8959-cb75227a8178", "comment": "Malware payload (Mirai)", "value": "6579a54fbb4ecb9cd096f16b16dc62e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315017, "uuid": "c78d78cc-a697-4f58-8432-0e77a744a09c", "comment": "Malware payload (Mirai)", "value": "23c4c674b09974acb6ed1fbfe46f14f724e108ac69741b600f0037feae3cecb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315017, "uuid": "2e6ff32a-da93-4021-81fb-b8574a53b21a", "comment": "Malware payload (Mirai)", "value": "981559698b3f4d2c84dc7987d54c7511f7f1f60d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315017, "uuid": "4c36868e-3987-45c1-8539-3343ba74edd9", "comment": "Malware payload (Mirai)", "value": "00ff49817667c28cb040e9cd2c23970c3c10fa1623bcc92e89e5e91143041dd7332058646fdef9e6d78f8f3bee326adc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315017, "uuid": "65f24e8b-ff9e-4c04-ab5c-c0579b0f5bc5", "value": "T1AE03F1A51B1BC47DCEA018733988078F2D2116B9D15978C20FC6D8BB9199CE2FAD8DDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315017, "uuid": "abfaa7ac-37e7-4e80-9e2c-99908462603f", "value": "768:FJw4cwG8GTCBnTNzEfYsPztq6KVZQVqTRme71sMp7gn74woRLFe9q3UELCY:st8GTenTx6t4+VqoeSMp7gn79oRLFDLD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751315017, "uuid": "96cd5134-c323-4074-a506-d87382d0373f", "value": 40184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751315017, "uuid": "6f606a71-4380-40f8-88d1-6eac44e91741", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315017, "uuid": "e3738d44-1b1b-4204-be0a-bdafd1977cef", "value": "SecuriteInfo.com.Linux.Siggen.9999.11198.21650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77facc4b-5582-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751267929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751267929, "uuid": "9e240281-54ae-4195-b7b7-cc19b14dca68", "comment": "Malware payload (Mirai)", "value": "e0b5fbd32499782838eba9857ee6294e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751267929, "uuid": "a212d730-a07c-489c-805a-cfb8964c55d8", "comment": "Malware payload (Mirai)", "value": "24323d0435301b1dcbb6995d0c6fa186833b671653eedf941bf5eff14a69c2a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751267929, "uuid": "f6f6ada9-14ad-43ea-8456-34d139ab6ac0", "comment": "Malware payload (Mirai)", "value": "949f62c3ea89be1b773004070f64c79808b52e3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751267929, "uuid": "6a0221d2-724e-432d-ba04-5c34cca4bf75", "comment": "Malware payload (Mirai)", "value": "acd738493457ce17986c2f92951561915bbe4a449f25f9ce4b64ed7c00c783f0b352d0a0fdf6e44c9e276604e423064d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751267929, "uuid": "0a7ac1da-4b23-4892-b9e0-79739cd58551", "value": "T15C932ACAB401DC7DF40FDABB4463490AB531A7525A931F27776BFD93AC321A04867E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751267929, "uuid": "bf96e57c-66cd-48d1-a455-3c894655041e", "value": "1536:gBlFQAe3Xj0XnFd1lCd+8P1CPzbJIGY7MsrPR8rUwFhirEFEE65vEExu+Nbc/a1v:gZXFdjOjPGXeMsjxQtFn6Njbc/M8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751267929, "uuid": "551290df-4f67-4c7f-8b9b-46f7051eb604", "value": 91936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751267929, "uuid": "23daeee4-8d03-48d4-85d2-8ee8547b629e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751267929, "uuid": "e35060e8-8e58-4c97-9a03-d6c3593ca025", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea55995-55d5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751303508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303508, "uuid": "56df9b1d-6e85-4945-a9b3-9a55daa6f9a8", "comment": "Malware payload (Mirai)", "value": "c3c87afdc0e166a53d096a691247218e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303508, "uuid": "39348e6f-8fd7-4db5-8da5-2fb0c3f9656a", "comment": "Malware payload (Mirai)", "value": "245daaf02866c349c32028beeaec0c428a85ad4a0fe3df40449ad0cdd2942db6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303508, "uuid": "6c7edfbc-4c6d-4dfd-9fc8-13769520ef24", "comment": "Malware payload (Mirai)", "value": "545c78f887f52f55655c166f4e9dfac1709d5618", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303508, "uuid": "515ce6cf-bdbc-4487-8bbc-0b6e836abbd4", "comment": "Malware payload (Mirai)", "value": "4d30ac6aafa002bd583b1b64fa6cb84f32b238c7d99af8460e8e21d3dd1911c8e70330f5b28b9b919177af6f7063d72d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751303508, "uuid": "93c53a04-65ce-4411-a60c-a753774640cb", "value": "T1E8B35B72D826AF68D655D0B0B0B48F796B53A981824B2FBE2577C3744083DCEF505BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751303508, "uuid": "56d7aad2-2d08-4eda-b9e7-8338571d7665", "value": "1536:VaMJ6h9bZ42nmW+C4Kzrw6fUM/mZzSGWZOGXm8fVUYT/z0:VrJ6LbZ42S2zeM/sSGWpXm8TTb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751303508, "uuid": "af32ca4c-8c51-4488-83bc-8dc58317f070", "value": 112868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751303508, "uuid": "4c62c5ed-61f2-475d-aa04-9c3be92d343a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751303508, "uuid": "f66e87d5-384b-4cd2-8c64-ef257732586a", "value": "cutesh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b82475-55c7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751297743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751297743, "uuid": "84ec1630-497a-4681-8260-41d7d0e0abf6", "comment": "Malware payload (Mirai)", "value": "e1ba4f86ed5c6c93b1ee46508b5e989e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751297743, "uuid": "947b2486-bff5-4164-9283-17d08fb59be2", "comment": "Malware payload (Mirai)", "value": "250b246f923c9d2ee434204388faefc8477ed0f9e539bd98e5947e1eb76bcdb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751297743, "uuid": "5b3dff1b-9d3e-410a-8462-32725c9bd7ef", "comment": "Malware payload (Mirai)", "value": "ddde97761f581a432e2dcd9a0191f07c2742cdc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751297743, "uuid": "169e7d08-b7da-4aea-919d-ae8a44477685", "comment": "Malware payload (Mirai)", "value": "5f1079f7b36e2442081bc9a4d2055b95999a3d027c2f306497daa23ee3b581adac4d1b3b16d20e6e6e8b04dbab8249b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751297743, "uuid": "d78199bb-8710-4f3a-9a45-ba2b8ea8e067", "value": "T110936DC5F643E0F5DD5704712177EB329B33E0BA211ADA93C3A59E339CA1541DA0ABAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751297743, "uuid": "5c46a393-205d-4431-8019-7a249f91a461", "value": "1536:OOFjw82Bny2L7xrGePFC/1Qh+w6VSOUiSdtdlIU0zwPLNblSvbfM/:OOFs8wny2LFDPK1Qh+w6VlUv5lewDVM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751297743, "uuid": "cab6c585-74dd-4623-9469-bea949cc26f5", "value": 95880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751297743, "uuid": "c23f1be3-febe-4045-8269-546ef6a2cc5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751297743, "uuid": "89f736af-9abf-4f29-a43c-a64a584598c4", "value": "cutex86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d9c7f8-55b7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751290904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290904, "uuid": "19ba9844-2506-4f85-afa1-0fbb841ee713", "comment": "Malware payload (Mirai)", "value": "7885cfecb26171db1090204a8e1a098e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290904, "uuid": "4854e86e-0cf7-4466-8f87-088b138a7f95", "comment": "Malware payload (Mirai)", "value": "25339e20a6ff9dbf6dcb469860624a8ff0d3c452b2a30fd622703c161857a3da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290904, "uuid": "9eb6c960-95eb-4ac1-8166-169e6bfe4b5e", "comment": "Malware payload (Mirai)", "value": "f11a5e30a140e79303331c136b56645f7b01ad6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290904, "uuid": "6d31c722-2c9d-43fe-a0b5-ace9acf34d2f", "comment": "Malware payload (Mirai)", "value": "9c15c3f3d793776937fe57f47c39ecb7b4ce80c94b8e7fc249fa7449c09a9f9b45502f78fa049cfd1df9499081e7ee6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290904, "uuid": "95efa1b2-caee-481a-b7f6-3b768d8658cf", "value": "T13C83FA46F9418F01D4C622BAFB6E418D33136BA9D3EE7112DD20AF5027CA99F0E77552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290904, "uuid": "79ee66bc-8609-44c1-93e0-817112c31acd", "value": "1536:TFnwukIkMVBuQAxULm+mxIfQdVdLs9nOG2ETYqovgiTO5fGamB107GNlMtiG+Csy:vkVkAExGIYdVdLSg8YqggiTO5fGamB1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751290904, "uuid": "a41729c6-4be6-4d54-bef2-c07fe4b280ad", "value": 87524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751290904, "uuid": "946bf4b8-d881-4c7c-8c6f-6e2d43047578", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290904, "uuid": "21519135-78c0-4fe4-99e0-d993693dd351", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e1cffbf-5590-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1751273791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273791, "uuid": "cad84bc5-411c-40d3-9f77-c4c08e1f9d49", "comment": "Malware payload (Formbook)", "value": "87879bc856fc34702c86f982f8509335", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273791, "uuid": "6b8cb3a9-82f7-47f6-a364-1b4f8a1a6c39", "comment": "Malware payload (Formbook)", "value": "25abcd08bf62540d75ae237c227d934cd1a26a954643dca1501367320b92055b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273791, "uuid": "5a7b0473-22a4-4473-a5d9-def24ddf4b10", "comment": "Malware payload (Formbook)", "value": "b1e08bd93f89b1dd158d2600395830854aece07c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273791, "uuid": "1b928035-d9e1-4b33-8659-b285977cecb4", "comment": "Malware payload (Formbook)", "value": "208e9de26c8c5348da19cbcb8b2fddd5e98503b82d5548532cfeeaed5def854bce336098153eefe5fc7b6d77cb3bdb19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273791, "uuid": "dcb14e72-eb53-4eda-9ca3-f23a9717edc4", "value": "T1C955BF027381D062FF9B95334B96E63157BCAD260123A61F13D82D7BBE701B1563E6A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273791, "uuid": "5d2117c5-9249-4c7a-a78a-4800c1d88de7", "value": "0b768923437678ce375719e30b21693e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273791, "uuid": "6ff1788d-1bb5-451f-961d-b4c734d949a9", "value": "24576:j5EmXFtKaL4/oFe5T9yyXYfP1ijXdaBZJlkZASMTpctMrWx3akohhO63:jPVt/LZeJbInQRaBZjkZASMTpcxKZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751273791, "uuid": "fb46013b-373c-44c8-881c-ce59d2a99c8c", "value": 1391616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751273791, "uuid": "c7ca891f-2413-4dc9-be0c-2f9c131ec755", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273791, "uuid": "43c2a1f3-1498-4f83-8f6c-9194924af1ce", "value": "Order confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c1147f-55af-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1751287281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751287281, "uuid": "e2c471cd-81a0-411b-9d66-28cf431c163e", "comment": "Malware payload (LummaStealer)", "value": "71018fa67455ea2b21fe9a4958339039", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751287281, "uuid": "3c6a966c-30cb-4ada-982c-6e65e8511f0c", "comment": "Malware payload (LummaStealer)", "value": "25e81ccb9f2e3c498b6da2e372f4caa4070241725c01c698eaadd2678cfa814f", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751287281, "uuid": "dfcfef76-99b4-419b-9b1d-8064f3de8b3b", "comment": "Malware payload (LummaStealer)", "value": "642e156710fea3b6030fce97a33d5a7ce029a9e3", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751287281, "uuid": "f754175c-61f2-42c5-bb49-c8ff8ce02f13", "comment": "Malware payload (LummaStealer)", "value": "d8d5749cff86b60ec759792dd19689b318ac8244d773d934226ad52c58cfbdcb6f7ef8b3779861d65cad9eb699894e9f", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751287281, "uuid": "477d7484-eecb-4443-9177-3b08eb276105", "value": "T10A2812B03324713D2947149734516FDBB63AEA5333C04239D92BAD2836A7BCDAB853E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751287281, "uuid": "938f11ea-3022-4447-ab52-c07871a38e77", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751287281, "uuid": "4d74b933-aa05-4397-95f9-567104f32fd1", "value": "24576:W0aTqbCP824+rT2VFStLKJXE0PePJr6H4mbpOXGIHhW:WKb+f2TMQXdPehmYmbp+HhW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751287281, "uuid": "e8a837ea-cbe4-458e-b164-383df1ba9260", "value": 98578809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751287281, "uuid": "5d69d322-75a2-4bbb-a063-85ffd71f26c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751287281, "uuid": "79b040f8-f47f-4cad-9e9c-64dad55e6fdc", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b17ad43e-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751291218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291218, "uuid": "45e1cd88-3dda-4e44-9133-cb4f41666074", "comment": "Malware payload (Mirai)", "value": "bd3ae3faee72595c0c8e27acb09d421c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291218, "uuid": "52f224a3-1339-4703-999e-e6d352cc00e9", "comment": "Malware payload (Mirai)", "value": "267e0d7a5af418392c435e6470d84ff53ae8d04383bf3f0e000f6dc60c7d0e9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291218, "uuid": "586ea580-1a07-45ba-8439-b54834a2d003", "comment": "Malware payload (Mirai)", "value": "f336c8602e48778b3cf2b00ce38f9c34563ada2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291218, "uuid": "64c64f5f-c769-4f21-8774-fb923ee86ecf", "comment": "Malware payload (Mirai)", "value": "492f3b727ce4d154689cdddb91671f2064ee12115e1da590dacdf6b4af2eea11763aaaac1c4242764689026df6501588", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291218, "uuid": "f52e30c3-f27b-49f3-9b78-5a1716e413a7", "value": "T19A335B01362C0E57D1A65EF4293F57E083BEE9A021F4F68C265ECA4A4275E33058AFDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291218, "uuid": "adeeb93a-2fa6-4571-af73-4c0da1cabfa1", "value": "768:YQ1rRJTgyEIY0X09/ORFl++eP4TM6GdTKVPBawtL/aQxkEXtCCQTc9ItPEG:ZTgAV092FcP4TFgEL1x9oFTDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291218, "uuid": "40120a6c-bc48-461d-93bc-dc212471c0b2", "value": 52792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291218, "uuid": "d8a3a1ca-241d-4e1e-abf9-b74d94a1190e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291218, "uuid": "8effedbd-fbda-4e46-99cc-1e56ec0b1e1a", "value": "miraint.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae6f664d-555c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (CobaltStrike)", "timestamp": 1751251700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751251700, "uuid": "de1b0b3e-4589-4a6c-acec-b9dbb8df8b2c", "comment": "Malware payload (CobaltStrike)", "value": "d4d112d2d18eeb18d1405f8bd5a0d155", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751251700, "uuid": "8c5d1bf6-f69c-4b96-8efb-549964427f91", "comment": "Malware payload (CobaltStrike)", "value": "26ee09068f5fec0d566c2068c7f32cc3fe82a35e7c0f82b253e79eb42b01bf16", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751251700, "uuid": "9b6baa34-7314-4ee2-9ec2-f926ac19dbb8", "comment": "Malware payload (CobaltStrike)", "value": "547f31b5f89bea3805e1ebe51de7e502bb961a94", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751251700, "uuid": "000d2f0d-d6c0-40ca-af5a-2b138b9b8d6a", "comment": "Malware payload (CobaltStrike)", "value": "749d01201d612de06ddac0971bd3b23b44f8c5d3bbf6bdd6a8bcf5b387da0c32bd25a1e90115995b664d873ab825717c", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751251700, "uuid": "17b1b604-496c-4e70-a451-552572f4d448", "value": "T1D5565D07EC9515E5C0AEE2318676A252BB717C456B3123D72BA0F7382F77BD0AA78710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751251700, "uuid": "0d329b02-7467-4ece-a011-b3fbc3f9acee", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751251700, "uuid": "4365d6e7-0f47-4adc-a5df-76781e9305e6", "value": "49152:i52PacCOKJ54FKdztCoCAiTGF8whn4BdNQw7lEPs8zxXey3UdqjHuSx4wKeK9KEf:iznlVCYmvN77lq8DfuE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751251700, "uuid": "94406f39-d309-4172-b18a-8dd6a5799e84", "value": 5928448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751251700, "uuid": "bc8b091c-9ba4-4ed0-876a-2f668cfeff84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751251700, "uuid": "fd1a39b3-049b-4bb8-ac61-b7f3c0b21203", "value": "hide2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426fa674-5580-11f0-8bd0-42010a9c0005", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1751266980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266980, "uuid": "f2871fef-a824-42d9-9d98-3ed29d8a023d", "comment": "Malware payload (VIPKeylogger)", "value": "d96973f17bc64e02fab58abe2424bf02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266980, "uuid": "5c914683-73ee-4464-b4f0-fc3ec56df844", "comment": "Malware payload (VIPKeylogger)", "value": "26fcf3b70d8119ba0d243c7de7e96ee213f143eb7dc806567c0c78c5f1b0677b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266980, "uuid": "33673f40-2515-49a0-9225-1bc196ba6545", "comment": "Malware payload (VIPKeylogger)", "value": "205bb856dd0adaae0e5063612167dad4bc184141", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266980, "uuid": "ffc8fa66-758e-4387-96ef-f37e6b167ef5", "comment": "Malware payload (VIPKeylogger)", "value": "a98e19b8ac4c1927fdc2df7ee0bceed1c6e8bcf8456227834fe378201445c28681555f82aa388b6145c4072307e8b147", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266980, "uuid": "dc3d42ec-0c20-46c4-9db0-2b7648b5b584", "value": "T11F451205B25CD6FBD09181B1A95B54C32B657E74CCC0298BB2EEBB094E3B0A3D34B95D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266980, "uuid": "2f2ef458-d7d4-4b94-94f8-987bbe81d11b", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266980, "uuid": "7ebf7d1a-6f91-4aaa-85c8-dcd15f19622d", "value": "24576:q+w4gn+z0BJ/Yg9OUIshoj4xAr49fyUWtNKXKbRj+bb9FWJi+:tw4g+Qjgg9ODsCyArkTWtmKbRjgXWY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751266980, "uuid": "3170a61b-65fe-4477-8fc4-2d2630269d45", "value": 1167408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751266980, "uuid": "e72511fa-705e-493a-995b-b0ced5222186", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266980, "uuid": "d44bd643-44dc-4e30-b585-c7c15264e19b", "value": "JUSTIFICANTE -Carta de pago.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "106b12e9-556d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1751258736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751258736, "uuid": "a96fdfb5-eba7-4eca-b014-c7a439420ead", "comment": "Malware payload (Formbook)", "value": "2bc162c8e9bb486bfbe9e441464f8c1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751258736, "uuid": "7c2bb997-b95f-433b-9567-700801b655a9", "comment": "Malware payload (Formbook)", "value": "2740e9c875b6d70c61a6bbe6793d5820ca89ed0a479ff85c68dcbed917545d8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751258736, "uuid": "dc90ff22-e558-4696-9fd0-598d545e4ebe", "comment": "Malware payload (Formbook)", "value": "bf6cd5d16742129db9395d5ce0477c86bb54d647", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751258736, "uuid": "9fc27176-e44d-4171-86d5-619d565a645f", "comment": "Malware payload (Formbook)", "value": "6243fd5e2b6f3a2cb56677be24abc36c48369ec143e33184f6793574089ecc711298242162a3f8de4571a81950cc1f59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751258736, "uuid": "4b549a00-5d13-4912-8a21-4ecd64cb3092", "value": "T17E55CF0273D1C062FFAB96334B56F6215BBC69260123AA1F13981DB9FD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751258736, "uuid": "661a3d91-1ab5-4340-bf25-73ea555252bb", "value": "0b768923437678ce375719e30b21693e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751258736, "uuid": "c1117543-1cef-4547-903a-6fd026399508", "value": "24576:a5EmXFtKaL4/oFe5T9yyXYfP1ijXdaImboGaSGiml9BbY9VjaD9TNc:aPVt/LZeJbInQRaImMXSGiml3mp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751258736, "uuid": "0dc5951d-2842-420d-aa1b-b8e9aa366720", "value": 1306624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751258736, "uuid": "4a004e32-a32e-40ba-8466-5d513ef70ab2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751258736, "uuid": "956644aa-1e9f-4bc1-b36e-2efa3928fb64", "value": "NEW PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3adcba8-556e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751259412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259412, "uuid": "15a3d140-4161-46e3-9d1f-644ff6468ed7", "comment": "Malware payload", "value": "344bfc12e9c4bb7eec956efe21ef2ece", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259412, "uuid": "730cf80a-699b-44de-8f27-a092ec8af87c", "comment": "Malware payload", "value": "27ba7aad479f1396cf0bcea600033d8e2e1bbc560077b39059e371471761a477", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259412, "uuid": "7c54f7ed-e272-49a8-a9a2-7e0f71ec3dc2", "comment": "Malware payload", "value": "05343d290ab0d9b6a8492cd52b6c8fbfe1242374", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259412, "uuid": "3e6c92bb-a870-4844-a7ae-7660a8cf201e", "comment": "Malware payload", "value": "5da40496b52c643d684bc0c4d29db8eb0cbddd3c92535c56ce03129214551ff7dacf3e2841905da28fbd0d2440715177", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751259412, "uuid": "692ff3ee-a9c6-4f22-96fe-9a237e8c00d7", "value": "T1AAB402118F881F8BC5AFCD750A2E167311AEDD9F46CA643E807CDD48B6A6D0D6783C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751259412, "uuid": "8aba540c-8654-482e-a5e7-c216fe84ff08", "value": "12288:7A84JF9Qc8GgZxTM6m1U3snB6NnVuqnAtSyBpywBdlEykR6LkV6N0L8AXwtZJHZz:/M6m1U3rVuqAtSySwY1gEIZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751259412, "uuid": "a506627d-e0be-4475-915a-9b434f0c934c", "value": 509272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751259412, "uuid": "19bd9608-6ffb-4739-8250-8af0e705600d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751259412, "uuid": "64c28b16-1a98-497c-a3b3-72a7c972221f", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a205e2-55b7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751290910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290910, "uuid": "29a8329f-3afe-4ccf-961b-ab7236b8cacf", "comment": "Malware payload (Mirai)", "value": "1d556bd8a48911ba48a5321768807623", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290910, "uuid": "108b85c0-de72-4649-bef8-3a888dce8ac3", "comment": "Malware payload (Mirai)", "value": "28b3af3c8a7a4e7363f4057af86e5ac01ad13237e5758c0e443d8c91148c883d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290910, "uuid": "2764156e-80ba-43cc-959c-b9e169311b54", "comment": "Malware payload (Mirai)", "value": "00735f5b7941cf60b39dc999b0847d2f02d39960", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290910, "uuid": "e676178e-8c8c-4582-8986-4559a18fe7f5", "comment": "Malware payload (Mirai)", "value": "59812335869997e70569e44062f64140afbd3ecccf0834f0678f179a737a0645531888c5270e333e41041bf38f811f4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290910, "uuid": "f3bce411-3c02-4937-89ff-c2cbf4b006fb", "value": "T1B3731B46B991CE12C4C512BAFB6E508D33136BB9D3EF7212DD20AF90778A49B0E77512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290910, "uuid": "e6d8e1e7-741d-40e1-8099-7ff56c444dd3", "value": "1536:Psn9A1JHkBGfQAo1L7aVY0RH+dVdRchoNQ+SOYR2kv7aRcgLOIMiKfrRtWOgbR:WATHoA0iFRH+dVdR3SlR207aCfrRtWOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751290910, "uuid": "fe715c1a-afbe-4996-a752-2bda5b15ce0f", "value": 74440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751290910, "uuid": "0ddb0364-b4c7-4991-8470-8fabb9a81dc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290910, "uuid": "c969eae8-110f-4810-952a-fb98240fd0e0", "value": "mirai.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b13d08-5585-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AteraAgent)", "timestamp": 1751269103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751269103, "uuid": "0d43fb62-8cd0-4c17-b33d-cf04146257d4", "comment": "Malware payload (AteraAgent)", "value": "e52c0cdd91f477f2d65dee95a3871e96", "object_relation": "md5", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751269103, "uuid": "4e1e1044-7733-41bc-bd4d-9c3f4ffb07a6", "comment": "Malware payload (AteraAgent)", "value": "291453d7973b2d3df64567954ce5050f15b96d3853064c237615542f994a7824", "object_relation": "sha256", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751269103, "uuid": "ee55dde8-5e67-440d-8412-07b9435daa98", "comment": "Malware payload (AteraAgent)", "value": "7f230d92be78dc6f812a49686a197e45527253fe", "object_relation": "sha1", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751269103, "uuid": "73ca2422-7100-48d2-bffb-f5b824a0a56a", "comment": "Malware payload (AteraAgent)", "value": "cd714fafd2a645fa123e4259ca439a55672d58e431384fdf003d945c52a0c0becf2e30595416a97498e3493483d3f7a9", "object_relation": "sha3-384", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751269103, "uuid": "6fc43262-1074-455e-ba56-1ccefaf108af", "value": "T14CD523117584483AE37B0A358D7ADAA05E7DFE605B70CA8E9308741E2D705C1AB76FB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751269103, "uuid": "49eec68a-ea62-4d03-9673-657867e9aa90", "value": "49152:N+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:N+lUlz9FKbsodq0YaH7ZPxMb8tT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751269103, "uuid": "4587b76f-a529-483b-b49d-20df1598e689", "value": 2994176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751269103, "uuid": "04f4bd01-435e-4c69-add0-30b9b1c63dec", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751269103, "uuid": "395b352e-1efc-46ce-9a1f-44bf3a2c3721", "value": "Acrobat_DC_Update_LK24374.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0d34cd-554b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751244153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244153, "uuid": "748594f5-bf68-47a2-a93d-a47bce93fb59", "comment": "Malware payload (Mirai)", "value": "ea54fa7623367c0d4b5fe2d1a03160da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244153, "uuid": "a5596f07-2da2-496f-a456-9f54f2c87912", "comment": "Malware payload (Mirai)", "value": "294836c96ce4c60da653129e5803708bc83b335744f8d98abc807677eb355209", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244153, "uuid": "7825f364-2de2-479e-9486-a8581b3fdb2a", "comment": "Malware payload (Mirai)", "value": "cf110bbf20b1df0e4e4b17bf27220217b1c39879", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244153, "uuid": "8eaa9797-351b-4062-93af-cac98222261e", "comment": "Malware payload (Mirai)", "value": "d4fce04a598047c7d0615ae16a0c1b9d11fa6e5fef376aab49c12274a25defc6dcfbadad74b09e9b39b2747674d70d5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244153, "uuid": "985525b5-eff0-4e60-897f-e29638af8c9f", "value": "T17E230791BC819A2BC2D41379F5BE998E3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244153, "uuid": "43c4010b-fec0-4320-b21f-bdf02d35729d", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THR:5DmKF7Gxyk8cqoHAmWurAufsG56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751244153, "uuid": "725effba-79d0-446f-addb-24b9faa22913", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751244153, "uuid": "f749be81-f9c6-49b6-b58e-eaf9ade4ae00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244153, "uuid": "d89d6396-f4c3-458b-9eec-d049ef42e554", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b923fb81-556a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751257730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257730, "uuid": "c1715fe7-f68a-4671-8fca-93e99e7f19d1", "comment": "Malware payload", "value": "a59e869631e2e0cc496fda0901fa297a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257730, "uuid": "753024cb-9a92-4be2-8b96-702ebc43578c", "comment": "Malware payload", "value": "2948c4ac4e3177b92ca1b04f012729d6050e327c5fbfb52b74ed11b7e2acd626", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257730, "uuid": "243092de-8f57-45de-97b5-6515273c6400", "comment": "Malware payload", "value": "3e5f019abb2f25a3ef7a25b7df598f3f0fdda07f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257730, "uuid": "84fe3795-8d47-426c-a1f7-ee0c94032a9a", "comment": "Malware payload", "value": "b53fef78c536796b851a5fddc4ec6a44e34dba763d7a5c3c4bfb51b1cbcaa3eaeabbcc02a8755f2fd7b1559a6073ed81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257730, "uuid": "b57125e9-7c70-4f8d-8ee3-efd8bb75c182", "value": "T1A8A41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257730, "uuid": "ebed1793-9627-4530-a659-6605ecce68c2", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751257730, "uuid": "2d0fa3d2-c9ab-41ff-8598-e2134a35402b", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751257730, "uuid": "b7fb64a7-1421-4615-a1e1-3db86a01eee0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257730, "uuid": "275df04c-a5aa-4904-b11a-ec2162a5910e", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e8e8862-55d8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1751304716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304716, "uuid": "db3830af-a93f-414f-8bc1-a319075d0fa5", "comment": "Malware payload (RemcosRAT)", "value": "c983e593174bdf6b4b1884af14486a1b", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304716, "uuid": "65be1dd5-961f-4c3e-aa13-5eb4e4484cd8", "comment": "Malware payload (RemcosRAT)", "value": "29fec7167f40f62421f05562a60b42441773c934466286b627d23a19c0106fad", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304716, "uuid": "0e92fcca-f8e8-48a3-b45e-b9e85b3ebb36", "comment": "Malware payload (RemcosRAT)", "value": "d38b0965abb4f371d80faa1ab29b147373307583", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304716, "uuid": "05535f4a-9f67-47f4-8471-5742137e677b", "comment": "Malware payload (RemcosRAT)", "value": "8c25417cfbea3e2e7c396c092e7f3d121a939421336e3d0d2f4383e6c55589a84f0c36716c06f5a435392823ae0c6e33", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751304716, "uuid": "e3e47cd9-07b1-42e2-8406-16821b3f7419", "value": "T1AA557241D2C4CE1BD6E08B3A1E7952E27371FC9467627B1346247625F9BA2B42DC0EB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751304716, "uuid": "78721c4e-05e4-4b63-b59c-c5b86df02817", "value": "12288:ASVKc7AS/KnK5NvkzYM/6+3mvkzYMBsfxqcWuL3NB6l/d3LrtJJpLe6swOH:GLB/X3TBBne72BdPtJTC6OH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751304716, "uuid": "5dec3fb8-5a73-4311-8162-08e9b1a33f65", "value": 1392640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751304716, "uuid": "e9151aa6-2011-4b0d-b6a7-37baa00e63d0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751304716, "uuid": "773a351c-e149-47cc-90e9-84c4b730c091", "value": "PO#78698329.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbcc64b6-5580-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1751267238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751267238, "uuid": "111bcf2d-9b0b-426e-a3b0-206ffc567531", "comment": "Malware payload (ValleyRAT)", "value": "f2026402c06aa36ae0eeae87527fb694", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751267238, "uuid": "c71a0a80-d258-47de-9b96-f2a97a5b6284", "comment": "Malware payload (ValleyRAT)", "value": "2a3b7d65fecc28bfa3d326774b083c6a7f3e4163603bf812682162182ceab990", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751267238, "uuid": "b0974aa0-10e9-4e0c-a776-f9431f14bde9", "comment": "Malware payload (ValleyRAT)", "value": "cdc9359b89357197b306b73004f722e0bd5a7154", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751267238, "uuid": "85274486-1d35-4cd6-a31d-88ed53a3fa16", "comment": "Malware payload (ValleyRAT)", "value": "1c66b9ff4e50ff43f3b8edbaa269c53b1f5c1d3c5019c3334200f0199c8a50d37485b8e2b08be48ca6b6d4da83b3d6e2", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751267238, "uuid": "4201a3ec-64aa-4dee-9f29-99d0235d6e12", "value": "T188573316334F9F25D65330368CE77A1581633C082371568FA359FAB47A73A4B2863EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751267238, "uuid": "7d280b3d-6745-4303-91f0-e83642412a21", "value": "786432:euE9trW1eEtYLLXUy6S8VeELNwq6Z3fpQFXcVvMMe4QBOAS:HE/vXH8wQz6ZvpUXcVUMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751267238, "uuid": "6218c915-4ffc-49e5-b46b-d107d3455774", "value": 28876800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751267238, "uuid": "66eaba61-6bea-49d7-9d22-445dc3840a27", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751267238, "uuid": "1899a884-7746-451d-83d7-e2997b67b262", "value": "installer-setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f04822c2-55a3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751282304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751282304, "uuid": "c9c2bbb4-0a50-45b1-97ee-69e089209c28", "comment": "Malware payload", "value": "5fb36510a20ac6ed25a80f7e9fb83f71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751282304, "uuid": "b24d5d86-2990-4329-889c-85210596305f", "comment": "Malware payload", "value": "2a7607b8beb388d44316b4a36027b8e5b401fab52c7e52cad22cfa4a8796b103", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751282304, "uuid": "e61539a4-dcc6-440e-a116-46c26faaca50", "comment": "Malware payload", "value": "82fa3ad025e4c697950c4b62ca241db36cae2cac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751282304, "uuid": "6f9aaa9e-fe4a-45fd-9587-634ec63254ca", "comment": "Malware payload", "value": "6457fcc79617bdd62b9f918557c09cb4bb7b8cd48823c3f8687529c4c6e2b32074b9bd2322614273c4927064bc6340ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751282304, "uuid": "26aa5163-acf5-447c-a88f-1c6096503b0e", "value": "T15FB401CE9520D295C4B02D33C57BA2F282AB6D3609596E1CDDD8FF6B2CF67450638B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751282304, "uuid": "4a8083e8-6601-4e2f-9683-e8601236496a", "value": "12288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751282304, "uuid": "800a83ef-014a-48da-9337-b7ed19524faa", "value": 502120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751282304, "uuid": "4f09490a-591f-4276-ad08-1698f4913bc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751282304, "uuid": "076a1716-6df8-40ae-84fb-858f6a85c463", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "effed848-55c4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751296477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751296477, "uuid": "9380dafe-686d-4254-9acd-d9852c79ed59", "comment": "Malware payload (Mirai)", "value": "4a1ac266ee30537371b640cc1e538642", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751296477, "uuid": "3f416177-755f-4e3d-b1b2-de7c19c7e8ec", "comment": "Malware payload (Mirai)", "value": "2c49a241c769632d093157f447117a39595875b4f460ff0f0468ea763e0a6877", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751296477, "uuid": "3ba5c875-d110-473b-b129-4782f75465c2", "comment": "Malware payload (Mirai)", "value": "376dda0cd0df9c71203d0a213d222dcda78cfafa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751296477, "uuid": "95b5bc65-1582-4e05-aab0-d98ef484bc1f", "comment": "Malware payload (Mirai)", "value": "cbc975bdf2e1f365eb6b027cbdafac5741b3fa228512468cd2ba8b09e28c40e0453f5dfc1e7cdfc42da11b7d9c8648a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751296477, "uuid": "026ae21b-fc06-4b9e-b612-05a8ae4ffc92", "value": "T16603F1E3059EC709EDDF383958AFA4C75641134F4651D3D01ACC283A95EAB3A497D2F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751296477, "uuid": "493d2280-22a4-405b-9d5b-e5844bf4b52a", "value": "768:XbT2SCBQn78uABN6Fum3Gs+0cHtvY5DvmQJ7nLCeUgzYbQGnbcuyD7UKQRjL:uSMQLAJD0cHtvY5CW7nLCsYMGnouy8Kk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751296477, "uuid": "99cb3a72-4809-45cc-9979-a1462b0b243c", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751296477, "uuid": "bfb98860-4b28-471c-833f-bce68fc8eb11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751296477, "uuid": "b62d4a4f-662d-4c62-b063-081040f07879", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe59a1c-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751291967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291967, "uuid": "bf3db1f8-5520-4ea6-98a5-5bf252d33739", "comment": "Malware payload", "value": "8dbaee5bb302f8e35038f1e50faa9a48", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291967, "uuid": "4fd2c40e-d752-4038-ae11-9027648ec495", "comment": "Malware payload", "value": "2c73f3ced1f29f3ee1949607afd66b34d0fa774db7faf5599d1007081e314f84", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291967, "uuid": "e52e4fda-3a34-454d-ad38-ec3391f26220", "comment": "Malware payload", "value": "7d3fe0a029e7945b573cc6b677276cf7a5d2fdca", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291967, "uuid": "5e7819b0-06b1-4160-9b5d-27ce3048b3a1", "comment": "Malware payload", "value": "31c0bf3ee967a85659ef7ac8cd9f8785458815894e18178bc2ab9c556a7df5819a932e348e1b5fcc7c7687504b40ae94", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291967, "uuid": "6e5ec097-f325-4a98-b0b2-a29fe47ffcca", "value": "T110C297372E0352B40976C1ABBD0AF015F9D842779A196806FA8C419D1FF179ED0B87EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291967, "uuid": "a9ae19fa-b644-4ce4-b510-7be9a1fbdda4", "value": "384:s96n1Bm9AS9arQmtY8kWs+ifKck1Q90LY8:st9qIvz0L3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291967, "uuid": "504feff6-9cf1-4ffe-8349-d7403dcb918f", "value": 26068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291967, "uuid": "016f46c1-0c97-4271-9cf5-a1b20efe4413", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291967, "uuid": "acbbaccc-14bd-48df-857f-ad8ea08b0f1e", "value": "RFQ875665.VBS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3515a1-55de-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751307452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307452, "uuid": "d092fb1c-dea8-4489-a980-a85ed4f44d22", "comment": "Malware payload", "value": "ed57e253b8a6fdddd8438271f2b2a32f", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "PG&E", "colour": "#22FC5E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307452, "uuid": "ac9b8226-3e37-4bfe-8002-9ac1ce44253d", "comment": "Malware payload", "value": "2cb092179f6766bc34b5b8c158be359f602df062b42c36601d9228f47d0bd0f6", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "PG&E", "colour": "#22FC5E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307452, "uuid": "9f6f7d49-2d46-4a66-963a-6b0336fcad17", "comment": "Malware payload", "value": "3474b99c441de01df5a9dda4170777879adcd16b", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "PG&E", "colour": "#22FC5E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307452, "uuid": "8038f32b-9ee7-4e5f-bb80-766a55b019c7", "comment": "Malware payload", "value": "255195b4df83d7f863f3fb42227ce6f3c894e358e86679cb2f995307dba5efa2f71c0788f2d73f782fda5915c88b84ab", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "PG&E", "colour": "#22FC5E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307452, "uuid": "4f6bbba1-21ea-4e10-86a7-5e7c1aad65c9", "value": "T13575E043EB06E46EC8F7833A563B462651029C26C793E78B4D94777C2DBB9D08E85EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307452, "uuid": "441245c0-fad9-4d52-81ec-8bc85dd7238e", "value": "49152:ZciqKD8UyvUIMHtE3Khxct60p5PKY2JU+wrSY158:ZcizAUCzitE3Khqt60pdyJUN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751307452, "uuid": "354614d5-e528-45ed-aa10-772343e4edfd", "value": 1683703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751307452, "uuid": "fddb73a8-f8de-4681-a104-7303921da92d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307452, "uuid": "8f6f26c9-c1d9-41af-91e9-21a9ad953c15", "value": "Android (5).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d31d2c9-55f0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751315021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315021, "uuid": "094305e6-5677-434f-b44b-707604ef5018", "comment": "Malware payload (Mirai)", "value": "86ae815b2782f05f8e59d1a4e77ee935", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315021, "uuid": "a622ffcb-d408-4db4-b5ce-5dd243cce390", "comment": "Malware payload (Mirai)", "value": "2d5386618b42d8b94ada6ffd98031f36560b5bcac53e5319fb8179fa88b28a26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315021, "uuid": "ee28a0e7-583b-4be1-9fbb-6ae85bcedfc3", "comment": "Malware payload (Mirai)", "value": "33372601a8c7bde89934b0656df0a28589d7ab39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315021, "uuid": "653a4a7b-b2aa-49c3-9828-6d91b4568000", "comment": "Malware payload (Mirai)", "value": "0f441998d0299c32da7acdbd3d591ab0e409f5194668bbc73488872123264a4dc4e2585fa24aac545d609151c1ab0ba6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315021, "uuid": "768b9625-958a-4a31-ae20-bbdc97bca536", "value": "T1F7F2F161DD4AAC34D878413AE57C824F9BDB5390919D3120591A4E244FABA1EBEF3F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315021, "uuid": "208d845b-7234-466f-aba7-1919593a1a93", "value": "768:6Alb5VA5dcjD5CoHSg/j6FltLk8Wp/ZaMduB6nFnyj50dnl3VUKs3Uozs:9RAvcRCoyg/0T0RkMdCK1E0zVUHzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751315021, "uuid": "999e5385-3cbe-475a-849a-1461018d0bbc", "value": 37020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751315021, "uuid": "ed9d2cac-1170-43d3-9aca-f309c0560ecc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315021, "uuid": "720130d5-a4c3-4235-b86d-f46304850cc0", "value": "SecuriteInfo.com.Linux.Siggen.9999.20988.14355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af86bbca-55bb-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751292504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292504, "uuid": "8bbb9ffd-044c-4f2e-a285-021e89f7ef31", "comment": "Malware payload (Mirai)", "value": "bf59272ca48170357bf55ed4371b2eb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292504, "uuid": "86b62fec-c479-4c30-aab3-5ab4be4bdb5e", "comment": "Malware payload (Mirai)", "value": "2d94c64dce6e28c028a34b95fe189a8131e904ca45148e2b484e269b2df55bba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292504, "uuid": "d41c08dd-741e-4814-b3d1-e765a71e63f8", "comment": "Malware payload (Mirai)", "value": "c7422fc1130cdb30649863a152d327dc6a9a8778", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292504, "uuid": "97a268fb-ebee-4322-9fef-f1080e48f523", "comment": "Malware payload (Mirai)", "value": "6bd7731c148edb376cc6b762995f508fd53fe9940434e749a18821344744823101095ba0214180d6b9b211d71dc44fa8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292504, "uuid": "9b007391-2aa2-4bd5-8633-83f5f7d28678", "value": "T170739D63C8281D98C65C86F875649E3B5363E96066C72FF216ABCA76D003EDDF5093B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292504, "uuid": "4ac82baf-2ab5-46c8-b171-51b3787ba118", "value": "1536:Z/FwSgMCRTm8C9Xb1yK2CZR7zR45gCtH5XM40:ZNwSrOaL9XB12e545gwlt0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751292504, "uuid": "4dcc23ba-61af-4721-9eb6-75b363c019f5", "value": 75296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751292504, "uuid": "6c4a2be1-6353-4c27-a4ec-9fc5d962379a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292504, "uuid": "568094a9-c077-4439-b2b5-3b54b17dd412", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d6cfd9c-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751243806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243806, "uuid": "b7ee686c-420a-4e9b-b613-dbb9639f9c1b", "comment": "Malware payload (Mirai)", "value": "53537234fcdcdd357e67d83de0862e14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243806, "uuid": "332c0e7f-2ee1-4067-89e3-90841cf760d6", "comment": "Malware payload (Mirai)", "value": "2dd5e21b145e0812a62378ea66b28f6f93266d858b01ae302900b3aecda39158", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243806, "uuid": "0cf5ef32-93ac-4c1a-bfe4-08a510ab896f", "comment": "Malware payload (Mirai)", "value": "9bf039614fdb2ccf235326c2d5661fedbadff4e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243806, "uuid": "7bcc825f-cefb-4140-a0c9-dc0a7d7dcd6c", "comment": "Malware payload (Mirai)", "value": "b1db3cb23edbef8c5b05b6c97061ff892e3dee5d820f743ec432520341f0ea8e31fd1b019c8337fa0da0f9040d1f3d63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243806, "uuid": "daf78a53-4352-44ff-a418-d53b9c64d592", "value": "T1BD330A8EB8029D3CF90BE6BE54164E0DBA3177C152830B2757BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243806, "uuid": "c05e4e5e-89cc-4f4e-bb55-1b5b4733f5b3", "value": "768:gduPBFnHooqR8qOCKq2cH4Y3e+TK806MMUVjzMfQXOtHud2oG0:r/hqaJM53eqK806MHdMfQXoHuC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243806, "uuid": "767fd653-ef8e-4729-82db-3dfdd78e76b2", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243806, "uuid": "37870c83-9a38-4d4a-8600-a42bec081306", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243806, "uuid": "767bda3c-8f65-4c10-9e3c-6f9d694fab50", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e817e452-5550-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RedLineStealer)", "timestamp": 1751246642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751246642, "uuid": "51bfbb56-2f9d-4fed-81d0-f872ad8f3113", "comment": "Malware payload (RedLineStealer)", "value": "7c5490c346d9bdc918ea16efdccad257", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751246642, "uuid": "026639dd-bb72-42b8-a6d7-322ffd42ddfb", "comment": "Malware payload (RedLineStealer)", "value": "2ec91258dd18a298cb4e7cf2c13af556296b7c63d2a67b59ffecf61af88a31a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751246642, "uuid": "e6498bf9-ff6d-45a4-bb21-7b8889102120", "comment": "Malware payload (RedLineStealer)", "value": "cbd673d366f5f5dc7bdb8327691d1acb8b147349", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751246642, "uuid": "508cae86-8c7b-439c-921d-e729b805cc51", "comment": "Malware payload (RedLineStealer)", "value": "495e52e79b0aee2972c43ede0a71b7fa4b9cab4b18f4f6504cce2badf16e8fe62f1b7b065469119f1099336cda45ed8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751246642, "uuid": "8ce8621e-51f6-490b-b553-9c4cfa681de2", "value": "T1F8A4DF4A736410B8E9778139C9A79647F2F27855077093CF13A483B99F2B7E19A3D322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751246642, "uuid": "eb41f9f5-6313-4628-908a-7bf4f8fdb0d0", "value": "11eac9769adb755cf6a9ae47d4dfee7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751246642, "uuid": "40b70d1f-3bb0-4792-9833-da310b9d0116", "value": "12288:XdqT7v2AuDoE2PlipXqfxuZxKZ+Zj5A4Y+L4:XdqT7v29oE2PwhgxV+Lsy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751246642, "uuid": "b20e5f0b-d104-434d-9078-1ba1b2130108", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751246642, "uuid": "31be6027-9f2b-4c63-b98e-c13722aa2c4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751246642, "uuid": "8b129619-1eb1-4eac-99f2-9001c29f39cd", "value": "SecuriteInfo.com.Trojan.Clipper.597.10274.29807", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd892eac-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751291239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291239, "uuid": "4dd204cc-1b87-4345-975a-a7c3703ce09a", "comment": "Malware payload (Mirai)", "value": "a8accbba122986a760f6002aecdfccfb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291239, "uuid": "d91cff0e-dcc7-47eb-a211-cdeac2a9b9f7", "comment": "Malware payload (Mirai)", "value": "3070c8e440bba8491d200d5760f119e7db1c72e5301def636cf454553c4b7d91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291239, "uuid": "76777475-88c0-4f5b-91be-534cb45ebb4a", "comment": "Malware payload (Mirai)", "value": "8126fc9328a9fe634977b3fd0e0272e68ef0625b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291239, "uuid": "ff34faa8-fef0-4d70-abac-03401b8a0776", "comment": "Malware payload (Mirai)", "value": "7dc1a04e7bd78ef2a21a942dc56fa73924ad018c2467ebd89aecaf0a5f1d81659a88e812f6dd3d2ca175196e15743122", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291239, "uuid": "070580b9-6a3c-4ade-9cd8-b1319f876d61", "value": "T1AF631A46B992CA02C4C513B6BA6E118D33137BB9D3EE72129D206F9077CA9EB0D77513", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291239, "uuid": "c4b4d591-3007-4717-bfa9-78233d273350", "value": "1536:sVndgjvNRSVccQA8ELndu4+sqdVdv509209JG7c6LB0IiibvjitWPxb:MgpPAXdursqdVdvSHGVvjitWPxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291239, "uuid": "6380e757-744b-4bac-ae94-9d8ffa5f0d6a", "value": 69108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291239, "uuid": "40c0e1af-1fb5-4fe6-ad2b-2d4a1406f743", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291239, "uuid": "6e794b6d-8057-4af8-b4bc-2496e1dcd146", "value": "miraint.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9576bb-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RedLineStealer)", "timestamp": 1751292014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292014, "uuid": "5d0fa607-bb25-4c34-a3d0-728750832949", "comment": "Malware payload (RedLineStealer)", "value": "d7ff5e6c677a5555378846cb9794c9f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292014, "uuid": "462b71d7-04ea-40d7-bc7c-a22775a3eac8", "comment": "Malware payload (RedLineStealer)", "value": "30a3b2dadb38084cc19d271b08b15710939b3b9de88efa716684b7ebe819b7d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292014, "uuid": "aff592c3-81b3-46de-b207-e50d969ac1a1", "comment": "Malware payload (RedLineStealer)", "value": "61060217cc4ba3dc3e05c16e6cb0a3fe480d4d87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292014, "uuid": "fc58ca9f-f938-490f-b4d8-48b29ab0cca6", "comment": "Malware payload (RedLineStealer)", "value": "19d058a1636fe0ddb577d0a029366130e5446467ce2d737d42dccaaffd9475f5ff474afe52b762a1bc05c3fdb62cd0a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292014, "uuid": "0a9493e5-77d7-45d8-a766-9020e5669b48", "value": "T14E85D0027381C062FF9B92734F5AF6115BBC79260123A62F13981D79BE705B1563EBA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292014, "uuid": "5c264641-bedf-4f07-abb4-1fd83c53cedb", "value": "0b768923437678ce375719e30b21693e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292014, "uuid": "031ab58b-5018-4791-85f8-45116ead6665", "value": "49152:nPVt/LZeJbInQRaaDY/XMqDeMQYFs1Z0x:PTYbInQXYkqApgx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751292014, "uuid": "4d6a22c0-2588-445a-86d3-ede25cf0aa59", "value": 1723392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751292014, "uuid": "18d8b2bf-2d23-4fcc-8de1-a42eaf095184", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292014, "uuid": "8bc0f124-021b-4355-8022-1c4899314b3e", "value": "New Order---PO230607246L.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cddfa57-5569-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751257254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257254, "uuid": "cab7475b-5e98-4fdc-a743-f4209fae321d", "comment": "Malware payload", "value": "4b0165a01a7c49fc583d972e2ef3b89c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257254, "uuid": "916fbf6a-6815-4fc6-98ab-74f4e3822c02", "comment": "Malware payload", "value": "30ced073af2d5091f67f67bc7824e05dcd8a814efb6ca68f327136f60c3bfcdc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257254, "uuid": "db2f21fb-a6e2-4215-8e7f-b05474225edc", "comment": "Malware payload", "value": "67607e5e9cc54057183a6c02667469cc6c49da11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257254, "uuid": "bd41292f-7c47-4fd3-928c-64a75144ccb2", "comment": "Malware payload", "value": "518b187cc093d27b92f61c9f79bf7867c75c4a45829c68bf7ff56407059914c04079fe993d6b75a8af960834faf36bf8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257254, "uuid": "5efe8d38-e08a-466a-81f4-c89c69f4e517", "value": "T149B401CE9520D295C4B02D33C57BA2F282AB6D3609596E1CDDD8FF6B2CF67450638B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257254, "uuid": "b2b3637d-afb5-41d7-8110-45b8cc178619", "value": "12288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751257254, "uuid": "3014a50a-bdbb-4456-96b5-7df1e3df4c93", "value": 502120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751257254, "uuid": "5ea1af99-d80a-416e-af5d-6f87df7a2a06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257254, "uuid": "609081b6-eaba-4bbf-aa02-4cdda561b305", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43df09c1-55d0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751301342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301342, "uuid": "378276e4-b224-46e2-97ef-557e03f62df3", "comment": "Malware payload (Mirai)", "value": "3d7f4bddbe48b972805af764f115d600", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301342, "uuid": "869d750e-a162-404e-8c48-fad038662074", "comment": "Malware payload (Mirai)", "value": "31bd74459680c387a1eb10667a44b7691101778b2eee79dd9e33c27cf18af7eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301342, "uuid": "7864d20a-a1e6-4921-8995-c1de59313c37", "comment": "Malware payload (Mirai)", "value": "d6617f6dde84075f6c0faaf653e2bbe3a6084802", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301342, "uuid": "6bb1b4f3-99ec-4c53-b243-578c4dd285df", "comment": "Malware payload (Mirai)", "value": "14550a05dba3b45b2972c85e9d4948cceeaa97c64578d7a95e62ac5712534d0c93fc0fa750d6800adcb4c1b729befe04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301342, "uuid": "7f929d5b-b898-4c81-bfdc-48b2b3d7615b", "value": "T1DAC3F745FC415B13C6C612B7FB4E428D3B2A17E8D3EE720399256F60378B96B0E3A546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301342, "uuid": "25fd4631-b13d-4b6b-91eb-ea32ccc26d98", "value": "1536:mVgG56RHUUNdIUeqtz2YvS4V4ztT2P4nmXXcvA46nbt9DlYRwywFFI+vVURtfeWq:mVNId99tzA4GtqP4nmv46bHbEb8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751301342, "uuid": "d8122012-6f2a-4125-ae92-39d1c98ab047", "value": 125696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751301342, "uuid": "e8903dc9-0d40-4033-a6ec-88b777a8f37b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301342, "uuid": "85e45e8a-6d3c-4714-a13b-f7d654b65a9a", "value": "cutearm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3749b35a-5568-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751256654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751256654, "uuid": "247e0311-ff9f-470d-8588-5e2637287588", "comment": "Malware payload (Mirai)", "value": "466482d4e5248c5ae27610b34ea53fa2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751256654, "uuid": "4bb308d4-8e73-41bd-9dc6-9ab37ee2ef23", "comment": "Malware payload (Mirai)", "value": "31d8145ddf9912deb0222f31c52e3c75f3918f805f20038337728443be40f277", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751256654, "uuid": "ab9e395a-131b-499b-887a-50bb36675aa8", "comment": "Malware payload (Mirai)", "value": "eb766638138e5d276a9ba5b47db1dc69495ddc1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751256654, "uuid": "952384b7-dc6b-4da5-9d00-0fe9022b2de9", "comment": "Malware payload (Mirai)", "value": "1daf8c575d3ed415249c38ea056ac293cb9b8b70588accd658e79602c4555775efad7e2b9d912d622f6e148ff4f73fdb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751256654, "uuid": "9ef1b10d-ccd1-4eed-acad-c502b946b431", "value": "T194A36BC0F98BC0F6D40B48706067FB3FCB32D5984025DA9EDBA99F36CA375429A1665C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751256654, "uuid": "ca8a411e-8e75-4a0d-bf2e-567869631f30", "value": "1536:tZCYOGUigWaDZ3X23e2gB9TWLIXJKpcnIZK7f4o40hsn:tZ9LFgWaDR232qUXJKpsIZKon", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751256654, "uuid": "df410487-d16c-424a-aad2-d31fa06bbf37", "value": 104780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751256654, "uuid": "1754662d-ed5b-4d9e-a29a-f7999416bf06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751256654, "uuid": "f7abcfe3-0e1b-4505-b39c-1370622a90a5", "value": "neon.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4832a802-5580-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DarkTortilla)", "timestamp": 1751266990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266990, "uuid": "e611317a-ccac-459d-9eaa-4742192cbc01", "comment": "Malware payload (DarkTortilla)", "value": "4fe147a5e2fa228ebc86c6ec24f53558", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266990, "uuid": "922ad335-6e5d-4b62-867e-c1ebc1d6499e", "comment": "Malware payload (DarkTortilla)", "value": "322c15b12e8a568690987a09f4e178fff651891b90e902c7ed3025d4b9ef12f5", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266990, "uuid": "da751cb5-c570-4e66-bea1-0124d249a25c", "comment": "Malware payload (DarkTortilla)", "value": "4f93c59815850f3a7dd3c2b8cb935e26c9c6aecb", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266990, "uuid": "b1051e9c-3fe9-446a-a1f6-90eb2b091f96", "comment": "Malware payload (DarkTortilla)", "value": "abcb822f87b1c449ea8c6ddf649f21b5f37284314c6506ed68fc4203e1a64a3e102680b588adee41b3c949d3a04d4d36", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266990, "uuid": "bbd500a9-afda-4a36-86e8-1fe286d735b0", "value": "T14E55F15E07C15C91E57FDF78A2B440E993F052EF4A5BF3AE084852F4EF2136699421A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266990, "uuid": "49ccd282-89c5-47c6-a899-e16284236141", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266990, "uuid": "c202d172-cfa7-4a4e-87e0-fef2c8f30906", "value": "24576:mezJXiuMceBRVMDcmYwAlCPADH9O7NZY6ZV4BS8mjAD0:DzhSibAIPAkHV40qD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751266990, "uuid": "e36f59db-621e-40e6-aa54-3af90b5b0d5b", "value": 1357312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751266990, "uuid": "6284797b-b821-4415-af8b-01722708aaba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266990, "uuid": "7b3ed743-f804-4e0f-84c2-01e306a84e00", "value": "PO- 77839985 BMH-globalompany.com.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d83f3ad-55b6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (GCleaner)", "timestamp": 1751290299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290299, "uuid": "b5be9780-dc61-48ea-93c6-77e5376b5123", "comment": "Malware payload (GCleaner)", "value": "7a3078816a2528ade49fa5de2a016132", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290299, "uuid": "30a4b103-a7f6-4461-97e2-23fd48641335", "comment": "Malware payload (GCleaner)", "value": "32c7b0e8a4cc49535ac3925c1208e7740cb9a10fa0b8321cd0b1bc7f3895b230", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290299, "uuid": "4e35f3a7-0885-46a6-a39f-be37437afc83", "comment": "Malware payload (GCleaner)", "value": "5d73786ada6c89faec186c1b1c5ad8d8c40d77bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290299, "uuid": "f087f05d-0ea4-4f37-9acf-939166a08884", "comment": "Malware payload (GCleaner)", "value": "ab4e401d0b68ae6c46543840e5a598a3fc046ccb1fa1166b6d078a4b2c53fb45b494453cab23750d7f9a43321d54a10c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290299, "uuid": "b7b8748e-51b1-47f1-acd0-85aee6dac562", "value": "T13836E01B71D821AEE321DDB9ABCFF259A056F7058D070C491DA3DD086B32A436D92BC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290299, "uuid": "3996a718-be7e-43dc-998c-50a45eceac6c", "value": "9f17d5c56b2eb5ca92679aaaff669661", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290299, "uuid": "e0f87a29-de42-4381-9d7b-35bd85d1f7c7", "value": "98304:d9ylomzlz3Moz5YnF87QKAOtWw1zRykTQjpm:dlKMoCnO7Q3LSVykwpm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751290299, "uuid": "2abed00c-0702-4f6a-b649-751f8fa66ea1", "value": 4967200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751290299, "uuid": "3c6bfa0b-84d6-4661-bfb2-be37e6d646d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290299, "uuid": "4b2e7156-c796-48c3-ac0d-8a07af62c668", "value": "7a3078816a2528ade49fa5de2a016132.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd546f9-555d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (NightSpire)", "timestamp": 1751251858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751251858, "uuid": "ca434320-c239-41a6-9856-9e2642a119da", "comment": "Malware payload (NightSpire)", "value": "2bf543faf679a374af5fc4848eea5a98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSpire", "colour": "#1B04B3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751251858, "uuid": "d1fc65d8-9f3b-4be3-8d9a-72a977471841", "comment": "Malware payload (NightSpire)", "value": "32e10dc9fe935d7c835530be214142041b6aa25ee32c62648dea124401137ea5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSpire", "colour": "#1B04B3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751251858, "uuid": "589c7448-a9f8-4b62-8622-de5e0d4ecdc1", "comment": "Malware payload (NightSpire)", "value": "072147d034e6db2db9f81bc9b74e0e59b79a1ee6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSpire", "colour": "#1B04B3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751251858, "uuid": "cdbc2255-933a-40c9-aaa7-a4547ec981dd", "comment": "Malware payload (NightSpire)", "value": "9c027c510777e946fa210c7fa6f4c2bc7f0a50eb012c2459d27dbd7138cddd5137e54f43cfdfdf47a4d8157e39cec765", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSpire", "colour": "#1B04B3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751251858, "uuid": "76111c00-bae8-49d5-88de-526ad660cd1c", "value": "T1C2168D17EC9269ABC0AAB33189B291537B71BC492B3263D72B90B7382F737D05975314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751251858, "uuid": "f5e3a79b-4b17-4f74-9694-aef96bcced84", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751251858, "uuid": "18aac91e-6b47-42ed-aef8-0c5570354e68", "value": "49152:Pp2LmIBtVWZ8l1cYyVqz+YLN1KxK9KxV5EjEaWvhJQt8sIPu5YW8n75etI7RJdY:PDpSGrEYbXQCsN5YWA5lY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751251858, "uuid": "743fdc60-39fe-47c1-ae96-4c485b8a2e75", "value": 4414464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751251858, "uuid": "75bf7987-ceab-4d2d-aa39-b461a7e7c1b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751251858, "uuid": "920dfb49-951d-4dd4-b4b9-ec8f6b1f5fe0", "value": "32e10dc9fe935d7c835530be214142041b6aa25ee32c62648dea124401137ea5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27992d3e-5598-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751277243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277243, "uuid": "8b2183df-ea82-41a9-a129-a2654e8c62c7", "comment": "Malware payload", "value": "c00154bdf864218b253c55f08fb8dac9", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Zorex", "colour": "#CD2DC1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277243, "uuid": "66b7c2d0-0813-49a6-8479-45fc78396d91", "comment": "Malware payload", "value": "330dbf4484dc0503795230b5afe05e4c0fc3e22ba82ce3f30ca6dc0fa3bf0ad3", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Zorex", "colour": "#CD2DC1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277243, "uuid": "f435ca42-4f99-4892-9387-345b93deeba8", "comment": "Malware payload", "value": "6d56095a984c3d050a089c96e25c871adf25ef6e", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Zorex", "colour": "#CD2DC1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277243, "uuid": "50164c04-2b36-450a-8eb3-93c105ef00da", "comment": "Malware payload", "value": "8c2c49c396d8b461f4681c38792f25edb784fe93e101b43725e8841f9e4c41d657d632874deb418c7ea3211cf8b0e7fb", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Zorex", "colour": "#CD2DC1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277243, "uuid": "9979ecd3-804e-48fd-9146-69f5e693d0c9", "value": "T122E36C39B2828576C1511D758D0FC2BAF53ABB041E7C65CFB7DA0E288C3335A2D751AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277243, "uuid": "25436442-d7aa-4491-a51f-fce3d601dcbe", "value": "3072:Q6ZtBBsWpNOpBfwVU4y/Ao+mv8OhU20LVmcVq4zJyQRJa0nS4:zZXBsWqsE/Ao+mv8Qv0LVmwq4FU0nH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751277243, "uuid": "c46bab37-22c5-44b2-a14b-7c9e12558f0d", "value": 151239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751277243, "uuid": "8bbb8da0-67d1-4bfc-92da-fe717f8450a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277243, "uuid": "2c2cac37-059f-4b2a-9153-7806297e3d02", "value": "executable_01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f357c2-55e4-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751309860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309860, "uuid": "c0481152-54b0-40a6-9c3b-e3abdfbc00bf", "comment": "Malware payload", "value": "917c13e82d8ff62dcbe254b6bddcedf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TA829", "colour": "#FA6C2C", "exportable": true, "hide_tag": false }, { "name": "TransferLoader", "colour": "#89D860", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309860, "uuid": "eb48b42f-e341-4455-810b-00ddf5018a78", "comment": "Malware payload", "value": "33971df8f5c34c3c79f64e2e28e300260499285bd37f77295ba88897728ace4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TA829", "colour": "#FA6C2C", "exportable": true, "hide_tag": false }, { "name": "TransferLoader", "colour": "#89D860", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309860, "uuid": "70651ce8-25a5-4c31-a066-87df39953360", "comment": "Malware payload", "value": "26c6e5770bf4f3cdb9430523f02dd71803ccdd56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TA829", "colour": "#FA6C2C", "exportable": true, "hide_tag": false }, { "name": "TransferLoader", "colour": "#89D860", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309860, "uuid": "a731ce00-7b52-4b29-a7db-df07c0a65f9a", "comment": "Malware payload", "value": "8c9704f861953044490324434019c33c7e4d4212f93aabbc4359cb5945d4d7d19016a77abefe8468528c2f0b216379a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TA829", "colour": "#FA6C2C", "exportable": true, "hide_tag": false }, { "name": "TransferLoader", "colour": "#89D860", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309860, "uuid": "4cbb77cf-56a1-4021-8e22-9272888d5bb9", "value": "T18C735189F283C8F4EE63723454716D176F92BC1E6A5528DE21CCF6A63832213506ADF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309860, "uuid": "0d7329e0-9fe7-4d40-b75b-335879dbd0e7", "value": "3d133e9d1c4c3d3632d1f1f05b2290e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309860, "uuid": "06402892-7606-493f-ae46-a061def9ad50", "value": "768:aEhKQfwFj+WGi1cGMIB8t+pM8hGwflrLL0mr6JCp5ALOP:c+5pKBZcwfRLL0K6JA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751309860, "uuid": "8c24943b-a4f0-4105-af2e-43e361e7921c", "value": 79304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751309860, "uuid": "ade0868f-b718-4e5a-8675-94f830003772", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309860, "uuid": "85a4a6ad-902c-47db-8f5c-c7bb0c92990f", "value": "Update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab901019-554f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (FatalRAT)", "timestamp": 1751246111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751246111, "uuid": "5b711176-8d2c-4e3a-a036-3a0c2508ceb2", "comment": "Malware payload (FatalRAT)", "value": "5b7e5e593c1fce9059c9c73e6a09a1da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751246111, "uuid": "714c6411-5f0e-4d2b-95eb-a16713cab028", "comment": "Malware payload (FatalRAT)", "value": "33f2284963bd7b6aa213bc552a11ab30f877d1023096e4d9cf0a6a78e15be0fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751246111, "uuid": "13b72a09-9b18-4041-9064-f817b398c0d8", "comment": "Malware payload (FatalRAT)", "value": "932bcdac3d36bff25511de72625f3b32b87cf44f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751246111, "uuid": "393304a4-36a9-41fa-ac5c-51b38af4a971", "comment": "Malware payload (FatalRAT)", "value": "5540ce363098369aa927325f3508f2619c6e1d5a804b85f0a9237e45ea70cc31a29496c5cf3d396e06a384c5862fd473", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751246111, "uuid": "921778fc-8994-4b24-b1c9-6ef1340231c9", "value": "T1A9A56CE05813A2EDD62F72FE2A00725134065CB72E346986B47D8597B7CFCD460AB39E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751246111, "uuid": "1bf3b381-6c55-4754-b07c-5e1e32a82c18", "value": "848a921ef19d9dffffd57f543dc8705d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751246111, "uuid": "a8e57150-a770-4b49-9239-f1331f6e0f44", "value": "49152:/0L2TlfA3LzUsqlyW7Tz+wQX6lUpHb1ECi:/fTl+6hnQiohECi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751246111, "uuid": "93a07fcf-2414-4998-865d-b4b8d29d86fc", "value": 2149376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751246111, "uuid": "841d3493-333f-405c-b711-c9c2939cc5d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751246111, "uuid": "c25d1611-731f-49f6-9e5e-9975b25e047b", "value": "5b7e5e593c1fce9059c9c73e6a09a1da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501af910-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751243810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243810, "uuid": "655592c3-ba8e-4ecd-841c-a03fad0c4789", "comment": "Malware payload (Mirai)", "value": "81f2c733d4f1cce4b7734fec63a2a2af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243810, "uuid": "d7b93272-2aff-470b-843b-745e6d0c4db6", "comment": "Malware payload (Mirai)", "value": "345d420734d6ea848f553993c5ae88b0f61e22636c4d90664e10bbc70eb620ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243810, "uuid": "dd2105a4-ce0a-4ac5-9224-abc2cca8dc54", "comment": "Malware payload (Mirai)", "value": "1d12cb4e97553f2e259e137c036daee75c08ace5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243810, "uuid": "d1d32c75-4b18-4a7d-a892-1df00c150f32", "comment": "Malware payload (Mirai)", "value": "c54c4262efefef14231e19f83f266778dc2c4ebdf514ac645a61c015e06aaba5af820e38297ef0240de7fa2d6ea2f8ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243810, "uuid": "44fd71ee-1e85-4e6e-8a1b-418173553ab6", "value": "T15FB2D03C5D0507F9DA0E947C46D903503A750F76A982AD4FB026AE839E9F4B83591AE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243810, "uuid": "a352b0be-d4cd-4b1b-b124-729274792c55", "value": "384:6eD8ZSH2LLZUYyGZbsOiTdjdniUGfoxSatkDh2ldaatomd1JgGlzDpH7uNj1JA4n:6eD8ZSWvZHZbs1dRSfWSvt2Dakoi1Jg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243810, "uuid": "7da41bb2-ca44-4b58-b9dc-1798d7245213", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243810, "uuid": "16efeff8-d10f-4e72-9a32-3305429cccc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243810, "uuid": "3cd1aeda-22b6-42c2-8a16-56d800360d81", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cdc0db9-55af-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1751287238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751287238, "uuid": "bc63f60f-9dac-43a4-ba3e-2cc77870f6ec", "comment": "Malware payload (LummaStealer)", "value": "67fe27e80ca9278868fefffe787e79a5", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751287238, "uuid": "51aa81ca-e41d-417d-98ec-c4304c8c1852", "comment": "Malware payload (LummaStealer)", "value": "345f5b173c6c4eee7902656011ec7f5d035daa6006d8e15c0630687f66091e5d", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751287238, "uuid": "4cbbce8a-35d5-4eff-835e-b0a93690a762", "comment": "Malware payload (LummaStealer)", "value": "48dbc21226c07569a0bb933cffacedadbfcd5b2e", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751287238, "uuid": "23ddf161-480d-4cd1-8432-dc7cad82d33c", "comment": "Malware payload (LummaStealer)", "value": "5c3c5a9eb074a2383400f5df84f4d852608992239ca4fd0309846c5740840528a50be5fc1a4c0bf9e4f1d3a1ef6d1457", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751287238, "uuid": "e6ed3ea1-bf31-4231-a3d6-64ef301b8a35", "value": "T171352343F6219C17D6F30F33A9E6A9ABAF775E0215DC0357871E72783E8A6C0596E060", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751287238, "uuid": "6b282f57-d575-49ab-850c-652be992d2ec", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751287238, "uuid": "4bcc283f-fb3a-4226-b02f-c5f0c6af6b0f", "value": "24576:A0aTqbCP824+rT2VFStLKJXE0PePJr6H4mbpOXGIHhS:AKb+f2TMQXdPehmYmbp+HhS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751287238, "uuid": "f8d53f74-f8e0-4cdb-a581-558b8ca0b46e", "value": 1154184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751287238, "uuid": "8d65c7c4-93ee-4e87-a657-d27fb572b8aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751287238, "uuid": "98cb21f9-ebc9-409b-a544-e9add614b99f", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910850dc-559c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751279138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279138, "uuid": "7aa1cff0-0529-4e7a-9648-829354de4164", "comment": "Malware payload (Mirai)", "value": "dc2380d8830570c30f18b29bf90f0af9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279138, "uuid": "f26e8b7f-c529-44cf-9488-39120f21161e", "comment": "Malware payload (Mirai)", "value": "35ea949b87d8d18df1c660357ce6fe966d9f3c4f2d7f7660f61ff48ee8ec55cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279138, "uuid": "4f060b75-cc0e-4ee9-ab4e-684203963898", "comment": "Malware payload (Mirai)", "value": "064be8c95de5e6e00303334d56c3b70bfc52b6f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279138, "uuid": "60b5b5be-6116-4dc7-88f7-6d6bcb0cbb70", "comment": "Malware payload (Mirai)", "value": "f0b413397415b1bbf83a3c35efccde9666c3350e41019a3aff6b0785b971e22ec73921f32a64cf275c324725dd2beda4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279138, "uuid": "921279cc-580b-42ff-93c2-a6d520c4969b", "value": "T174736CC4F643D1F2E89700B2A03BEB325F33D5A91019D953D76D9932DCA1952EA07BAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279138, "uuid": "05d46a7f-7e01-4efe-a548-d198ff81a3b3", "value": "1536:NPP4ov+zCkdsekj2ZK/JfvPRUBd9YcFuY+Al3TVOSfS6va:NPPp2zCkjdZK/JX5iYUubA1VXxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751279138, "uuid": "f97c9235-6fc6-42df-991c-c9f43d075066", "value": 76776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751279138, "uuid": "e218f4ca-876d-43e2-9281-ec2ace535777", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279138, "uuid": "1bec472e-130e-45f3-b841-49829a2778ad", "value": "cutex86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a8383af-558b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DBatLoader)", "timestamp": 1751271852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271852, "uuid": "d95b3f44-2653-4df3-baf6-2e67f0136fb1", "comment": "Malware payload (DBatLoader)", "value": "520147f2110d161c59a890f19988c02f", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271852, "uuid": "51b0f5d8-d482-4838-8657-33c48df0bc03", "comment": "Malware payload (DBatLoader)", "value": "373a59724445fe6a91b6c0d1aff0ec54277faf061a4960d0e7e13fcebedfa709", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271852, "uuid": "cc263c41-e6d1-4169-9f25-d0d6132dbba3", "comment": "Malware payload (DBatLoader)", "value": "058ea920eeeedb658e5257f91172228f577a7e1c", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271852, "uuid": "4763a7ff-23a7-4667-8c3f-cbf141133ee9", "comment": "Malware payload (DBatLoader)", "value": "983ff65ad89bc73680c01035858dcd5e85a985493b94410ae3141bf5be7527565d5765fe8a6ef69a1d3cd2a9c30c247f", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271852, "uuid": "52d422b5-65ee-4149-9e03-11a844702fbc", "value": "T1DB75BFC6A280BA71D1DE063C7C3AA7EC592D6E2A3F1475431DB2EC7C8E293819D1519F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271852, "uuid": "77815635-166c-493f-aaf1-3c2b77bb495d", "value": "e2abca3a680b21f6252a3cf4bb41e3d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271852, "uuid": "cab96a6c-c3bb-4a81-bb26-851819aa38e4", "value": "24576:WEXBExG0rr/P6w031o1ogt3ZxJebXLLJP1d7VptQXU6c66:WEruSwSzgt3ZxJe7nQk6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751271852, "uuid": "99816ddb-b6da-45d3-b4cd-1dbd3d2debcb", "value": 1701376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751271852, "uuid": "d1a1dc2b-8b92-4733-a818-e62699d0c502", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271852, "uuid": "504dabb8-d35e-42c5-8581-6c7226066fca", "value": "SecuriteInfo.com.Trojan.Inject5.58749.17741.27629", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59aaf325-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751243826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243826, "uuid": "3e5d261c-2703-4d1b-b15c-4a929554b637", "comment": "Malware payload (Mirai)", "value": "7973b03b43478c18dc20af44e1ef47ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243826, "uuid": "eb72d76b-da34-4533-a43e-fd8dea6b8486", "comment": "Malware payload (Mirai)", "value": "377e94d32d0d62b19ea1b9cd59c9922e1588e85b5404b4fe37fb7fafdb199394", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243826, "uuid": "c68bdfb7-f4a4-4bf3-b387-1c8fe7fce4b5", "comment": "Malware payload (Mirai)", "value": "cb8170c23b868b665a588802ca00d69b0e833cb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243826, "uuid": "58a1750a-7671-4fc2-a044-73c6bd2e990d", "comment": "Malware payload (Mirai)", "value": "843051b8ae5766ff298a6fbf72b3015d468ba0f903c4a91766100c8691793a1d1cd0303830994a0fb4864a5b6d339d0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243826, "uuid": "959cce1c-35a8-42c1-80bb-4d3975835232", "value": "T1E8230271880A8EB524303C72DED5D793BAF01AB1C6673013D6280A386FB57631E5BE4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243826, "uuid": "8d6c5b32-722b-4cfc-a9ec-b1fad60ec77f", "value": "768:S/TYCoIxdEk+AxoTZAZHFeq8b3RJ9q3UELbUXfi6nVMQHI4vcGpvN:SECFd+A6YHAxR8LRQZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243826, "uuid": "fad8aa45-50b0-473b-9830-81d911025d70", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243826, "uuid": "756cdfb0-32d0-4b9a-b3d3-b5452cac00ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243826, "uuid": "0d26f1ef-2bfa-4a9b-bbc0-9a1e05d7f642", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce93f65-5596-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751276420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751276420, "uuid": "29d319b3-1f58-4839-bd96-ac6be26d1b01", "comment": "Malware payload", "value": "a412c69335854eb80b3e589b9d8f6c8a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751276420, "uuid": "08116be7-cfe2-4bc7-af0e-718495cbaae7", "comment": "Malware payload", "value": "380c22b151b50cec80dee972fdeee6dae41e0c4bc7403fc5dd61176d967197c7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751276420, "uuid": "0b218f1b-16c6-4af4-b0f0-33db31edf30c", "comment": "Malware payload", "value": "38abc254a9b788a3b8b48d7f20832ec63511012d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751276420, "uuid": "0829f6d6-f84d-4457-ac1c-cf28750ee829", "comment": "Malware payload", "value": "bdb62db917a9622509d4d535e79af3ea3b062edee992d763f38e84394c98d730485d802b9fc3471fe8196daeb4cba3d3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751276420, "uuid": "a6e9d55d-c6ec-4fca-9938-3eaf56a17d89", "value": "T115D02EC7873A41CACAC0F3B4018343F9CAA9C184A0C38483229AE2A69C134464CB7A98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751276420, "uuid": "8358095d-aab4-4052-b3fd-ed65d1125f69", "value": "6:5jalCQLzo7XdYwVHof/ZzGv5joVjalchmt+lX:5ja4QLzmSwNIR8PaEtaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751276420, "uuid": "b79dcf7d-3e78-4fbf-8f24-eb9de7606f38", "value": 283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751276420, "uuid": "c8dabf11-02a4-41b1-9e22-d1bd5ef4dc08", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751276420, "uuid": "5fbc3ef4-63fd-4e07-9c4f-0581962b24ea", "value": "ORD739403847.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e682c8-5600-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751322223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322223, "uuid": "8156eafb-c6cb-4b6d-9051-5cfbb334a4d2", "comment": "Malware payload", "value": "72373fd99a8115955ebafd8e5b64fc14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322223, "uuid": "deaf4253-7940-4518-b6df-6f7931a6834e", "comment": "Malware payload", "value": "381ca5a75191ddcca5b767a11bdf477b9513484823c1f7be1883f2dd52e115c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322223, "uuid": "b6bcc88a-38ba-4a08-ab0a-9074f19e69ef", "comment": "Malware payload", "value": "9e6960bc6f2a590073f1fe2cba122e66228dc7c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322223, "uuid": "403bedc6-ef3a-4482-9a38-e5ce3e56995c", "comment": "Malware payload", "value": "186024d629c802bc7bc876abfb9166c9b3b3302ce39d9cad3cbac304c6b4e63593aee9ca7e8457c98d16bfaeb86ad984", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322223, "uuid": "a6cd76a4-235a-42bb-8300-d3740ca8c93b", "value": "T16BE4F1037308A756DF4BA83A82CBFD31B7C2799153D096627A80E29F8775726CF0D649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322223, "uuid": "32fe1b46-927b-4853-826d-2ab0757d22c2", "value": "12288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751322223, "uuid": "31c62947-eb97-4fc7-9059-4c4d46c9a2fd", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751322223, "uuid": "d34ad5d8-0807-48a7-91df-7e6ecce950a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322223, "uuid": "8c78c656-4f3c-4f89-b18f-5ec3352bf5c5", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eabafd2-5601-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751322406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322406, "uuid": "62afcd2e-35ea-48e6-a9c0-d1f922b55dd1", "comment": "Malware payload", "value": "67bec815a401d777261ac2ec637f156b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322406, "uuid": "9386cb7d-5fd8-4941-b6d8-6f314317624b", "comment": "Malware payload", "value": "394615b85082d11b4415283a72089cd1cb9b0ffc133a805c762f5248817d38fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322406, "uuid": "83b295df-d854-4e6b-9552-ec5e205eabb7", "comment": "Malware payload", "value": "e5520fb30a37837c0a227b855d784453fae8dba2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322406, "uuid": "5b387425-534d-4ddf-beab-3bcbf513ff9f", "comment": "Malware payload", "value": "2cfb42c988f4ab178dd375d911d7868bc151d8cf36a5cc9ba5abeb5a608bab199bbdaa2c43c780be60b831b2ce0806ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322406, "uuid": "8e2f8a92-0d2e-42c3-952c-74d6882bed9a", "value": "T1F7A41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6198F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322406, "uuid": "db43cc25-c21a-45f3-9985-b40fb104d13d", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751322406, "uuid": "0dc9c5ec-c964-45ad-abe2-8512c8a0c793", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751322406, "uuid": "8f5d94bb-5764-4a70-9326-71e292737dbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322406, "uuid": "3d1970e8-f368-475e-9640-1bca03177379", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f9de60-55d7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1751304616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304616, "uuid": "87b03131-69e9-4752-82de-4016560b0d7e", "comment": "Malware payload (AsyncRAT)", "value": "8630f91435caa563a06bcf6842ef4294", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304616, "uuid": "bef3af41-5107-4499-bd06-04c2ab60da99", "comment": "Malware payload (AsyncRAT)", "value": "3a96cc605d6a375d621e231b5159f0b993b83babe9dc993dc36a487d5a51578a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304616, "uuid": "517ac67c-4969-4aed-9ee6-617f9372e748", "comment": "Malware payload (AsyncRAT)", "value": "95d0c1eb6eedd48b021fa469e0381d989cdddb6d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304616, "uuid": "2cb7647c-516c-4251-8e86-f1de3e8867d1", "comment": "Malware payload (AsyncRAT)", "value": "e494957f2eaf6d27b4992011960e440403be39ca4920dadca867b11da25b3b34b8d634c3826ac8565c8757f26453d615", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751304616, "uuid": "aacba49f-2f46-418e-b5f6-a890da438437", "value": "T134D312E8FE8E95BF082D04D11A359C548CADC52C7FBD8847BABB55D7981F989C4DB020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751304616, "uuid": "e76f79fa-f90e-4883-bd85-95d7a1539047", "value": "3072:3JOR+/k+y3yjevRcDVm1H0QDXvXxvB7XYnmLJmLwdK0MB:3Jx/qCWcxmzDXJvBbYCmLp0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751304616, "uuid": "fd732fd7-5286-4669-b15d-6b50cbcebcfc", "value": 130764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751304616, "uuid": "15f829e4-2c6d-40c4-b32d-29ae5ea040cb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751304616, "uuid": "ba63c4bd-88f8-4aa9-b47c-141f9662a8ac", "value": "nSDGSD.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc7af84f-55c4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751296498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751296498, "uuid": "866a8ebf-f579-4e31-9239-358c16d9dd58", "comment": "Malware payload (Mirai)", "value": "8cd906f045da3abfd36fd78c0640973c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751296498, "uuid": "ade6f529-8879-4219-93d9-1ee3f0971eb6", "comment": "Malware payload (Mirai)", "value": "3aab1d8f890f3cb78f6f1fde199f6605020f7135a26b571cafb34563444dce6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751296498, "uuid": "007e5251-bace-4348-b60b-54b4e14c56ec", "comment": "Malware payload (Mirai)", "value": "4e99686e89f94ab5f50bad17a7b2e75347270d22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751296498, "uuid": "4552adc4-da20-42b8-87b7-859be80c11c2", "comment": "Malware payload (Mirai)", "value": "be3639dba0a8790bd39023e161a13bf895b0d5aff2638d814388605cd3b3b825b975efd83bbfcfe943cc7c1554f48314", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751296498, "uuid": "b909fc55-6e2b-4dc6-8525-c73e96409998", "value": "T14103F15C262017B4F26DA07A02E557586F554B02F803AC0FA9BA3F43DD44E367983ED2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751296498, "uuid": "d5159d91-a599-42db-83d8-388980f3f1ae", "value": "768:kF9FwLP8oqJDzCHK9pmWn6Y3QJ4SxzU5d1r9EMp45S7L5Y/Bp8JgGlzDpbuR1JSr:kF9FwD5qpEqmRWSxQ5dtOuPe/f0VJucr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751296498, "uuid": "b141c384-91b1-41bd-859e-7fc97e2ba5e1", "value": 41192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751296498, "uuid": "dcdeb149-5218-4d7b-98af-1ec10d325651", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751296498, "uuid": "9aeb3418-2bf2-464e-9da1-a5e896b8d82c", "value": "SecuriteInfo.com.Linux.Siggen.9999.12856.32416", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37ee09c3-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1751291014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291014, "uuid": "61beddc1-c492-43ca-9d29-59939d2e96ef", "comment": "Malware payload (LummaStealer)", "value": "32f23ad59ea1010e242d211cf082b09f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291014, "uuid": "60a6a4d6-9afb-43e8-a728-bedd82df04d2", "comment": "Malware payload (LummaStealer)", "value": "3af607f03940754b7ff72fb397e5ca489f46ecbdb18cf246a49d1c7b01cd62b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291014, "uuid": "fe8c6a03-e6da-4796-a613-13ec43e31e19", "comment": "Malware payload (LummaStealer)", "value": "bd096be743336ffbec1fd4206392d6b5f10df6e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291014, "uuid": "ddafdf2e-6129-4964-865b-f270d06f85fc", "comment": "Malware payload (LummaStealer)", "value": "c39f891c1f807e0a4e9becddbc38fb56424fb37268f1bc5a8f623257fd889b7f4475c2c4647f27b72b0f14e51f4efc07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291014, "uuid": "777482b3-f412-47b0-b662-191ff848b4c8", "value": "T11B9533728E61C4B7EE64E8B79D4ECFE827A193B0A427D1C9720CD1F64A31456AD23C17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291014, "uuid": "1c566697-c38c-4a2a-9bee-b36388c27ba4", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291014, "uuid": "995bb526-968f-4f2c-91fe-ff97bb16f02a", "value": "49152:Nw1P7entT9A7OqeXnW0Lnyf1SMAArWApJJheVWyTseUn:qIn7A7AXW0LeseTHbeVWyYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291014, "uuid": "4a94b862-577e-4ae7-9da1-45def87f3d89", "value": 1928704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291014, "uuid": "5b0a435d-8f09-4ec6-83e8-c350b75831be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291014, "uuid": "1b00175a-d36f-4d33-83a7-0709ffbcc390", "value": "32f23ad59ea1010e242d211cf082b09f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f299af-55dc-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751306762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306762, "uuid": "88d50cd4-5fa3-45a0-af80-1372cb7b90b2", "comment": "Malware payload", "value": "cc74d8912104b895e9386179e041af9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306762, "uuid": "7e76c9fa-6cca-4ae9-81e7-bbbb558b641e", "comment": "Malware payload", "value": "3b16957b3f9918adc641f64d960dc88303299a232196b9034e4944034c3f6f04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306762, "uuid": "f38ab1cc-8512-46e9-984e-206cb94b05fb", "comment": "Malware payload", "value": "f775119180a9c09b0c9a822d98f113d504991213", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306762, "uuid": "4bd4051d-7aca-4908-b485-fb7dabc9213d", "comment": "Malware payload", "value": "b9f0bcb192061fef121b3ddca72bb660304286885002969f3d4a81567567b8e4eb783debb746c543e51922d354935b16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306762, "uuid": "e89cceac-4e90-4ebe-b614-3093b902252c", "value": "T1AC055B12BCD05036EEB30372CEADBA3D73EDA669033961D7939C5E141AB06E27635217", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306762, "uuid": "7123662d-fee4-4d47-a17d-681d3cf8d08f", "value": "24576:rdPmh9SxV3wJ1DWXfob1DAREBSVIfc6g5:rdP33wGAK56g5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751306762, "uuid": "cf188a77-ca58-47de-a5c3-b0e5c4c07e33", "value": 865000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751306762, "uuid": "990ec518-45b4-42d1-b19a-52a7b8521ebf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306762, "uuid": "65aa759f-2f48-4a7f-b7f3-f5c7d998ffe3", "value": "help.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b6e76f-558d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (NetSupport)", "timestamp": 1751272596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751272596, "uuid": "4ec7d48d-60fa-4596-9ba8-557b1fe9f024", "comment": "Malware payload (NetSupport)", "value": "095feabb31a8fc81a6b304954b37c5f2", "object_relation": "md5", "Tag": [ { "name": "alfagaraj-com", "colour": "#01FF5A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751272596, "uuid": "46384db0-984a-41f4-ac30-0fac55189bbd", "comment": "Malware payload (NetSupport)", "value": "3b6ee45167d255906cc6663177eb1a7d806cf3e6730ea1274058c9e75e4df0af", "object_relation": "sha256", "Tag": [ { "name": "alfagaraj-com", "colour": "#01FF5A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751272596, "uuid": "c950a3fd-0803-496d-bd8c-26be2f23501d", "comment": "Malware payload (NetSupport)", "value": "2bea6448fc7ce5a9e8fd0219aeffa4176141eabc", "object_relation": "sha1", "Tag": [ { "name": "alfagaraj-com", "colour": "#01FF5A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751272596, "uuid": "aa326206-92cd-48e8-bba6-2e956ed31e58", "comment": "Malware payload (NetSupport)", "value": "561676474c21f4d2103cf89e678e37d467186e2ac050f915b96ac5fdf52e6f339c9715178913954837d9b2830e07f24d", "object_relation": "sha3-384", "Tag": [ { "name": "alfagaraj-com", "colour": "#01FF5A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751272596, "uuid": "84b90450-b8e6-4bfa-8ccb-9ef42b9954ec", "value": "T18C6633D9E5290F97C788757FFFCE3A3698275008075A842FFB66305893848A8C793A75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751272596, "uuid": "8bdf92d3-5860-4b59-a22f-886a9b4aac29", "value": "98304:/srKfaWGPd1BYAVq3L6sp33gDnJ7c8gDnJ7c4gDnJ7ccgDnJ7cb:Ur6GPDBYesp3wDJ7EDJ7wDJ7kDJ7g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751272596, "uuid": "460b83fa-444f-4ad6-87fc-b6f63c83c838", "value": 6951983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751272596, "uuid": "ad75b8d7-afd0-45f4-a670-dc8c5031d3b9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751272596, "uuid": "2e385b30-610b-49e5-be77-6203913b38b5", "value": "tsks.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be195896-55e3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DCRat)", "timestamp": 1751309708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309708, "uuid": "3874ec00-5506-433f-9a55-b96df05febd2", "comment": "Malware payload (DCRat)", "value": "ca882681010732ed4784eb186e007da0", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309708, "uuid": "22ce8fc6-afea-46ea-8ec3-29253e701de1", "comment": "Malware payload (DCRat)", "value": "3b70a6bfb2982c55bc61cc9bd84bbc25fbf36361267c61b35a09bed33e9f0640", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309708, "uuid": "dff70f10-2c5e-4a06-b928-7b98077f932a", "comment": "Malware payload (DCRat)", "value": "e84eedb3a1cfebf0fc7cd8e7f9f9a1abd77fd5e8", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309708, "uuid": "e67ecebb-8281-4ae5-a168-3335db876ca1", "comment": "Malware payload (DCRat)", "value": "5ae5ef752cd521b7ba8c267f9e7212c24dd0bef30cad7caa68711b5e33f2876cdddbf5fb4884ccd7922e95e9980a8ccb", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309708, "uuid": "28fd0235-a57c-435f-8735-dae7ec9a289b", "value": "T11A657B017E468A11F4181633C2EF854447B5AC112AE6F72B7EBE376D95223937C1EACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309708, "uuid": "ffc9cb0c-e8f5-485e-be09-e9cca8ae2f46", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309708, "uuid": "48e51c31-b8ab-4b1f-8642-ce8705a8e092", "value": "24576:U2G/nvxW3Ww0tC6eZu+91hUVHZ2s7htm18lb2bM+RfgpnhknU:UbA30Ck+PEHrllhnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751309708, "uuid": "74c07591-3689-4e37-bfbd-d47e8d111437", "value": 1503396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751309708, "uuid": "6379a68b-1075-4348-afb3-422988f0a970", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309708, "uuid": "69e5f6bf-489f-433c-aaeb-80d3245154ef", "value": "CA882681010732ED4784EB186E007DA0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1a3e3f4-5594-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751275837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751275837, "uuid": "470d55b1-a213-45e0-8693-5e953fd21bf1", "comment": "Malware payload", "value": "209e63d8fb6cdf1588b23adc592b7b13", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bitspay", "colour": "#636DB7", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751275837, "uuid": "3703f93c-8642-4727-b86d-c829ba4fde97", "comment": "Malware payload", "value": "3ba6e9551aeae6fbbacff487bd89045e0c1536ef879c12ac12c1c155011672f6", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bitspay", "colour": "#636DB7", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751275837, "uuid": "15083328-52bc-404c-baf3-1ccdae27c80a", "comment": "Malware payload", "value": "d2f6c16a0757bfef140327706646a8168743c15e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bitspay", "colour": "#636DB7", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751275837, "uuid": "643ff68f-64bf-4179-9b83-c9661db3a440", "comment": "Malware payload", "value": "ed72d87afa63a10f4fc7508c3f6a5369f2f66956a040ca89d38aa75b0db1a9100268403f106d50d51258fba1b244b36d", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bitspay", "colour": "#636DB7", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751275837, "uuid": "69ef889b-2f82-4335-91c5-01680971369c", "value": "T167C5CF8AFB05E8AAC0A7D63286754626551BCC558B43E6875F59F13C0CB7DC08B8BECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751275837, "uuid": "68e73158-9dc7-48d5-892f-3cf73be77be2", "value": "49152:8/E1MBVrwcINIz2Z2vXWoIMgJXWC0At7k/bSEj8bHc:gwMBVrwXNIW2vXA5B7k2Ej8b8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751275837, "uuid": "4a604013-cb5b-4426-b61b-d18467e840d0", "value": 2743705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751275837, "uuid": "8931dc7d-96a3-44e1-9c84-542c62e6f165", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751275837, "uuid": "e6529144-59d2-4f4d-81b2-3ac9b5e1b560", "value": "app (7).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d2c1f9-55b1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SharkStealer)", "timestamp": 1751287946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751287946, "uuid": "5f375ed6-2545-411f-a2c4-83b17cb68cf4", "comment": "Malware payload (SharkStealer)", "value": "74d279efa9c308881ab0934f64ea0719", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shark", "colour": "#0F0156", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751287946, "uuid": "f9689b3c-75ce-4593-8be8-e588275ec5c4", "comment": "Malware payload (SharkStealer)", "value": "3bc9d58f61d0f013b9953def55d26c53327a7c8f171718e65ec0d15d2ca1eeda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shark", "colour": "#0F0156", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751287946, "uuid": "d9cf6756-eb8f-48a4-a544-5f5a80583627", "comment": "Malware payload (SharkStealer)", "value": "4fb718aabc0bc9b6a62db9ee7e9cccce28d294d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shark", "colour": "#0F0156", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751287946, "uuid": "162848ff-023b-4ab7-8849-786e3531e521", "comment": "Malware payload (SharkStealer)", "value": "07d69039b9c3ec3f433f55cc64dfba026bc0925ad2285095e05cd3bc02a320101727a706c6222f4f46ee8a432d0a7851", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shark", "colour": "#0F0156", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751287946, "uuid": "722601b9-303d-407b-a8b7-8d90db8be1c1", "value": "T1CC46F0695CD4E722F01E1A7748A35438076C6C2C850DFC557BE2278729AE33A3B1F79A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751287946, "uuid": "da50a734-ed33-4726-b37d-929dae543985", "value": "ce5cf1f82c0d3b892c659f37e18de1c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751287946, "uuid": "4fa32e51-9f23-4505-8d65-4168389f8753", "value": "98304:FNMZystyiPvcrNkARrGR9PJYuvYc0Lt5V55d:FNtsBPvMYl45V5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751287946, "uuid": "47731e8b-cc4a-48d2-9900-8b9575ea600f", "value": 5638432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751287946, "uuid": "577da08e-29a1-4f50-b39f-0e5b735c8d7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751287946, "uuid": "6e579947-8216-4127-b54c-755073b9bac3", "value": "shrk.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d91050fd-559c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751279259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279259, "uuid": "793e85ee-ed5d-47d4-bb75-670910c141bd", "comment": "Malware payload", "value": "756b9d4a26b5a024efe412760ff08cf8", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "GOPAX", "colour": "#697297", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279259, "uuid": "62656085-5c1e-466b-9d8c-0f42d81bf2a4", "comment": "Malware payload", "value": "3bfe946220f2a0a60c4c39434bca5c9acd0434eab2c971b43a047240be8b615e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "GOPAX", "colour": "#697297", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279259, "uuid": "8c131bce-f3fb-413b-ac20-cf2e85262fa9", "comment": "Malware payload", "value": "e797f39fe98a65600ff68164073b4fdfaf864559", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "GOPAX", "colour": "#697297", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279259, "uuid": "95da9787-244f-4134-b0a6-0ccd0a57ecde", "comment": "Malware payload", "value": "07df90bf3a6d1544b826796dd2fe23e2c4ae8569c59778532a9b47e18304fca49e25d58daf54db253e67b5f40fb9c77a", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "GOPAX", "colour": "#697297", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279259, "uuid": "8f339947-69d3-4ae2-8f20-4d7d1ce12665", "value": "T15C160143F74CA82FC877C0374A7B063656A69D868993D7131919B21C6CB7AC84F9AFC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279259, "uuid": "47e70c92-4c98-4f80-8c18-b43fc5bcfe24", "value": "98304:eoPjY4t/BNuWzcNK6kN4SHZJtKTF36IsqV:eo84t/i6cNK6kN4J535", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751279259, "uuid": "5267b514-f202-475d-b713-3191656bdead", "value": 4220283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751279259, "uuid": "a57908cd-f56f-442b-b077-de1c17c03a0e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279259, "uuid": "bfc8d63b-fa98-424c-8e4b-52ec51e7c56a", "value": "1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd59242-55f0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751315022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315022, "uuid": "b5f10e93-1887-458f-8345-2520afae31b3", "comment": "Malware payload (Mirai)", "value": "d4e631ea00758d0a7f86304f7100efc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315022, "uuid": "e5104d46-3123-4d40-812a-029555323b74", "comment": "Malware payload (Mirai)", "value": "3c8adeaf19a9e0b0b8a3e8101bb5d7eee08c86f28c1260deaaa9af9a77a1f15e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315022, "uuid": "873441d8-6dd4-4c52-a5ef-564779be1a7d", "comment": "Malware payload (Mirai)", "value": "127f227a1334968c167d04ccd00ad04f2e860258", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315022, "uuid": "f650f02b-f673-4b32-b1b2-30cfe206bf34", "comment": "Malware payload (Mirai)", "value": "b1c3a9beee22aeb45c4f85fd705bc83d88e819fdd2ad81fa36f6140255a043d2d2f2dcd3dcbb2be5be7164371a65c938", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315022, "uuid": "57c1055c-e284-4fa3-8288-9571a3bf58d9", "value": "T18603F1D8D04874C6C9ED9E7DE2DF33374953E34011A68EA466204148FB93893B9BF1B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315022, "uuid": "f4abcfd3-dfe1-4955-a1c9-640fc8e141eb", "value": "768:NpIg6fksRepYiM2bsykNtah5Mo6iNnXJ7oJgOMXezQHfGQWO:/IVfks0M2QyZUobXFkCQsGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751315022, "uuid": "633790de-abb5-469d-9f5b-16982d1e411a", "value": 39576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751315022, "uuid": "a4e1500b-d41b-472a-8838-d927a9b983dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315022, "uuid": "1a9b6347-4c1a-4450-95cf-fbeb8d2d2ca4", "value": "SecuriteInfo.com.Linux.Siggen.9999.29054.32207", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2fd6647-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751291221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291221, "uuid": "b7f34cbb-4684-4204-8c41-3d79bfb10418", "comment": "Malware payload (Mirai)", "value": "483e8eaa052dfc8780dbd5d48664b325", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291221, "uuid": "51950e3b-4a1b-4752-bb09-f7764ac39d77", "comment": "Malware payload (Mirai)", "value": "3c9076220ab597589c364599f0e4067273adfbea0cde237989224b1fadbe4650", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291221, "uuid": "09201c68-bfd4-4559-999c-2b51b46f3772", "comment": "Malware payload (Mirai)", "value": "cedcc95a40d6d1bc93076ccb1a2644d7b528a811", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291221, "uuid": "b2613cef-921a-4422-be34-a0bfc37965c1", "comment": "Malware payload (Mirai)", "value": "a29fd54a69b37239af340dbc827efdbfbefcbdb2539ab43edbe3be3321ae3cd2b13de2104d76453f5e6c33cbed471138", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291221, "uuid": "5d1a61ca-f75c-4e02-ab69-16f90594a56a", "value": "T15F435C4AE787D9F0DD4609B0116FFB39D935D8322120DEB7E7D8F967ACB2502A44229C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291221, "uuid": "a5ec295a-8f3f-4b0b-86d7-b7ae8ea58fd8", "value": "768:5SJMkffH1nemIhrjpB8AdwAWBrfP44NiQtMCSnlCCe5JOGsHLFK:kfH1MNB8AdwA65CCSCKnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291221, "uuid": "a5dc717c-c1a0-4a09-9bd8-4e96568285df", "value": 57948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291221, "uuid": "18fc4f91-01a9-44b9-946c-ce1f68210f41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291221, "uuid": "14b8bf24-9871-4df8-bb38-35a142408a4f", "value": "miraint.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d11dc14-5588-11f0-8bd0-42010a9c0005", "comment": "Malware payload (NetSupport)", "timestamp": 1751270380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751270380, "uuid": "1e3be27e-061f-444c-83a3-2e0210850408", "comment": "Malware payload (NetSupport)", "value": "503ba152518cb8698cbc3de179f1cce3", "object_relation": "md5", "Tag": [ { "name": "5-181-157-51", "colour": "#250DEF", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751270380, "uuid": "58a4356f-2c12-4ea8-af82-37310d085d27", "comment": "Malware payload (NetSupport)", "value": "3d2e92af3b269b054da237871cb8d6033ef25f000a7357cdc12753e6afd49bf5", "object_relation": "sha256", "Tag": [ { "name": "5-181-157-51", "colour": "#250DEF", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751270380, "uuid": "2e8aba74-e0dc-4ab5-83fc-6fbbd61a22d3", "comment": "Malware payload (NetSupport)", "value": "459db99d8d28313d2dd54e6870b5cd656bfbb8de", "object_relation": "sha1", "Tag": [ { "name": "5-181-157-51", "colour": "#250DEF", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751270380, "uuid": "c3b07512-82e9-41cd-9c9d-1a017e884b09", "comment": "Malware payload (NetSupport)", "value": "8975f45b74d35e12cc39ad01401791957f224eb1dadf1a948e62a3103bc0f69f76830e5fabb0b277a504da3c0f1bf0d9", "object_relation": "sha3-384", "Tag": [ { "name": "5-181-157-51", "colour": "#250DEF", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751270380, "uuid": "cb770b16-32af-482d-b1b2-30e24b5a8a91", "value": "T16C763362945E0507642CC5FDFCE52F896913894F398E8D66D829F844B2C87B8F2316BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751270380, "uuid": "259a9fa9-9c2e-484a-93f3-d64eb979aab5", "value": "196608:Ur6GPDBYIsp3YfrMc0kmfnMc0ANfDMc0hYfnMc0SA:Ur6e6IspY4cmUoNgJY0KA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751270380, "uuid": "2abad2b7-6fac-40ac-a3a2-39a1a71d2867", "value": 7292550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751270380, "uuid": "7cc74715-8bf6-4672-bb32-ef36e00ee97e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751270380, "uuid": "0fcd580d-6c22-42f0-8493-426f49210b7e", "value": "3d2e92af3b269b054da237871cb8d6033ef25f000a7357cdc12753e6afd49bf5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f192d43e-55dc-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1751306788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306788, "uuid": "d32bd15b-93a7-473e-938f-14258db3e6c9", "comment": "Malware payload (Rhadamanthys)", "value": "582857b34338eb8a66a17aeedea6943c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306788, "uuid": "68eefcc6-1118-4a2e-b4b7-b048dd039dd0", "comment": "Malware payload (Rhadamanthys)", "value": "3d78cf16e186cb1309701dc586ed0002181197c30b1a4e6d87f33cd137cfad01", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306788, "uuid": "8395a7b3-6502-475d-811f-53d5a6b06950", "comment": "Malware payload (Rhadamanthys)", "value": "413715f61824b7f412433ed215ca3c0b652137ed", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306788, "uuid": "5490bad7-70f5-4890-b1e5-31eb6e1ef27c", "comment": "Malware payload (Rhadamanthys)", "value": "5d7d994d6f2a3b0c6ad6c17dad20b2675de48cbfc631a4261ed1c234079e5122e1d103415ad22b1ed560633f7251c17b", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306788, "uuid": "6d296906-8785-410c-bf91-6e5bfa503eac", "value": "T1C02412058535223F4EF0FBF5E44A4800DAD8ACFA458CB8ED5DC7A0AA9AD868745DF606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306788, "uuid": "2489b511-58f3-4d38-ab8b-7f101c3c820f", "value": "6144:QpG9WUnakM23oVkfM0LYiFtAf2vvKSE4fnuaj:wGoZ23TfM00iFtKSEej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751306788, "uuid": "9b5db3ca-66c2-4500-b52e-ca544cff6b7d", "value": 213274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751306788, "uuid": "0c194e98-add1-4000-a198-b9c55c79fe65", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306788, "uuid": "2e08bfa0-8282-47a4-b5f8-1f89ee335d4f", "value": "stub.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45358fb5-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751291037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291037, "uuid": "e083bc75-693a-421f-9372-d3498e290937", "comment": "Malware payload", "value": "1fa3b63e7e7980011d12e53b3ea20a76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291037, "uuid": "8fea7b07-bfc4-4972-aa07-497836594b88", "comment": "Malware payload", "value": "3daa28ba0227582e0253a15ed478c27d585c9014f322be7ada94e20cef85638c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291037, "uuid": "506262bd-79ec-4ed1-9391-fe3fbd5df9ce", "comment": "Malware payload", "value": "81900723c1cd63693e63ba715d768741d833a71e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291037, "uuid": "92c19d51-9b46-45f7-8c59-99df33233f32", "comment": "Malware payload", "value": "6d8527551faa158e39240b6a12ab527e8e61b466e2e3ed5c7bdcaa2179ca96c082b653e7e09eef6bf1bec564a5cba0ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291037, "uuid": "b8899b0f-9616-49b8-9ae3-ea1583b1235b", "value": "T15E847D1AFB9404F9E1A7927CCD534902DB727C8E07B1A6DF13940A961F276E09E3E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291037, "uuid": "1b34a9d1-4ed2-43fa-a0eb-3db4d27ec57d", "value": "d87b818d972e72b778d2b6b73c8bee34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291037, "uuid": "7f7c3f49-cddf-4542-b293-b89de2ec3f9e", "value": "6144:vgTLCrQQaDQV+ABfXT1dDTeax1t1JAgQeFS/M5tTAjxHClv1x:qQaDZWTDPPzJvrFSxU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291037, "uuid": "17f2567a-9482-4b4d-84a0-35eb7f78d683", "value": 381440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291037, "uuid": "56c3d188-2fc9-46ea-9950-f1b11d8df1ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291037, "uuid": "56958d94-ea64-477a-9b87-b5fd1527233b", "value": "1fa3b63e7e7980011d12e53b3ea20a76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec0bcd4-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751291241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291241, "uuid": "90858caf-f1c9-4261-a99c-21ecdbbee594", "comment": "Malware payload", "value": "0b9e798ee3394db15b7f7659af0f34a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291241, "uuid": "f4348fd4-fe2a-4d82-b938-693f56976380", "comment": "Malware payload", "value": "3e2f166fcc656d6ded1962a71fb6d5f2f2093d900c3f3a75804e6eda3418416b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291241, "uuid": "3f812b12-1494-4e4f-b416-26f779a996f7", "comment": "Malware payload", "value": "2910ef064cb00ed01e6cd6df690c7ebb41b8e430", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291241, "uuid": "258f9f3f-54b9-4190-9a74-ccb4d139a1ed", "comment": "Malware payload", "value": "8268d902f272616c73634aa64c968dd1a45549483910f2c8d3754ddda5f84eef7ee38b6cd8a1ba142de10bed3ac9e9dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291241, "uuid": "f269f56d-7873-4557-ad3f-03805b31f742", "value": "T115767C13FCA145E9C0EEA6318A6692527B71BC891B3027D32F50F7782E76BC46D7A704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291241, "uuid": "7a9a0ad9-f8a1-427b-a152-543c6e29fc40", "value": "98304:Lf6gwNVJZjEhcApnzcmuU7yz6qju1cgKsRtVQ:LWJS6Q7yzxqc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291241, "uuid": "af17992c-4542-4a6b-a13c-216c521a6771", "value": 7226659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291241, "uuid": "8d0b65b3-322e-4ea3-be77-ec487482b66e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291241, "uuid": "931bbdc6-d203-48c2-a794-f0fce4d03a6c", "value": "cnc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad3ac4f0-55b7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Stealc)", "timestamp": 1751290782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290782, "uuid": "1d013168-7cfa-4463-9fd6-b03627382d72", "comment": "Malware payload (Stealc)", "value": "ced1f0918876f0ce7fd20da67f7467f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290782, "uuid": "37b91953-a29e-4861-95ae-ad263f4b26ab", "comment": "Malware payload (Stealc)", "value": "3e8e9982a0f9fc2d24bf4f84127ff19dc2ac57b526d13b2226b33d7d39bb5748", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290782, "uuid": "b9958dd0-abfa-4b7d-94ba-3c9d08b7e2b6", "comment": "Malware payload (Stealc)", "value": "a48ebf07f6c154804a8f89717ececce45e231201", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290782, "uuid": "319c34b6-d88e-4d2c-add4-af0b3fa497a7", "comment": "Malware payload (Stealc)", "value": "5860725e872ad768e99268ffcebede20f97327c85f61cf46928bec2e2cc5ebc82a64309ffafd6c5998399ec94f4e741d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290782, "uuid": "b3ce1e5b-f3a5-49e2-9a0f-755586a8942e", "value": "T16E95120AEBE904F8E063E174C5478902E77ABC4E1372D78F17D956562F232B09E3AB51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290782, "uuid": "486ec043-1191-4f8b-898b-7c05e2e8ac10", "value": "7e0a0e8f80bbd1a9c0078e57256f1c3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290782, "uuid": "548547d4-6c16-4f6f-86fa-fd55036e86aa", "value": "49152:xDojF464ysN1UOhp+f2QR5pvb53bMsymLvq4EzPvONT9KPsII:x0Sy4Vhpp8z1bVymLvqlzPvOeXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751290782, "uuid": "1a0b08b2-4ba3-4580-b78c-9454abf44d79", "value": 2045818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751290782, "uuid": "2f6a2ffc-0a86-479b-bf71-49082068e514", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290782, "uuid": "31ce2af8-245f-47b1-8adc-ead50c27cf0b", "value": "ced1f0918876f0ce7fd20da67f7467f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e73f8a-55bb-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751292513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292513, "uuid": "6915a15f-eac7-421c-a1b2-48c56c4f1da0", "comment": "Malware payload", "value": "e544a83ed3ccc38026b9cda5bed712eb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292513, "uuid": "5f94b436-55c3-416e-acb9-0453900b3cd5", "comment": "Malware payload", "value": "3f2fbe37bbe0e7b5aeb09cd5f5fdc593ce826a58eeabcc1d6888c1cd2a7d17cd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292513, "uuid": "26e1aecc-a5d4-47a9-ac27-0726da97435b", "comment": "Malware payload", "value": "8c594a12d1b97b51f143bd155aa9f65b028ae545", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292513, "uuid": "d3aa46a0-887d-4ac1-afda-5d60162103c7", "comment": "Malware payload", "value": "99ea26ff016797692ecf8da8226e79165c5f64b2d09e9f0daacd31e2276d68460571f08423c8cbc95e821933aa096d72", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292513, "uuid": "b5150a66-55d2-47ab-aa8d-a885c20c5c6d", "value": "T1EE71FDC976B23A6313E5C42776524A9F26F488F6544B5BECBDF8183A6494708730FF48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292513, "uuid": "0a2e3bc2-8f95-4332-af9f-705b42c76065", "value": "48:a+uE+b1Azrjb1LnAl510zYWf5HYFoLwH17M:ajzb1Avjb1LAl510zKTHZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751292513, "uuid": "84c36abc-2b71-43ee-a408-a1e67b308105", "value": 3592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751292513, "uuid": "71a757f4-d570-4ed5-93ff-777adaaa53ae", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292513, "uuid": "7eae5301-6cf5-4b4c-aaf7-11f95883bd51", "value": "bash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b16742-5602-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751322946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322946, "uuid": "b6e6bf46-8d95-451c-a6be-8f44262f8c6e", "comment": "Malware payload (Mirai)", "value": "d835a1fc048ab94138f0c59cfce85682", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322946, "uuid": "c08ee56e-2052-4df0-8ddd-30b3db5e7441", "comment": "Malware payload (Mirai)", "value": "3f35e3ec61a286559bbea3816d89e720076dee73f4f4149c93b77ad004608ad0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322946, "uuid": "0b25f645-401f-42d7-ad21-23a551aa6a22", "comment": "Malware payload (Mirai)", "value": "f64dddfdb8b4e499f979ab6d750a2caaf64feb06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322946, "uuid": "5ff2be55-6983-46f4-9e1c-235ad6c7a7e8", "comment": "Malware payload (Mirai)", "value": "c7b56fb3aa329a077b56119f69219aeb3a0f841d919080aae3e87552355f6434868cdc2cc6b4f2ceadad5b83f4115f84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322946, "uuid": "e0e7ff40-ac29-4630-b3e6-928ab3a4a2c6", "value": "T17A330985BCC1CA17C6D462BBFA2E418D332563E8E2DF32079D216F11778A82F0E67655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322946, "uuid": "aacdeb21-b0eb-4721-8df4-d4ab36f6656f", "value": "768:DPLgg9HdMZIqyHn0SbVKdKv9vuJkLHBayuoT1iSceP+Wt5Y/NPUBnGoOzM6:fgSHuSbVtFvuJiN3iScuJt5YSBso6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751322946, "uuid": "b2427fa7-5b08-4c3e-bd9d-a49581a97db5", "value": 52628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751322946, "uuid": "da455e76-efb6-48e4-8809-749223026825", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322946, "uuid": "3f8e52a2-9dd2-4b73-bccc-a54aaf576a13", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e78cb1f-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751243834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243834, "uuid": "6932f7d0-d624-4c30-94aa-ba6ab3931d48", "comment": "Malware payload", "value": "1f08e100e99ac77a070f18e77e3a0224", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243834, "uuid": "41ba42c2-f3fc-430f-afed-a10c5c26171a", "comment": "Malware payload", "value": "3fbd2d6bf23872affc79648d90e1ea3792859fe6a8960db6edf6b654902facac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243834, "uuid": "785e2023-252f-4773-929d-445755d500a1", "comment": "Malware payload", "value": "66ab3e0926fbe61143a929bdd121c4d4a82d58bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243834, "uuid": "b98ab786-cee2-4aca-a46d-45cea3ca1e1f", "comment": "Malware payload", "value": "678393e80ba0083cd34277c5511eaac4c3cdde1f7baa0690d21a9834cbc46cf27d2878bbef904a1f9fde29851d383049", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243834, "uuid": "a643c843-33cd-49cc-b393-6b48744af676", "value": "T18DB401CE9520D295C4B02D33C57BA2F282AB6D3609596E1CDDD8FF6B2CF67450638B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243834, "uuid": "6366ec77-db80-4742-bf0f-06064be7bea9", "value": "12288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243834, "uuid": "3ff682c7-237d-44ef-b8ab-7a18610a2920", "value": 502120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243834, "uuid": "b7f23974-172b-4208-bdda-a0e847ca1913", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243834, "uuid": "1fd72cf5-1007-4362-99c1-f172702ca15c", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "490a9db5-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload (STRRAT)", "timestamp": 1751291902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291902, "uuid": "251f78f3-e39f-487a-b5e4-b4a68beff139", "comment": "Malware payload (STRRAT)", "value": "c584c0610d4453a11918e3c95a29b3ab", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291902, "uuid": "a1ec273e-40a2-45c7-bdec-fa54d6c04945", "comment": "Malware payload (STRRAT)", "value": "3fcc9b4f023d51a632d44991427b751d8450c27d3bbe648a3515e6703c84aa07", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291902, "uuid": "b4bbdc1e-14cc-4707-b753-a3e7f03c2170", "comment": "Malware payload (STRRAT)", "value": "69638318a9e0598a86c3ddc9fdac043ffd27e74e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291902, "uuid": "5ffc8615-3e99-4186-b666-ffec666f54eb", "comment": "Malware payload (STRRAT)", "value": "d653d18238c634250434b169777dd3eafb225895503883e4cb95a20ac153d5155fbea84602425c0422f02bd843d24954", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291902, "uuid": "48a48a75-2364-45e5-a44e-8189586b0f86", "value": "T110145A685180EE249627C008DC96D32543A7BA427E13D77AA5FD6B7D9AF2F7F10093C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291902, "uuid": "f23010d9-8075-4bee-8eb8-e3a96454fb18", "value": "6144:eQS+9tk3g/Lh/6eb1YYt8D/wL3Fz934BNwHyudmclAYci:1bagvbeY2D/wRzx4B2HyAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291902, "uuid": "0092d38a-4207-4b6c-9e67-6ce877fc9223", "value": 201590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291902, "uuid": "1de1b210-a14b-4cbf-8200-25ad9f1f0f38", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291902, "uuid": "2a1d6af1-a832-484f-8fcb-606b0997a00f", "value": "Request For Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ddb17c8-5569-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751257014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257014, "uuid": "6be3ab84-3854-421d-8035-bea30969ec37", "comment": "Malware payload", "value": "2f4f995b26cf5f1c50928085d760d4e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257014, "uuid": "6e437ff1-4019-42b4-9604-f77306c656d3", "comment": "Malware payload", "value": "3fd4535c5e8dc87f849ff5e32dd52de5cb4d12353e5bfc01323b6fc2f522f7c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257014, "uuid": "952db50b-f15b-480c-b323-74c9f72450fc", "comment": "Malware payload", "value": "a8721a028d1dfe7fd28705254d110eb05f20dfcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257014, "uuid": "026cedf0-33ea-46c0-889d-a417d5388acd", "comment": "Malware payload", "value": "4124da2ec313bc3794ad217f70e04d85c3268b156421d689e74e8f31fc2e5e5154bf969ddaebf3602fcae27cd92cce4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257014, "uuid": "77bc7de0-88c2-4b48-861a-fc87ee2c5c0f", "value": "T10CC4F1A377204F91C35195B209F389335AF6199706F39982537DEE107F20A68386BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257014, "uuid": "89f2ff6d-44b5-4bf5-83ba-adfbf051dfc0", "value": "12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7zM:W7v+mrY2xzf03yvZ/YIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751257014, "uuid": "18456b8a-0f64-4287-87a3-876d161a4bd7", "value": 592688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751257014, "uuid": "0b428454-409a-4b56-8084-81431971b0fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257014, "uuid": "80988ec3-20a2-4b2f-bb87-c6943d800995", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ed026e-55f1-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751315516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315516, "uuid": "13a84436-d344-451b-8db5-270057e8a69e", "comment": "Malware payload", "value": "1ca01613b7b49c0514c464174cb2aaf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315516, "uuid": "3d99201c-e6a3-456e-8628-65c6a42230de", "comment": "Malware payload", "value": "3ff374e8d9d63cd65c33349fd12cb5a96d7cfea808b20187fac7ff024c2ff2ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315516, "uuid": "42459c26-d45d-471d-abb1-faad8ddee632", "comment": "Malware payload", "value": "7ec994dc56767e06e640942be8b46e94dd16c005", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315516, "uuid": "8f615c2b-894c-4a66-ac47-fc6952e99b82", "comment": "Malware payload", "value": "5d2714b813ad98aa1840547746abff836af01dcc49822dfa1d66db9e85a665ba23ef4f63f52674feabd90586c74a14dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315516, "uuid": "6be0b109-f069-4fa6-8a03-4bc05840761c", "value": "T15E523C115791C279DCBD0BB35CB3E6501B7AEA498507EF5EB8D8204B4D7B20483A3BA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315516, "uuid": "683a3ec3-e436-47e2-9e8b-45d0bf6ddcce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315516, "uuid": "47b392f1-c19f-47e4-b064-367592b4e3d5", "value": "384:dIXkSEAO3dLJ3EBGQBc5DquQb3Xaokw/BWT:mFEAO3BKcNQdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751315516, "uuid": "de887232-89d4-4aa7-9f33-a759806addb9", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751315516, "uuid": "cc5c0c09-f7d9-49ae-9d40-e8859e0c730b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315516, "uuid": "56929633-6055-43b0-8bde-f62807c1ada1", "value": "3ff374e8d9d63cd65c33349fd12cb5a96d7cfea808b20187fac7ff024c2ff2ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c74df5e4-55b3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RedLineStealer)", "timestamp": 1751289107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751289107, "uuid": "0083ef8e-c2e7-418a-9f8b-4eb3d794fba0", "comment": "Malware payload (RedLineStealer)", "value": "22e65fa68da61e4678b7dc6391492cfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751289107, "uuid": "88879334-747f-40ba-b3d6-17875b3137ea", "comment": "Malware payload (RedLineStealer)", "value": "409b91be113a46f365f3ec04dc5da58a25871ce339f77364a4546d32ceca4a7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751289107, "uuid": "c9a31d1a-9a46-4559-a7ec-537ef39a223f", "comment": "Malware payload (RedLineStealer)", "value": "85fe0e2acde0d465fcf17e6d3fc8c847f1e26d52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751289107, "uuid": "20e916dc-fc76-497b-bee7-ff35f26fb036", "comment": "Malware payload (RedLineStealer)", "value": "7eeed1199dee90bf60174d9da1d4e20d23445b7fe76866dcebc92daec83fa3a8b7dae4fc827b2ec937e15d200c666bb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751289107, "uuid": "66ac0d54-1e7b-4502-9e8f-4358934a5785", "value": "T1C685D0027381C062FFAB91334F5AF6125BBC79660123A61F1398197AFE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751289107, "uuid": "2d9f231f-7798-461e-9a0b-1b2204b241e6", "value": "0b768923437678ce375719e30b21693e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751289107, "uuid": "2f48932b-859c-4019-bc6d-c260a89f4c9a", "value": "49152:WPVt/LZeJbInQRall5AxHNMlxGL0kTv7IZsm:sTYbInQcAxHaG4sm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751289107, "uuid": "1f9b0e57-0ca0-4deb-bb3b-9dd631526174", "value": 1741824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751289107, "uuid": "24211bd6-29ff-4a1c-a6b6-e608bef54f4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751289107, "uuid": "998b2f35-e8a8-411e-a341-ef299869af72", "value": "32609918795.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2060cf5e-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1751291834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291834, "uuid": "8fb80534-f5fe-4858-869a-99ae0575d05e", "comment": "Malware payload (AgentTesla)", "value": "b92414d326f583699c408459e3d80d0f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291834, "uuid": "9a7048ff-caa2-41f8-ba23-1e506e0ad92d", "comment": "Malware payload (AgentTesla)", "value": "40a689e0b31438b6990afdb225de28913e7aa099cb3966ec8e03fc55517ea8e4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291834, "uuid": "db02cbd8-84b8-4a12-85e2-705f875a7776", "comment": "Malware payload (AgentTesla)", "value": "c907b58ec7413e1ec4a784eca6f166259054b799", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291834, "uuid": "bc28ba47-d1f0-4859-b49e-8c3dabc8602f", "comment": "Malware payload (AgentTesla)", "value": "797b940b9f4689d54a7c310b57e725be01778d3935349c208fbfe49951b725d82531c5cff2925e6d7b69f3eed3607223", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291834, "uuid": "c22b8876-4961-486c-a146-d6b6c199d79b", "value": "T139E412853E1ADC13C46697F54920C13863B99ECDB922E3D29FD22EEF35E1B641941B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291834, "uuid": "9ea43eb3-29b1-4486-b3f5-1dc37db8c347", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291834, "uuid": "7fd89458-4c4b-4f4d-afd0-0fde7b9bf9f4", "value": "12288:J2sDePUJf9lMMWxLgsRt4qkxFPy0dcOohYps3iSoKYRWL3dMlbbr6E8jb:a4f9KHp7Rt3a1oO1pWiFOJSbfX8jb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291834, "uuid": "09548962-538c-4209-a85c-33b665abc2ce", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291834, "uuid": "c2dc88d3-d73a-429b-bda6-10d82b105d66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291834, "uuid": "0441b512-1115-467b-bc74-b7710a33069e", "value": "Halkbank.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053b0a75-554c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751244544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244544, "uuid": "9e5be160-0228-4c51-b097-52b404af70b5", "comment": "Malware payload (Mirai)", "value": "6efaa6451973eb18588b928ad356c6df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244544, "uuid": "5436f0ae-7721-499f-a914-657ea71f0e93", "comment": "Malware payload (Mirai)", "value": "4113283b6317b6b2f7d4a29eca7241e9a10ad196b479f16f5422ff8ced7d5f93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244544, "uuid": "67de3b22-8542-4eab-8746-4073b160841d", "comment": "Malware payload (Mirai)", "value": "0c68d0f9088ceabbb01e04f49715de5470a4c425", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244544, "uuid": "8a2ab085-ab65-4808-9375-1cb07cad5cea", "comment": "Malware payload (Mirai)", "value": "710efb2ba28b4773255a94ef634f0aec8dd6657818fcdae9ec956846531522469800dba82e8fb8e436079dd0ba3c733a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244544, "uuid": "d58f91fa-a798-46c4-ab77-e93ebc9f9fde", "value": "T140A35D56B3090F43D1C619F01A3B73D6836E56D070F6EE493E0BAB0846B6972918BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244544, "uuid": "5a1aa5bb-865f-4be2-b6e1-7a0212c20679", "value": "1536:yyUrIXjEq/SwBxbNQWLZGWHdA7j7kihjMeaAr4OL0aLZqzwUnJ:tn/5BxbxGqd4vhAArKImJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751244544, "uuid": "41aefa0d-29fc-4336-ad7c-29d6e3f72bca", "value": 101864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751244544, "uuid": "4b73afac-0c75-47ec-9f07-b77b92a86a1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244544, "uuid": "23d91aae-0bb7-4014-b9fb-03ebf749255a", "value": "rondo.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a3656a8-55d7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751304440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304440, "uuid": "1d209440-3d18-43df-a5be-4fe71263aee8", "comment": "Malware payload (Mirai)", "value": "7d0a360e162fc647fc640beb5e6a5397", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304440, "uuid": "6fbed3db-528d-4505-9ca2-ee627d6acdf8", "comment": "Malware payload (Mirai)", "value": "413fbb322cbb5ef8942558b4b56f4f654a03738b9933e625b2890749d4a680ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304440, "uuid": "6f3bbdeb-2da0-4cb4-8679-a913776da5d1", "comment": "Malware payload (Mirai)", "value": "4e821bb55292a2a479506ed80292378325e25b5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304440, "uuid": "50aa484d-090c-4118-80bf-b9af714f0e43", "comment": "Malware payload (Mirai)", "value": "48d0fe204f896565e6eac864ed9e5e0af3344c4192f716190b204e34217444ae9e4a76823acd19ca28d5566a3301932f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751304440, "uuid": "6e350dc0-87ea-42cf-9182-b36f7d11784e", "value": "T145B3D64E6E218F7DFBA8C23447B79E21A75933D637E1C684D29CD6011E7024E246FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751304440, "uuid": "2f37e7fd-0040-4f36-af84-e1f7c087f6c6", "value": "1536:JOd2MIRcCeKmZKLD8IN/+kroI98p42DsAQUmze0knFqC6jr:I2MIqVZK8IIkroIup42DWUmYqC6jr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751304440, "uuid": "8d1bddb2-b7b1-4c24-9319-e85d55ebae65", "value": 109872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751304440, "uuid": "85560f85-70a9-452c-af98-4ff2b92b65cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751304440, "uuid": "cbb8ff40-8043-438f-abcd-c150055035f7", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f43ebe81-55dc-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751306792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306792, "uuid": "fd8c65a2-8dc6-4fa5-b7d6-ee55e2b69702", "comment": "Malware payload", "value": "a1093a8ee80c8420208f2c08d7e00d45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306792, "uuid": "146cf446-ffab-42aa-876c-f7c297b04df3", "comment": "Malware payload", "value": "41938903b5fa521e712d21fc0391b01d47370af4ce298fcda2de976088ba7bfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306792, "uuid": "29ba5b68-5661-4c78-984b-4b5c79c59c65", "comment": "Malware payload", "value": "c6a6bd5fd884b3c26da394c4cd87c56df73f11ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306792, "uuid": "4c5006f1-fccc-4101-ab75-42aee549f62e", "comment": "Malware payload", "value": "07689d9d14adeb1e143de61486719dae2cc838d38be648fceb7a5f60de6b37bd731a34738a1072f2450d449a5864c0f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306792, "uuid": "2292b402-e560-4022-b932-ade6ecad3693", "value": "T1A106C7E720C266EDC416C57F8723ED7E898FB1365616D8E3A094E2225D2ACC43776F09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306792, "uuid": "9d836fb7-1ee7-4001-b4c2-322c45ffc18f", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306792, "uuid": "e8c8f364-b499-4e38-8d2f-df3faeb3662c", "value": "49152:gVap/BCYJbTkoLxhThNPdawZ5nwLkT4irXSo:gQPxBhN1FZ5nLT4iTSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751306792, "uuid": "e3e3ee25-98c1-4f7e-88e4-00658f6c72dd", "value": 3693056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751306792, "uuid": "e5297d60-201f-4cb3-bd76-5f0bd96380f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306792, "uuid": "7655a101-9160-451b-b3f6-841abf959d8d", "value": "IY0IvT6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b80913dd-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751291229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291229, "uuid": "b36c3b43-e72a-478b-8f7e-477723ca1590", "comment": "Malware payload (Mirai)", "value": "57b111f2794b9057a2d9cc6132d1e2e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291229, "uuid": "76c636b9-8503-44b8-b096-c55bd6a9d146", "comment": "Malware payload (Mirai)", "value": "42260804326193db8cdc69789f6c21952fb3175a8df5c646d16e45a96b4133b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291229, "uuid": "c2584310-f49e-4866-ad6a-b8e7d41b3ec6", "comment": "Malware payload (Mirai)", "value": "0ea4981634a823b513444f213f5f2b3e8cc6fde9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291229, "uuid": "177c18e2-f133-409a-812c-c0cba78691c7", "comment": "Malware payload (Mirai)", "value": "b8e58b1f75f391e770087909769a16d095a206bc60aa506f3df6464b46f91b8a58982325f3e57475896f25b1ea4b0402", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291229, "uuid": "ad4808ec-afdb-4438-a4d8-b097d625586a", "value": "T1F63339D6F401AE7CF95BDBBE80134909FA62675150930B2723B7FDA36C321648927EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291229, "uuid": "6ca55161-7796-43b9-974b-bcff18608fc1", "value": "1536:YLK3/WgyVik/Qcyqjj4tV8Srrgy5MfkVB58dz:BkikQcycfsrgk7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291229, "uuid": "b45fd099-84e1-4645-a44c-152051221e12", "value": 54548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291229, "uuid": "22aee154-cf05-4969-a03d-c5a513ee2f28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291229, "uuid": "79d4f901-b449-4eda-ad2a-00eacca8e03c", "value": "miraint.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4198c7fb-5580-11f0-8bd0-42010a9c0005", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1751266979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266979, "uuid": "6b5776a7-5251-4d58-ac1d-c77bcc4fafc9", "comment": "Malware payload (VIPKeylogger)", "value": "9cb7a249b891560d94a9ee41ab892be9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266979, "uuid": "39492ffb-af3d-4919-b67a-a274d1898779", "comment": "Malware payload (VIPKeylogger)", "value": "43b6d57c48dcf0baa0e1ff7e61843ba059e63897a0e902d5b270339d784a0e73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266979, "uuid": "ff127d18-0161-4f88-97f5-89810bff2912", "comment": "Malware payload (VIPKeylogger)", "value": "ca4e796c9acc409579a26475cd102173fb12c73d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266979, "uuid": "19b8086a-9323-4333-ae7b-bdaebc7f18d7", "comment": "Malware payload (VIPKeylogger)", "value": "1927eb549cdf5a20be6bd67e84e95b8f71c7a1382ebeb093b57e3636f405b913d6aa5ef9d421c2bb28159554be9fcc9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266979, "uuid": "414e9260-94c4-4ebe-9baf-1ddbb9252e37", "value": "T13F351241BBD48D67CE684830816AFF38D6F41EB7F9113A0B598C3F563E3B6863246A54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266979, "uuid": "a9563f27-9738-4935-a871-b87b4c589e2f", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266979, "uuid": "f83f3104-e941-49bc-a268-ce398b38702f", "value": "24576:u4zBy2kZY5OiZ/PY820M/N1yYX0V/YLy028vlTlEr:3zYVZPiZ/PY80Wk0mG0zdTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751266979, "uuid": "c2ead2f5-673d-421c-ae55-9ffaa74b8ac3", "value": 1061072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751266979, "uuid": "b4ea4ead-513f-413b-b66e-8bc0e9f2b8a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266979, "uuid": "0a70a73d-9f6d-43f5-a4e3-a42b241adfdb", "value": "JUSTIFICANTE -Carta de pago,.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f149df60-55b7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751290896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290896, "uuid": "9d9e351f-a9be-409b-9320-c6765d97e3ba", "comment": "Malware payload (Mirai)", "value": "191fac4890b768d4efd817c611e7282c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290896, "uuid": "64e92ebc-18ac-4ba3-9700-34abea10f34c", "comment": "Malware payload (Mirai)", "value": "43ea93569ca7861453290021846c243177140edaa733c8999d8ca953dfd3c9b6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290896, "uuid": "03abc5e3-1c3d-4b5f-b0e2-430d35da7852", "comment": "Malware payload (Mirai)", "value": "5d0453f1cc7d731e5c4cb103cbb5a19055fac12a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290896, "uuid": "2a83e148-6d6f-4278-b3aa-c236ac013835", "comment": "Malware payload (Mirai)", "value": "1ca01452e1756a2ac410172dfab7771f96ecf5a4075a1ccfd123f4efaae7ee3ae259b9fb7d55614a1cc7890247cb2e53", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290896, "uuid": "7770fe99-5c37-46b2-8ad0-fa1799a5416c", "value": "T1F9413DCA11A218B83EA79D57317E4AC13282EEDA50C65F1DD8ED7CF440DEE187060AB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290896, "uuid": "083a3a78-83db-4665-96d6-ec12ba7c1193", "value": "48:v9vmvDs1ja9aUvslbnpTD1J5dtHD62yqDj+Z:v911mUJlTpTDT5vHD62yqDj+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751290896, "uuid": "dfdf7bd1-eb00-4610-a802-7941526bddf7", "value": 2412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751290896, "uuid": "f7d28054-d241-4652-84f5-4975e940bc38", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290896, "uuid": "ef99e075-b0d3-495a-a30c-f6e81b1eff18", "value": "tbk.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc2c952-5580-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751266969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266969, "uuid": "246ac62c-642a-4e6e-b58f-4f9cc1de24c2", "comment": "Malware payload", "value": "d2fe42feed8b3d018d1cb99e8893c103", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266969, "uuid": "5baabf4b-904c-4dda-86b8-3bc8a03b297e", "comment": "Malware payload", "value": "4445b9df79f29fd728906b85dc4989c99acf88a54250991dc54d056bfaea950f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266969, "uuid": "cc258362-84b0-4b30-9a8d-0dd42fcf5b75", "comment": "Malware payload", "value": "a2d6771ba2b9a1555524c94d2c86da380a3764ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266969, "uuid": "48be1a08-3d30-43fd-9d24-5bfafb678437", "comment": "Malware payload", "value": "200b1d9af2cf074b7b615638f367e8c8e80d19c020b6cf50609e338bd5453b56a07fab7ef857b2c11927433c5bce00dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266969, "uuid": "f219f661-a6fb-44dc-aa1a-eb3f7d790f7f", "value": "T1B00623D86774A926E59D1378F0614D204FF4E559B763CF6E4A68A8EF1803BC09D02FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266969, "uuid": "94104c4a-493c-4817-ad48-09e12b5ae96c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266969, "uuid": "800b9dc8-7af9-4e42-9f9a-6ee079350511", "value": "98304:GLEzzkCyj1xNBnjoZu0BIwZMklPjXEqPDemvvs5k1+v:GsHyJBnjolIwfBXvr+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751266969, "uuid": "e1a209ff-c2f2-4dd5-9184-adec3e2afa99", "value": 3683840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751266969, "uuid": "c708c2ba-f8d3-4c56-81f0-c82a71626c68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266969, "uuid": "ea21326f-033e-4563-91be-c67a874f1c12", "value": "EURO 260,600.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e769b48-55d4-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751303159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303159, "uuid": "e20ab9e2-c0e8-4342-96f8-348d55d35641", "comment": "Malware payload", "value": "c54e8429b37adcc08c2f26a55cce4c96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303159, "uuid": "fe55d449-e86a-4e95-8463-e625f40aed76", "comment": "Malware payload", "value": "4471d478a6ffe00fa91db4c5a35878274b6116f0a5347aaf9dd087d498901070", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303159, "uuid": "e14bc15f-3ea0-45df-84bf-bb6214cc98a8", "comment": "Malware payload", "value": "50ffeaa60ceac15d785c03d693c39cfd22c4203f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303159, "uuid": "78f4fbf8-3bb0-4d78-8c43-0d45d2820dc0", "comment": "Malware payload", "value": "d65316a17ee5b9444206fb4eeadbb423878383bf73e6286d3f6bb771c38c9279e3dd6a28269acc112d9a8830ac0983be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751303159, "uuid": "1f7168f4-1ae0-4493-b8cd-da54dd453555", "value": "T178A41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751303159, "uuid": "88d64839-b6f2-4c56-9480-8622349aba70", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751303159, "uuid": "60700c05-786e-4bdf-a823-4ef9b33b3a0d", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751303159, "uuid": "06f982bc-d766-4256-870f-2d0b96c381a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751303159, "uuid": "290048ff-c207-4beb-be71-59bafc8c5968", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e888d9-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1751291895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291895, "uuid": "ce6e4a28-281a-4656-a8ef-12c5c3552bc6", "comment": "Malware payload (RemcosRAT)", "value": "6c273c215a0c5c12de7b52a3f4f616d7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291895, "uuid": "d1acffd6-be8c-4ea5-b51b-28211fbb1586", "comment": "Malware payload (RemcosRAT)", "value": "45068b2b4b8ae6b4e3e88886700ca4cdc345ea5e1c21dbfd7ae689465b65af34", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291895, "uuid": "ff95c5f8-181e-43b3-8c4d-9c154051a968", "comment": "Malware payload (RemcosRAT)", "value": "335d3f4a7a7549e960a3abff5fee702ba0e3b089", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291895, "uuid": "e61908e2-73a4-4480-ac98-4a26587152fc", "comment": "Malware payload (RemcosRAT)", "value": "7a0feeebceced3aedee9e09d0742b05df0b445954fca569b6eeb3f4226c56c8159dfaac2fba3660de2a6eca786704738", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291895, "uuid": "07a9b5b4-a86e-4c13-9701-c63260d0b796", "value": "T177039484B541E66483D31760052E6D0CEDA9D52B0CB8B0B8E2ECC7E576B066357B6F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291895, "uuid": "42620a24-5ee1-4865-87d1-0d8c28f7a463", "value": "384:94CpnDY3qu36JZlNzT9f6RUJ2Dmtkuxf2Fa23yzLEacHbs+TC0ym00TY8FfUyUUp:94inCqu3Y/NzhzQ5sVsY8VLD522Ke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291895, "uuid": "0371f7a3-a3d8-4730-b6f9-b194baa9f277", "value": 37940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291895, "uuid": "2b3fc81b-381b-437b-a66e-116c66006d8f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291895, "uuid": "03d7f435-5630-4e82-a8cc-3b1dfb33a627", "value": "Transfer_copy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60fd25c2-55e0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751308263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308263, "uuid": "09936c4c-a469-4dc9-a8e5-b8b8964c5794", "comment": "Malware payload", "value": "7ed06f67a595c219a7150597734a01b6", "object_relation": "md5", "Tag": [ { "name": "AIIS", "colour": "#997C27", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308263, "uuid": "338bee37-ea28-4b4c-bb88-8dfe9e6471f0", "comment": "Malware payload", "value": "45073fb0dab7fe91b0bcda6cc57f6e888223f5490a212eae4b00d65a50ffa73a", "object_relation": "sha256", "Tag": [ { "name": "AIIS", "colour": "#997C27", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308263, "uuid": "89fa3dfa-7444-4dbf-b7f8-fc1b423e8e37", "comment": "Malware payload", "value": "6f5f5cf10cabd6863b2a6a11dc751adc77d5de0f", "object_relation": "sha1", "Tag": [ { "name": "AIIS", "colour": "#997C27", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308263, "uuid": "02242104-9096-4871-bb09-2fff94544dfa", "comment": "Malware payload", "value": "80733ec05985dc396fd7b3187d9f0bc99d58c4b7b9cfd54d413c1bb267787ae77e30060d7c5491743fcf8a22bfb0aae1", "object_relation": "sha3-384", "Tag": [ { "name": "AIIS", "colour": "#997C27", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751308263, "uuid": "e3d1db58-3df5-4b6c-aa80-08a9ac28da98", "value": "T145E5C0CAFBD8AD2FC8771032C96A52F116574C468A83DF476948361C68B76D80F5EBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751308263, "uuid": "df4bee2c-7601-4074-90bc-df963e430d77", "value": "49152:GmYV+inDVrLt3zPDMW63vv8B+daIA5LH3l6JCg3g92Fo/KrGuX6bX:GmE+iDZLNOTX6L1+o/KrGK6bX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751308263, "uuid": "505a8c36-aee1-4eb4-a782-93daa1e73e15", "value": 3057646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751308263, "uuid": "065505f4-0754-44fd-92ad-c4a70d8de009", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751308263, "uuid": "ee6a5da3-e0a2-4777-94d6-1c8bc7c45577", "value": "app (13).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6bbdb4e-554e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Xorbot)", "timestamp": 1751245674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751245674, "uuid": "6a975458-0cf5-4a8b-a029-62c714e7b84c", "comment": "Malware payload (Xorbot)", "value": "1362a90f61527585af3c3bed7917716a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751245674, "uuid": "44f2581a-98a4-4a05-bacf-717a5e72eada", "comment": "Malware payload (Xorbot)", "value": "4578502a90d69df717e6d2ac3cb31310c06343d67af7cce74195a608868a6cee", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751245674, "uuid": "ae160e1c-b18a-41fa-8927-0a547dfd781b", "comment": "Malware payload (Xorbot)", "value": "1aa1583673127dc0c97a88e58e94629543998770", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751245674, "uuid": "80a6fd15-c077-4628-81d0-4ac3565f90c0", "comment": "Malware payload (Xorbot)", "value": "db7a2a81e940005c06068e1dabe021dc10398d5212c518456021e0db643f6d5b349703c8c90e9798c1d9a3f8d5ed3353", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751245674, "uuid": "13944b4b-d94c-4275-944f-438c18e9f0a6", "value": "T1C22211C501D8BA249A858D157EB1A884A201A3C5E9EA3BC8CACCFC7C418DFD7F5D5E64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751245674, "uuid": "c56fc59c-59b8-419f-bd5a-e16f715f3f31", "value": "192:F0RCl4b44V8MNG6Yee1iGTFss7YkjYJmuCl4b445ee1iGM8MNG6Gss7YkK:F0qHHYaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751245674, "uuid": "ffc88a58-c21f-4f9b-8fd3-00bb8ef082f0", "value": 10578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751245674, "uuid": "49b7c209-4e2d-4f2b-b0d4-d2ebf923b2ac", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751245674, "uuid": "863a7fc9-6dda-4bb7-ad77-69cbbd0fefbc", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "422be73e-5604-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751323673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751323673, "uuid": "fb86f201-4979-4636-b24d-6e69ca64ef51", "comment": "Malware payload", "value": "bbeef2d6c35684abfb6bb904df98b489", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751323673, "uuid": "83814d6b-c680-44c4-83d9-e7f68a3990e9", "comment": "Malware payload", "value": "458843674804beb0680d0bab79a89ad699d42a7724dc5a8682f681ed66cfa3b1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751323673, "uuid": "66b1cd59-5b9f-48a8-83f0-2dc442eb0257", "comment": "Malware payload", "value": "f17c8d83a722e966108cbe8b13f2a3a12c4fc3b5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751323673, "uuid": "b9e9885e-0151-4216-8a52-f9853de134bf", "comment": "Malware payload", "value": "f9c2f439f3e6682b5fc0d5b8fc4bde311ddeba6e776106c8c820c1c7f7be6b3066bdd87467d6d1ba4742be0a523d1170", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751323673, "uuid": "c7724538-47c0-4492-85cf-98692b8b7089", "value": "T16B22FEC282D47370A1825DEA3F7A8050F650C5C165F67BC8D6C8DCAD648AFDBF289A70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751323673, "uuid": "ddc704ac-0629-4d5e-8d5e-68dbeb6369ef", "value": "192:OQEhAzqsUMQdUUrbZ/2ENzYyMQdUU3QEhAzqH4:OQEhAzqsUMQdUUrbZ/2ENzYyMQdUU3QJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751323673, "uuid": "b0f2da7f-8a51-4836-82db-c07e774606e7", "value": 10578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751323673, "uuid": "b86d89fb-0433-4c55-acea-b356f03d729b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751323673, "uuid": "718bb868-802d-4cbe-be9b-d43a5fc8020d", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ec22df-55e0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751308132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308132, "uuid": "22cd4dd1-6d16-4a1e-9622-d22e14d6fc67", "comment": "Malware payload", "value": "13c15220aeb06b0fce2a77ff0d1c9ccd", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308132, "uuid": "319f3c92-c9bc-44b7-ac35-f6071af40b20", "comment": "Malware payload", "value": "45a5b13ba8a8709255b1eeaa78865798be772999849dba1e3d422821440bccf5", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308132, "uuid": "07d3106c-7a22-4fad-b30e-57c166cdfabd", "comment": "Malware payload", "value": "f918c6b6be5a7fa49422994f92a06cc9938f9f98", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308132, "uuid": "40b6369b-d4f7-4412-9272-ed0cb7d9b8bf", "comment": "Malware payload", "value": "82e8a2ad3c4a4d7347fc608727754027226c1453aa84a2e15fdbad8bb207f69888d672c11673fc2c6fe02baa067ccda2", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751308132, "uuid": "d2950c1d-318a-45dc-85fc-9267dfc4235f", "value": "T155173396EB41982EFDF793364777873A65214C27C363C2534985723C0EBBAD05A8AEC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751308132, "uuid": "cf2a837f-d623-4a1f-8a50-43d9a29d49f2", "value": "393216:R/rXPdGRlq9UmsKvbpVZfX6B5Ht2vHKxVPp86qeTBhEtjVO:R/rFGRUUtW1bwtoMBKgheO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751308132, "uuid": "fff3c7b6-45d4-4642-8c56-acc4ed98d0af", "value": 19315826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751308132, "uuid": "39e683aa-b96e-43b6-8b24-6d77da68681b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751308132, "uuid": "8daf0fbf-267b-41d2-bd2e-1f0be0a3293c", "value": "Green.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35dc604-55dc-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751306764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306764, "uuid": "3b44997a-0e7a-4f78-a34b-1f045a618ed2", "comment": "Malware payload", "value": "a63186ba08fc85f30d755402e4a733c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306764, "uuid": "63a27898-0aee-4f0d-9b58-3ac549b4dd2b", "comment": "Malware payload", "value": "45f61ba03bf23aa1cac3a6b1bec0ebc8a739f2c1f99c4054649b8dfd54161548", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306764, "uuid": "594860e6-2573-4e7d-b2f9-0fa2cd9e40da", "comment": "Malware payload", "value": "37a3aa4837f96598f095f9437d64058f2c515cee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306764, "uuid": "bf57c25d-b228-41ca-a45c-ba17f44d93d0", "comment": "Malware payload", "value": "1ab4131e297b47f404553118fe2e1eebd95924c812fef72277e5dbbfbfacfc56b718072b4f27948b70aed96c849b093e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306764, "uuid": "01a7c76d-b66e-4dea-bc4a-42287aacad30", "value": "T193F53CA03B0FA1FFC96B08799C01D807819467E2EE209602FD65756E7683F6552CBB3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306764, "uuid": "a94128da-fa69-4bb1-87a7-c664245b93dd", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306764, "uuid": "eff78607-89a9-4705-a87a-d1e61dbbc4d2", "value": "98304:EAtCXW/xeigvSRE6jwfhLWREng0g/OVrQE3Ym:uJv9LWRmgPOVrb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751306764, "uuid": "271d8d49-f916-41a2-90e8-0b62bbc1e48c", "value": 3336704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751306764, "uuid": "1d0aa06f-8532-425b-8591-117acb53b8f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306764, "uuid": "c1709f14-6228-448b-ad90-4489436d37c0", "value": "addon2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72af1b56-55e3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751309581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309581, "uuid": "6b953640-44c4-4da0-9a23-c91e5ffe3b1f", "comment": "Malware payload", "value": "8c4997d93c6b92da912a852198ed6e26", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BRICS", "colour": "#3CB714", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309581, "uuid": "3c3879b7-c7ea-42ed-ab59-eccf641e363b", "comment": "Malware payload", "value": "4637ff68777ec315d0b3f383177059a3630308f15e66e882889b67f1bba57bb7", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BRICS", "colour": "#3CB714", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309581, "uuid": "5921c3dd-024b-44bc-8ebd-4de60160f76b", "comment": "Malware payload", "value": "52a3f62ae8050eaddf6d39ed40359a748b37f9e7", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BRICS", "colour": "#3CB714", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309581, "uuid": "cac82275-3180-4f36-bd7f-6dfb47f2eb5f", "comment": "Malware payload", "value": "2216efae9b39ca34548fa17856beae63bc00daadd373c4458089df0e07b4555c7701e275371ae9d0beee157a7e51a7af", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BRICS", "colour": "#3CB714", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309581, "uuid": "15755f22-fc6a-4373-a81c-40c27c5cd960", "value": "T1AB750253EB8ECDAAD4A7D63A8131925711178C784A8AF7A30E06B56D4EF3DC44F1ACC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309581, "uuid": "41ac12b3-b0f3-4664-a701-74264f471980", "value": "49152:JRZRxvhFH8XCVlWF0oW5/oDhKGlPfHL2oa:JRFZlCSD5/D8PfH6oa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751309581, "uuid": "97dbeb1c-32be-49f3-8af7-19798d84c535", "value": 1612807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751309581, "uuid": "e0af11f0-c8fe-43dc-ba48-525ae9003ea3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309581, "uuid": "af46056f-4851-4443-b605-0c1490998b6f", "value": "BRICS1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf3ddb9-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751291236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291236, "uuid": "c6a64beb-4b3a-4f6d-9e25-1e60db9840b3", "comment": "Malware payload (Mirai)", "value": "498b02fc0becd0a0a3273462610744ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291236, "uuid": "a9c2ee67-3ecc-4fba-b0c4-7b58bbfe15bc", "comment": "Malware payload (Mirai)", "value": "486055c81ff90f11ce536e9ba9b15a325bd008d49a67a0358e47368eaf53a7c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291236, "uuid": "048b9999-e47d-4497-98f9-62e6b40fbbbc", "comment": "Malware payload (Mirai)", "value": "f484e53c838ede0f22fe0f614bec6a8ca842a673", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291236, "uuid": "9a08af4b-bad2-452b-a4ac-76ed64b49974", "comment": "Malware payload (Mirai)", "value": "381fee32c3a8f1a419c9e2206f51763d4d98d781201c18c5e92a0904af7c12adc2e17d3b93fad0dc3a9c5e0d8b3f24ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291236, "uuid": "ca7ca5c7-52d4-4e91-ad5d-09f7fc1e50db", "value": "T16973F946F9829F02D4D622BAFA6E418D33136BB9E3EE7101DD206F5063C999B0E77512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291236, "uuid": "44417903-9303-46bf-b228-d331f9324daa", "value": "1536:0tnHJhPu43tpFSAQAbHLmVhrXgdVdv6MoqcIzVMXbuX91B97rNlR5iUSju7KW:ghHt0AnyBXgdVdv1VMXbuX91B7LSjEKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291236, "uuid": "ab331d30-016c-4b7b-989f-3ca569160381", "value": 80704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291236, "uuid": "3ed94ccf-701e-462a-a4f9-364f12f9d4e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291236, "uuid": "750482e3-69b2-4ea1-823e-549c16a70d3a", "value": "miraint.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f18d42-55f7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1751318145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751318145, "uuid": "c1fad146-2876-43ce-ac37-316fd730d757", "comment": "Malware payload (Formbook)", "value": "50f2e58e8fe9d99403933742afb7a0ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751318145, "uuid": "f6926b63-818f-4ada-bbcd-5ccedcb60f96", "comment": "Malware payload (Formbook)", "value": "491ac50c3138e38f8aa97ac5760292b16236bd1cad7cff24631d066b5d47d200", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751318145, "uuid": "9c5e4ca0-d799-4808-9b43-9fac9a97ec5e", "comment": "Malware payload (Formbook)", "value": "698d00e9d9c2b2166fd7e6af3024a124b1f893f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751318145, "uuid": "263ce62d-fd0a-4f18-a0cd-4547bac30f21", "comment": "Malware payload (Formbook)", "value": "de04759dbea862faba823eeb0b7e23d832682041e6edd804c473590599a529ddfdf96e70661764a10ac83c882c4eeb7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751318145, "uuid": "7d6d78d9-f36a-48e9-9ec8-c8772a8bea8c", "value": "T1E545C01363DE8364C3B25273BA267741BEBF78250AB5F56B2FD4093DE820161521EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751318145, "uuid": "fbaf9b79-8080-4408-9293-405a51b9c102", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751318145, "uuid": "de4e91be-1268-4c15-b4db-6b2917339c11", "value": "24576:Qtb20pkaCqT5TBWgNQ7axJNBFvQH7Q62RhtXRu5R6A:ZVg5tQ7axnBVQYbXRuz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751318145, "uuid": "e7d51ef2-695a-44be-80c4-3a638f08a9ca", "value": 1193472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751318145, "uuid": "7461234f-51a2-41af-8f27-b698aa21d3c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751318145, "uuid": "71d21208-6d00-4dd6-9ce6-768983b7872c", "value": "AL DHAFRA AL JABER - SUPPLY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f28f56e-5594-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751275592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751275592, "uuid": "b180e2d5-26ff-4509-aa55-b2f2e361f6a2", "comment": "Malware payload", "value": "1fd6132318076553ceb3b52b335ea975", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751275592, "uuid": "a8e2c497-3e6f-4f3b-829e-4548d56b07c2", "comment": "Malware payload", "value": "49efcc4fb597c78b34da69a5ffd675fbf0aa25c1b3dd3284dc998a80d2317509", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751275592, "uuid": "121a73ab-f4ba-4830-b608-311555ad7b2a", "comment": "Malware payload", "value": "e17b5580518a2710429c65526988d3ce91d2d694", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751275592, "uuid": "dfc9c129-ca1e-40ba-9a38-0809f1d8f2b0", "comment": "Malware payload", "value": "218305ba6bb1c70a1b1a52dcef04f416ba9551188b6b1398f158870c5594618f863acc48962ac1e047819baa9c5eec85", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751275592, "uuid": "fb8e3a12-5f24-4d49-83dc-5492cae067ba", "value": "T1ADE63356FB4AE76AE4B7823693750A5395261C984207F7031F85B12C1EB7EC09E89FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751275592, "uuid": "1f9518b7-7c69-4149-843c-d38fa84ee601", "value": "393216:JVTeMUZVLfY2FZz3WIJ8MCNQ1MroaaWdSsp2zBN66eEo:zk7pF938aWdSwkA6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751275592, "uuid": "fd32bb17-1528-4965-8e90-3c8233b65912", "value": 14516725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751275592, "uuid": "91839889-4d30-46cb-a3e9-c912ebcae786", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751275592, "uuid": "f1341dbd-c153-4cf2-a581-b7425e417004", "value": "app (4).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d34f5b3d-55e3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751309743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309743, "uuid": "08a175f0-f965-48e0-ac76-6dacb9fc037d", "comment": "Malware payload", "value": "fd51594ebe1ca6ec0134b9199fc4149f", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "Geofenced", "colour": "#BCAA6B", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309743, "uuid": "7ff940f0-1b81-41d8-a416-23d229e16c0f", "comment": "Malware payload", "value": "4afae0ed98ed2637f47f0fa45d2739baf2fe59ca3448bcb85076f7a36e0e2806", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "Geofenced", "colour": "#BCAA6B", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309743, "uuid": "439f0bf3-b68c-499c-ba31-63112517a2ca", "comment": "Malware payload", "value": "ec95175808bf48bddfba44785c24988543e35d6c", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "Geofenced", "colour": "#BCAA6B", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309743, "uuid": "48735be7-38da-4d21-a7af-4d7fa342e324", "comment": "Malware payload", "value": "36dcc50a6107680aeb3ce97326fcc8104e9d18fe0ab64c27bb3a59aab1f22a048fe529aef6d823c11c8493e4195a4c12", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "Geofenced", "colour": "#BCAA6B", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309743, "uuid": "3ad6afe1-2282-4265-b10e-d15339c5d545", "value": "T1B484A93CDA78E91B2EF0EB06CC4271B49BF5563B89E26B1E0D5F150E81845EB5E6B1C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309743, "uuid": "9aac46c4-a03b-453c-a364-da2ce948199a", "value": "768:HPHA2fjiXfNNKfjRgfjr2fjNKfjggf8ifjgf2NfgjfNjrfjK2frXfr8fj2jfjRRo:qT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751309743, "uuid": "2666bef6-a66b-4ab7-be17-db3d2fcaf557", "value": 403305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751309743, "uuid": "f0aa6441-f75f-46bc-a70c-834bf5b40435", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309743, "uuid": "67ffd0ea-99ff-4cee-a1d3-2355956d3078", "value": "fd51594ebe1ca6ec0134b9199fc4149f.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74814f4b-55c7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Xorbot)", "timestamp": 1751297558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751297558, "uuid": "ce4fc487-d3b5-47b8-a60c-4c707ca3f54e", "comment": "Malware payload (Xorbot)", "value": "d7ddb3b56cf66e6c7eb921e809347f51", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751297558, "uuid": "071edb44-f44a-46de-897d-10bc8c84c22e", "comment": "Malware payload (Xorbot)", "value": "4bffcf055e045c7a820e05cf9798c9d8c36bbf7ca6f4434b2ad2cdbf4dd0595f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751297558, "uuid": "93d2df9a-4e9c-440a-a62c-f486f9b6fe16", "comment": "Malware payload (Xorbot)", "value": "d496a01abd7039164129cf4c20172b26330646ea", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751297558, "uuid": "8b91bb05-9678-4eb0-a352-46ed38be8465", "comment": "Malware payload (Xorbot)", "value": "eab67e6e7f6c1b3abb125e4a6eedad0be33b4a1bd6b25c47052d1e729d60f5d52d5fa8fa2993e42a61083beaaf367838", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751297558, "uuid": "60371a36-23c3-4bce-9741-2186dccf8b9d", "value": "T1092221CE12C9332586D68C557EB288C0D31692C0A4C57BCCE6CC9D5C81C9FBFB49A9B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751297558, "uuid": "63238510-e11d-40be-82d0-fef7a69e5ffd", "value": "96:JXTKTKTRT2TKB4QSfhaoKukKuQKuTKukKusKuLecoKukKuQKuTKukKusKuy0rWKj:JDQQ58KJSZajkUDqGCkUDqGrQQ58Ka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751297558, "uuid": "048728d1-857d-479f-8db7-c78e9d1fd7c4", "value": 10578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751297558, "uuid": "3b3cfb64-0b9e-4169-aa92-c62e142c4755", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751297558, "uuid": "96815d21-0757-441a-aae0-6d7f4c97f511", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb76b3c-55d0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751301522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301522, "uuid": "66a76e73-b90a-45d7-8b81-c560e62fdda0", "comment": "Malware payload (Mirai)", "value": "36b75f9e75d900e133c1a248c81d5b8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301522, "uuid": "cbef2775-72f5-45ee-8e6c-d9c5b8d48957", "comment": "Malware payload (Mirai)", "value": "4c429ba34ce795e5f6d7cf151889caa9221c8fe6910b52312fe612addda6498b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301522, "uuid": "01e9d575-1199-408b-a5fd-7261a8d53d04", "comment": "Malware payload (Mirai)", "value": "c942fbcb80ec35f892dc6e4882f061d0fcd53fab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301522, "uuid": "c4c72067-3679-4e2f-91f7-08a1d7b6e001", "comment": "Malware payload (Mirai)", "value": "c6e680db2443e7ed9024979f356f4bcc76eae100f8031cc98456936b927a9d1e5b8398f1845d595cf91d5b00ca2e1dbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301522, "uuid": "bc652666-3706-49fd-b0b2-6257e7980d1a", "value": "T14203F141C8BBC68BD12F727C247D7A0FC664D63BD85548E047D8B63A88C097FAE98593", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301522, "uuid": "94fc04ae-d559-415b-b9fe-d0c8164a0427", "value": "768:W7VZQiPVyhRVtWBf4+waH5iqU0edxDGYTRz/373IzFOnbcuyD7UHQRj6:W78EtwaH5iWeBT1/znouy8Hym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751301522, "uuid": "614e288f-6efb-4d0f-82ed-93bf0828c9a4", "value": 40304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751301522, "uuid": "26a1e43f-b258-4c65-92c5-bd19ba2520d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301522, "uuid": "0771e0a3-2e66-4780-bd6b-6fb06607aae2", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af18880-559b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751278645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278645, "uuid": "fcfc6363-4b52-4019-8e5f-efe1d83fd2f8", "comment": "Malware payload (Mirai)", "value": "e07a60c9381e0f5f8fc70eb2d6f8c457", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278645, "uuid": "b19ba482-f38c-448e-acb5-271f3f6bfee6", "comment": "Malware payload (Mirai)", "value": "4c9b987b5dcadc2eba82065aff21fba9a4d8c9cdba7e559b5dd14054a579fa54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278645, "uuid": "f7e6b145-16f8-4c4b-a7f2-262346351904", "comment": "Malware payload (Mirai)", "value": "cba17064d47c524195efa594419d53988874ac55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278645, "uuid": "aa9d6dfb-f1f7-40f1-93bb-f018c307f89a", "comment": "Malware payload (Mirai)", "value": "a9edd78c6fabaa631a18328e1c479c60c8d3f5b73c5695405c1c3886e3d4cdeba6c98961ddc4720a28f8e1a3c4c8e889", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278645, "uuid": "e71ec5ae-88e6-41f6-aa0f-bdb49ebbc52b", "value": "T16F331841F8D299AEC6C4137AA73E658E3351B3A4D1CF3617CD596F2133CA60F4DAAA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278645, "uuid": "3af1b96f-5c5f-4a85-a52b-b91f1dc49adb", "value": "768:ZZygLAx5AREN20ODEFbcFVfJ+erf5swMCAhgnxJD1yxott5ieMM+fBNknfKmzyB:ZBTMQDEViZswMCAuD1yneMJVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751278645, "uuid": "ce0f57e5-b54e-40eb-b8ab-92aa186d699f", "value": 50616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751278645, "uuid": "67058aaf-b94f-4ce9-9d3c-ce96b91d3e69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278645, "uuid": "22fcd62e-7f10-430c-bf7a-3377cb432c61", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "445256cf-5580-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1751266983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266983, "uuid": "9ae27c81-25cf-43ac-bdfc-75414e6ed116", "comment": "Malware payload (RemcosRAT)", "value": "362b47cfcf2ca61584b20c442ee81734", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266983, "uuid": "76780563-d54f-477e-9226-7657c2a19292", "comment": "Malware payload (RemcosRAT)", "value": "4ca004dfecad262a46385413529cd2a6bcfe18ea2e66e7c1f59eb60629eb2693", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266983, "uuid": "26705b8d-d9a8-448c-9ed5-2746c940d768", "comment": "Malware payload (RemcosRAT)", "value": "22325375f24cf6c4457791192f3857f741027b9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266983, "uuid": "d8e9a041-48ee-4127-a109-f242798a36b1", "comment": "Malware payload (RemcosRAT)", "value": "be9695f3d9c535f9d89b142b02b9060ace0a8be99460caa56053eef47dc7714e2abfd1aab0441515cd537f50341e94bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266983, "uuid": "c5ac4fb3-efb5-42c0-ac3f-14970423e6e1", "value": "T1B8C40118368E8F12C5BB6BFA0500E071A3B67EDEA151D3564FC56CE77CB2B8A0506727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266983, "uuid": "86983a9b-0c7d-46df-a3c2-0285ad2e3717", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266983, "uuid": "c25205ec-0677-4767-b114-ad25ada5bf8c", "value": "12288:9grAOnbGeuw4cR7Gev3mXTcoyUhZ9p3iZUUVMn9zjwRMB3D1:JOnbx4cwe/mAoyUhZn3iZUgMn9zt3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751266983, "uuid": "84ee1b2b-609e-4459-b514-3a9448cc293c", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751266983, "uuid": "18c229f6-3b9b-400a-a367-c437b4a984b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266983, "uuid": "5787ca4e-2a81-49b7-9ac8-53e956a1e401", "value": "NET.CMS4006975815.pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1624319-555c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (NightSpire)", "timestamp": 1751251785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751251785, "uuid": "375ca0a0-2a3a-4d87-b8be-e0dfa36f454a", "comment": "Malware payload (NightSpire)", "value": "82afcebc49f49b758de83b3275c91137", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSpire", "colour": "#1B04B3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751251785, "uuid": "c6504a1d-4de7-4b40-b0ee-e1773897327a", "comment": "Malware payload (NightSpire)", "value": "4cda6af63873eca99b9a0b69be1c8b9c81b501339f569a30fd30394fa54da3e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSpire", "colour": "#1B04B3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751251785, "uuid": "7bc3310b-4afa-48cc-97a8-605da8a4dec0", "comment": "Malware payload (NightSpire)", "value": "96bc46719eb773b1f13b63606898d1837cbd4169", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSpire", "colour": "#1B04B3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751251785, "uuid": "d08352bb-b50f-482f-9e89-b60c0860f9df", "comment": "Malware payload (NightSpire)", "value": "36baba3608e88fc1629eda0068bbf39fd6078b3a7765a16fa17f073852b33abad4bb1ee2eef4d750ab3ffb9a98a9a759", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSpire", "colour": "#1B04B3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751251785, "uuid": "041ca06d-a883-4461-be12-c32abb14e0ed", "value": "T1C7C55A07FCA649F5C0AAE23189629153BA62BC481F3123D72F50B77D2F76BD099B9704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751251785, "uuid": "7618042c-dba2-4d4e-aa0f-ab04a1c1ce67", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751251785, "uuid": "fc77cba1-d2bd-4c9a-b003-93fd0fe69ad7", "value": "24576:+I9l4n8Jh7RqiWZ6YO6ioXqrCxrXd9k59yjQjW6Jm0cdkOVvQjfqiTChx5yN:+Izc8Jh74iDYObMrXdy5EEGVvFiK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751251785, "uuid": "bafdb0d5-3db8-42ee-b7c2-bdf13541d824", "value": 2617344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751251785, "uuid": "31951297-6065-4049-b94a-d53fd6b458ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751251785, "uuid": "20443877-360d-43fc-86a9-dcdb763808c2", "value": "4cda6af63873eca99b9a0b69be1c8b9c81b501339f569a30fd30394fa54da3e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f03023-55b7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751290909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290909, "uuid": "4325eb35-3ac7-46bb-8695-5b7252738c06", "comment": "Malware payload (Mirai)", "value": "ed4f216dc8bdd0becd132b1e717cf133", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290909, "uuid": "25f3900f-e92b-40fe-bb19-769f5177876d", "comment": "Malware payload (Mirai)", "value": "4cfb18a22cee9e5fa23f9626c2a38b4b9e5576cb81cad1133a1d1e45383d5499", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290909, "uuid": "fa97492d-0523-44c0-8f92-4d4c3ecf2c4a", "comment": "Malware payload (Mirai)", "value": "fa6adad8270aa71cadd15bd420189fdac5767465", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290909, "uuid": "c15fd85e-13bd-47d1-a0fb-db1798f53413", "comment": "Malware payload (Mirai)", "value": "f45c08d8d6273ac263ecee6479b67ce0edcf928d3cd579faa8d0992cbc79c0b26ac2fe8cc126d01db8ccbe3d21cef93f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290909, "uuid": "59474050-9f65-44a8-9114-f7723af202ac", "value": "T137533B0BB94580FDC1ACC178137BB53AC572347E4239B2D667D8FE262D4AE610F2E984", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290909, "uuid": "d7c166fd-dafe-4e74-ad24-d94511fcbbef", "value": "1536:JXajQ6OFpQFEMR8TwzJT6QoNjTOVmtG4:JH6OzKEMR8TwFNeOVmQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751290909, "uuid": "79908396-6f40-46cc-9b56-46571e55943d", "value": 62464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751290909, "uuid": "b9aaeba6-d0e0-4d27-8914-c98254fb1b4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290909, "uuid": "7081a4f1-0380-4d6c-a875-56fc57096440", "value": "mirai.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0ef4824-5606-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751324745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324745, "uuid": "36698cb4-097c-4142-8c92-c8a8eb998da5", "comment": "Malware payload", "value": "a5b38d454d2c95fa8e13a6cf86738707", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324745, "uuid": "e5f2da74-e0c1-444e-afa5-146608bf2e5d", "comment": "Malware payload", "value": "4d1e2bcf3d93ae96b0b733e310863df656fa91fa8f5cd914f5882d083c17c0e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324745, "uuid": "447ff702-c912-474f-a87f-5d0e0c95f300", "comment": "Malware payload", "value": "426afb1db503d0f6a5a75eacb321638cd7683d97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324745, "uuid": "8b2d64f8-8f0a-4a02-a0db-2fb22c094955", "comment": "Malware payload", "value": "efe32aeb364fb7baaa4d2d6c955c2d8ad5dc7b132d6349fbb92555a225617a50f2d0ceb8e195d4c60299df69ebfd4fed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324745, "uuid": "44140772-1a3b-4970-91ca-4eb537a25c07", "value": "T157B401CE9520D295C4B02D33C57BA2F282AB6D3609596E1CDDD8FF6B2CF67450638B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324745, "uuid": "67c14b35-f537-4fe3-9fa5-695e01919fcf", "value": "12288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751324745, "uuid": "7ebfffd7-1219-4530-b212-b04f076c02e4", "value": 502120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751324745, "uuid": "afb3c5f1-1e4a-4fb8-ba82-aee376921323", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324745, "uuid": "cffc045e-57ec-4942-98ad-800180f7440e", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "151b3e6c-55b2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (NetSupport)", "timestamp": 1751288379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751288379, "uuid": "d9a2c43a-ce72-422d-bb29-b2e6939af141", "comment": "Malware payload (NetSupport)", "value": "0d924e99c925ab7a5526a18b189aa062", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751288379, "uuid": "a923ad06-8171-41f0-a50c-ceef1f602a54", "comment": "Malware payload (NetSupport)", "value": "4d24f57dad98ef27fb063d020fc7a072201806d6d1d0b4b431b59b28d6a69261", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751288379, "uuid": "a428c679-2316-4203-84f0-67eb6fbda0d6", "comment": "Malware payload (NetSupport)", "value": "e278e8c7d3878e035b0ff8d8d290e2ad629e966b", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751288379, "uuid": "87b7a03d-8ade-4943-b5a6-3a7c7db1d96d", "comment": "Malware payload (NetSupport)", "value": "2ac6d7d343f8ff26aea6913d3456f1e19e0b7bac231f3cfa4e19e00f0fc0826fd22a9bfad90f0160621e8c1a24153f08", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751288379, "uuid": "2d0ad195-2091-4f8e-92ac-e0e090c3bcbb", "value": "T176A66B788B84975EAE6F2A07E078572E6BF37F66D0C271FC46622707266FC046639C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751288379, "uuid": "2fc96a86-0115-4ae8-8604-b65d11f12475", "value": "49152:qupCfGXEAcIqi5togNKcJ5/MF9VBzlA/MjBoVzkHQ3CvhamxCmd8:h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751288379, "uuid": "e0505a96-cb81-432f-99d3-47816439480d", "value": 9715094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751288379, "uuid": "eaaf7a4f-5e77-4861-8159-445f0061ea36", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751288379, "uuid": "e22705c5-e304-46a1-9c6f-fa092b36d020", "value": "A3f.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d95af0-55dd-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1751306870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306870, "uuid": "b668c938-a229-46d7-8ed9-e0a4d7631cd8", "comment": "Malware payload (LummaStealer)", "value": "e51ab90ecd3eabd790ebfc354f456dca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306870, "uuid": "4888549b-e207-44ee-aa8b-9b228d27d0a1", "comment": "Malware payload (LummaStealer)", "value": "4d42c44b8dfbac53f73459f7cb507dac0d24f34c5abc6389c7133c648e4b9f80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306870, "uuid": "ff4ac487-9636-4908-aae2-125e987547ce", "comment": "Malware payload (LummaStealer)", "value": "d011a6d8f3fb3821e3b81033174354f1d43a6b59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306870, "uuid": "36e9168b-3746-4600-8d0c-14cd85780120", "comment": "Malware payload (LummaStealer)", "value": "24671279917ce6f37571f89ffabe201b4763c84b46f7def15a51724a7ddd1650a298ecbd83856a643cff4b222e0ff367", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306870, "uuid": "7d3ab2dc-a998-473a-addb-89c1bb609dc9", "value": "T15A85337D3EE09A23C3DDCE7E4433E7A1F62AE02053179534371926954713AA7A24B9DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306870, "uuid": "70f681ab-83e7-42f6-966c-11e66c25134d", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306870, "uuid": "f9725a76-8804-4be9-90ba-11329ebd078d", "value": "49152:ybndYZxEG9Mci6hC3m6BEimXRkIlCzKKRf:qdsEG9McnC3mmaSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751306870, "uuid": "da2d5102-7292-42ff-a0f2-d1824632167b", "value": 1874432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751306870, "uuid": "365fdd11-1a3c-4a96-82f4-f7057a20d7ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306870, "uuid": "a78b93dc-64fe-48e6-953b-f1dfc2900807", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "585eca58-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751243824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243824, "uuid": "a072ee95-0174-4905-9d6b-44224225c676", "comment": "Malware payload (Mirai)", "value": "b6ac1787ccff60c06924c5d544382974", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243824, "uuid": "f35ce050-d772-437c-a982-6938316aaf77", "comment": "Malware payload (Mirai)", "value": "4db93f075e70a9d9d90cf89c2dbd63170e165d342886731fb9add054c6262c6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243824, "uuid": "bd188831-f1fa-4f27-8459-f4899a738752", "comment": "Malware payload (Mirai)", "value": "16ee6d46b6d11c043e2b64eea533c6558348c188", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243824, "uuid": "31ae6b88-70fd-4d08-89d4-272d5d35080a", "comment": "Malware payload (Mirai)", "value": "0a76581ee0877676133d9c745622e16c5cd01b2eafebeaac26f110eed7e472799c66035ce519f9465f4bbd7a9ae2aea2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243824, "uuid": "80b45b34-5ddc-4585-8294-b1a938f78db8", "value": "T1D8B2D03C1B151B98DE1EC0BD839C1B603CB82F2591829D4B720BED97AF964747463BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243824, "uuid": "572f8ad6-e7b4-4e82-9262-bdcb6d2cd27d", "value": "384:neD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuibbmdzJgGlzDpH7uNj1JA9:neD8ZSWvZHZbs1row697qohQvg93izJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243824, "uuid": "82ba6d4a-19ed-44e0-b6f8-3d798955e580", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243824, "uuid": "c1a01869-769a-4c42-820f-67a4acbf7c35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243824, "uuid": "57c86707-75c4-4f99-b14a-1c018bfdf191", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae0fe649-556c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751258571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751258571, "uuid": "4bfb6397-920f-436d-96e7-2987c596c648", "comment": "Malware payload (Mirai)", "value": "ef80f94de84d77b3cef00f8442328ced", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751258571, "uuid": "3fb47b64-bad0-448a-be62-11bbb6427c1f", "comment": "Malware payload (Mirai)", "value": "4dce5f6b955b2456cb81f5625afdba3e8ba361a8d7e6597de1083721d74cc16d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751258571, "uuid": "d3233f73-2c75-4768-8b0a-b77d61baceac", "comment": "Malware payload (Mirai)", "value": "ac754acd64725ec82d81f9f601e907563774c181", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751258571, "uuid": "a5ba1f5f-a703-4c21-b180-f2bc8d8e5214", "comment": "Malware payload (Mirai)", "value": "6794407712e47b57f9c4e46e3c2655258a4f1d95c075a6d85aa1553e87f5ffd4e1109a149f4dd283bc72eea92fc69818", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751258571, "uuid": "1a722fce-317f-4548-af3c-258f93ed37f4", "value": "T121B39E9BF24710A2C8634AF007CB4F9E2E6332819F5BA8E76C5D257A18750DF5906FD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751258571, "uuid": "0890a9d4-e606-4f82-99c1-ba73c2c12cc5", "value": "1536:l8ytw9/wQEPyNJMKqUDihuyVpJqPRxVvXvxGgK/LWf:GTmvKNJMhKiQWJqJ4gKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751258571, "uuid": "710cffd9-2483-4f7d-9aae-0243c53385c2", "value": 116100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751258571, "uuid": "8b05db2b-2879-4734-bf77-a81032664e59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751258571, "uuid": "06d3f76d-5784-41bb-b625-80b3bf712c59", "value": "neon.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "455ef3ed-554e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1751245510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751245510, "uuid": "6b0d7315-39a2-4fee-90b6-4227470bb67c", "comment": "Malware payload (ValleyRAT)", "value": "58a488036c768cdabb71acc0b3ec3ad1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751245510, "uuid": "96f062f8-16a5-4e04-ba2d-ce954d5434fc", "comment": "Malware payload (ValleyRAT)", "value": "4f65b6d7c7b50956f0f9d57b93d7ad22758c0f737f81cca642fa8902a0e355d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751245510, "uuid": "4ea66aa0-a47e-4ac8-ac4d-e46ce429a117", "comment": "Malware payload (ValleyRAT)", "value": "0e3b46261390375349fa1cbdddae9a233cf7e346", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751245510, "uuid": "502d1f7a-9806-4ad1-b72d-a7c988ad4afc", "comment": "Malware payload (ValleyRAT)", "value": "d8521b74c27479ec7302f163043264458b5d3662733eeba029262f43c6da454e3b435d528394766bbbe6969cde3b6dd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751245510, "uuid": "7a0ef512-1b95-4848-a79c-a8dbb4fc2498", "value": "T148B57E783A958863F62330B2951DC6B296551D328E3A1ACF3B88793478709C7F83657F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751245510, "uuid": "dfcb798f-e721-4a11-b8b9-0509aade690a", "value": "601249a9f0b3a5dfc71a8b247e4b7d62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751245510, "uuid": "c75b9747-7238-4322-9d28-a8baec6f2bc7", "value": "49152:kypBjPzWnGtV5L1cxFjTX4GNLwJTMTDS7+yuxwJOec5gU:hzWnGtV5LOxFjTX4GGJTMTRyuxwUec5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751245510, "uuid": "9175c8c2-8898-4f94-a939-2ed569b94e95", "value": 2458624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751245510, "uuid": "98901e19-e85f-400a-8e2b-51f4969ee257", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751245510, "uuid": "811c752e-04ce-4e6c-a854-0e5c8b0e8e48", "value": "58a488036c768cdabb71acc0b3ec3ad1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49e13b5e-55b2-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751288468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751288468, "uuid": "4c8c40d0-d1ac-4e35-a6a4-e72cd2f81a19", "comment": "Malware payload", "value": "525c0458bfe0da380a4aceeb20cf9f75", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751288468, "uuid": "5c71748b-bb81-4c02-bc69-e843698f5ff4", "comment": "Malware payload", "value": "4f8211d757f5e212c82e94c875839a9199ec21193d04418e7f7da1e7e34b06ae", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751288468, "uuid": "04ef00c3-fc0a-48ed-9873-8b1a0763b12b", "comment": "Malware payload", "value": "d4c6500d5a33ad78b1907e56ab11f1919fad005c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751288468, "uuid": "ad22b958-5eda-4d71-ae8a-76a1b09aede1", "comment": "Malware payload", "value": "7c5a15bdb4558abcb6da3df148a9e45045fa7cbe98061ed40d418e8031d2710c4444b8389bee7bb9ced5a65c53df165f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751288468, "uuid": "4818069a-cb23-472c-8b24-37c8d0017d51", "value": "T1F6942273A2CA3C3CEAAE69F7120370B67EA52D570B753259A01B1BCC591052FA2514FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751288468, "uuid": "9644ad8d-9602-4844-89e2-d1ad5ed59dd4", "value": "6144:1NI9rxwocRAYTqlHqOLie/b8Rc+JXHVGsA5MTwFOH5DEjdlb/AsBagpE8NZ:1NcryocRHIqkierGLpSlMiyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751288468, "uuid": "49aa47cd-b0f6-4e83-ac0e-af488edd50c9", "value": 415514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751288468, "uuid": "a640672c-2c20-4c65-8948-63b273a9755d", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751288468, "uuid": "09ef3b1d-e535-4674-9699-7289ba9fb3a0", "value": "Q25081Ar1.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a731d21-55d9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751305299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751305299, "uuid": "4d2aa0c3-3ba1-45cf-93ad-4f014b4bce01", "comment": "Malware payload", "value": "7e6772d1f721741a177edcd467682ad6", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751305299, "uuid": "1cacf624-01dd-47b4-a701-4539a415d4c7", "comment": "Malware payload", "value": "4f9f55fa6fd5601245068c412d1d458928de826e6d02362c1ff62ca6bd8891a7", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751305299, "uuid": "241b9776-f0f5-4ff1-8f62-7066c3ad5394", "comment": "Malware payload", "value": "7c63da94c2703308677f81d3afc2c7bde70f1abf", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751305299, "uuid": "947bc736-dff9-4a4f-a286-e0a45fc8c733", "comment": "Malware payload", "value": "d328efc8c965abc7b97d5c867c33cce2a6de285ce001f0e6a8b713c1ea859a63fb0a5d32f9f129bc1ed6a5285b7e40c0", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751305299, "uuid": "f8f0fecf-0c13-47ce-853f-020887377d4f", "value": "T111F42357941811EFE4C2BE3B045EDFE932FE39D086654DC47119CBAB603D6FA2898A60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751305299, "uuid": "742ede58-621d-4d38-9300-dda6126e6f5c", "value": "12288:NQjSYN2/ZYobaXtkolbVJ8Evohy7V+IOF86RHxZBI5HvLCPWhcUqs:NQOHqoa2oZ3YwYP1HLmHDCPtUqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751305299, "uuid": "1dd9aa03-eb55-4f03-aa65-105b8c760883", "value": 788269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751305299, "uuid": "c3e1d5e9-afec-4510-a195-14b10fcaccdb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751305299, "uuid": "44743145-b99e-49f8-b0a9-57b210013876", "value": "OUR REF RET-402-1438.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f0708f-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751291231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291231, "uuid": "b6bdc9eb-2bad-4adb-b72e-80964d3fb266", "comment": "Malware payload", "value": "c8e97ab9cfb8c1531e97a3858ae3090f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291231, "uuid": "a574fe6f-2df2-4862-8322-f13f507fa888", "comment": "Malware payload", "value": "4ffa9955c47a37d269fea808caa48990188432cd1ef139d631ee08484b5adce3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291231, "uuid": "80cec91a-c2d7-4ba6-af02-79d819845a3a", "comment": "Malware payload", "value": "cdf6250ee24003a6af05ee6562513aad71ce6efb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291231, "uuid": "91b2d589-672a-45b5-955e-225190b7e752", "comment": "Malware payload", "value": "63f23c8daeb4d63c6ca7a8993b260f6400cddb572c963f5fef282006e4f02444c007270386a5d77b5d82e7c858865e0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291231, "uuid": "4d12a0e7-421c-498d-8447-0870b3b1ee98", "value": "T160E58C53BCA108AAC0AE96368D6681927B72BC454F3123D73E90B73C2F72BD49D79744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291231, "uuid": "a100e358-a667-48ee-aab0-a22e4d11cca6", "value": "49152:WEvqUpXonIpeUi4Q6L4ut4HIasDuF9IT3ddtQsdlQ:WEfRoHBt0T3TisHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291231, "uuid": "7a1d19a5-c542-4237-856a-5f1d5cf2f90c", "value": 3115037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291231, "uuid": "f9dd8e07-dcbe-4010-906d-a4a57d68d49c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291231, "uuid": "aac108cf-3fdf-42d4-9270-7066ba260bb4", "value": "scanListen", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "425e8b9c-5596-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751276429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751276429, "uuid": "59ea2a2c-f99e-4890-aba4-7578de93e28a", "comment": "Malware payload", "value": "288c99051f6b0ab15e36df2f94b5269a", "object_relation": "md5", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751276429, "uuid": "802275e7-25a0-4b6b-a1aa-5106b4b71ec9", "comment": "Malware payload", "value": "50cc86c28b3d8669e37b00a4e29c1cc2ea5fa4146a8aa8f33573dbed9937cc44", "object_relation": "sha256", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751276429, "uuid": "b646c401-d316-41f6-bfc2-06ffb1083cad", "comment": "Malware payload", "value": "b48f669519ed28f8bea3ac87de268a4d03aded96", "object_relation": "sha1", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751276429, "uuid": "653fab58-b6da-48c9-ae77-ee60493e6d01", "comment": "Malware payload", "value": "99f54107c034465dace6bc09ff4159eaa74be65ad9df32b7bb5b507a6781d89e6fb3a45778efbed6e3addd2cf719e46f", "object_relation": "sha3-384", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751276429, "uuid": "6c5be0c2-912c-44a9-a1fb-54d0ccbe027f", "value": "T19EC080444745C157D110350792D1FD457C0EB55908D3DD48F285D94F1881CD1C485F8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751276429, "uuid": "2e6567f1-0445-4920-97eb-1ea301a90cfb", "value": "3:HRAbABGQYmkBUGL6jVNnLXgNVSsWHKGmO25YdimVVG/VClAWHyn:HRYFVmk+pzgDSszGE54vVG/4xHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751276429, "uuid": "0cdae32c-5659-44a4-91b6-13fb382a7d25", "value": 176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751276429, "uuid": "e96965e7-e941-4726-9804-8cafdc3dd4a2", "value": "application/x-mswinurl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751276429, "uuid": "8704e36f-9a62-44a0-8d40-e10042c49d92", "value": "ORD739403847.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0bf630f-5603-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751323483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751323483, "uuid": "be7d66f0-17c6-4209-89cf-6a93e94e394f", "comment": "Malware payload (Mirai)", "value": "cd9f81057664bae14076a4a388c216dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751323483, "uuid": "f3549815-b9e4-44f2-ba1b-195c3af7d307", "comment": "Malware payload (Mirai)", "value": "517690b42a7fb2c819f1249facdaf027b7208983e471f1245e47b4912913ad83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751323483, "uuid": "f4836048-6d99-478e-8490-257ffcf449ec", "comment": "Malware payload (Mirai)", "value": "785ad315997f467b5786264aafd842febb451537", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751323483, "uuid": "60c4425b-c6fd-4074-968f-be80336d245d", "comment": "Malware payload (Mirai)", "value": "8b36395e0375b08a25cf090d8205443de1b47417303084b9470f71b4e69414c2943e64cb5c998cb61c8aabf1e39a82e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751323483, "uuid": "467c8de8-de68-4ad2-9b82-58d9ffd7d665", "value": "T1DB63C716BF610FF7ECAFDD3749A91B05298C641A21A83B357934D818F64B24F19E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751323483, "uuid": "5849a306-9246-4dc1-8e32-5798dee01bb8", "value": "1536:3Cz1umlN5hlEOkq7ozci7nbObCQZgw6st:381umlN5h6OkQbCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751323483, "uuid": "8b4abb2f-aaca-4033-ac50-62dc9ff544da", "value": 68656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751323483, "uuid": "f38d4607-1c88-4dd5-a50f-5bb6184eac7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751323483, "uuid": "9d5e27e0-76e1-4932-9a55-c6d091068e40", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc55b3e-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751291237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291237, "uuid": "1ab6dded-a8fe-438d-acb5-4fde3c3ca2d5", "comment": "Malware payload (Mirai)", "value": "1c0c2eba33773e498d08c7d47220a3d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291237, "uuid": "08993781-545e-40fd-a5c4-0e6cfb720f88", "comment": "Malware payload (Mirai)", "value": "51b309d42247df6374fc9eefdc177d5ebf112bc8e16b1a92a66ea41008b8dd0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291237, "uuid": "5d089eca-d377-40fb-8dbb-25e65ca18e41", "comment": "Malware payload (Mirai)", "value": "894fcaaf2cb450234ed71876616e08a0f9c8f155", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291237, "uuid": "0423a08b-f7db-4158-b687-76bb533643a5", "comment": "Malware payload (Mirai)", "value": "bc1ae83d44040afeeefab16ec24519db89838542ca3b2aae73bfeee9e7ef52bd6b9e9e174fe37dbb1728ea3943b351c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291237, "uuid": "fc486410-d08e-40c7-85da-bb685b294e9d", "value": "T1BA83094AB9818F01D4C622BAFB6E418D33136BB9D3EE7102DD10AF5067CA99F0E77552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291237, "uuid": "32fc534e-73b5-45e5-ac33-987653939887", "value": "1536:zFnLATdWv4BHxdQAZSLDr5AsjdVd8wDcBClM95TuPvOeJWmGamB107zNlKtiX+Zz:lAT8vTA+vmsjdVd8QWPTunOeJWmGamBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291237, "uuid": "48125bb4-2c68-477e-ac7e-b4dfe93594e0", "value": 87508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291237, "uuid": "30303174-ce05-42c0-b01a-4395bf63271b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291237, "uuid": "9891b564-e035-45a0-b4f3-7b1defa13641", "value": "mirai.arm7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "390d90dc-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751291875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291875, "uuid": "9894873b-4276-4ca1-b7ec-19cfcf004901", "comment": "Malware payload", "value": "140d60e61872d9673ac65ac2978f6e48", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291875, "uuid": "94ba359f-cd90-4498-8213-8a4dcbd13ac1", "comment": "Malware payload", "value": "51d8a35db0f0e4641ed1d8f179d9bb7fa70275eb1cee695266f473ae51e0cfd1", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291875, "uuid": "d30569aa-4488-4e60-a6ba-8facdd3d1ee3", "comment": "Malware payload", "value": "0da813f99f57a2568f04ea61912eb47b249bb2fc", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291875, "uuid": "74e4f541-d276-4f8b-aca8-d90611d5eba9", "comment": "Malware payload", "value": "1d7974bc01cc30ac6b601c26975fe414946abe01364e8863c4d7909161989f338e241a9334e5d8cb3f60cf8862422f53", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291875, "uuid": "621b2fc9-6106-4c42-970b-3a26fa426904", "value": "T121140281CB6A3F8DED794AFD0CBE1E4A4C8E6E323C21CCF5D95F314B42196914562A1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291875, "uuid": "67a9731b-14dd-44ff-b9c4-9dc3c346ee1a", "value": "6144:+xcIE2AKGoTDsPO0tAKnp3MMQ3m5Bpkj2DBzvSHXVQCZgs:+xc12HGPO0SKnlMRypNlz/rs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291875, "uuid": "b3f366cb-3122-4398-842d-03300319cde4", "value": 202541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291875, "uuid": "b0134411-2811-40a0-9377-150ea56c2990", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291875, "uuid": "af159881-93a2-4fd4-ba4e-07ecf15f2a02", "value": "PO#335395.LNK", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06389da2-55e2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Vidar)", "timestamp": 1751308970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308970, "uuid": "260001c3-262c-4dc3-a428-e1d6f3c04cad", "comment": "Malware payload (Vidar)", "value": "600623ba27769989d981904debcc3774", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308970, "uuid": "1caeb7dd-6abd-4a66-8758-e0a6073383e2", "comment": "Malware payload (Vidar)", "value": "5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308970, "uuid": "41dce954-c0be-4ba6-870a-e9514130e10b", "comment": "Malware payload (Vidar)", "value": "08b03982c2c7fe5b35f1379bca1e8832cb294764", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308970, "uuid": "10c912b2-a3b4-42ad-a2d8-25733d256faf", "comment": "Malware payload (Vidar)", "value": "cb73f3ff91bbfa649a741cbd6b07dd9920aa54708cd28e45ac48961f88285a0f1b4d9940efad0ac708a34afcbcb79a2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751308970, "uuid": "637815a1-d7c0-4a90-94ad-47a6d689afd0", "value": "T18E25D069E251A3E5FD2640B94451A246B472B937C2382FFF93A0E3339F07BD41E2A754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751308970, "uuid": "27d3f245-5ea2-42a5-9457-6281136efeea", "value": "a466125a9d0f2613cec3e55975386798", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751308970, "uuid": "d5974ff2-8569-48e8-a5bb-cccd7aff0965", "value": "12288:G6yQn1ME0VKFY8eoVEaXltnHGsdCBh46dV51satxZ7YT928nIpSm8satxZ7YT92l:puE0Vsb8ImfhRsatx428Issatx428I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751308970, "uuid": "eef95e79-a37f-4815-9ff7-f016c390b06f", "value": 974336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751308970, "uuid": "af7d58d0-777c-4ada-b0a0-e52c31a1a8bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751308970, "uuid": "37a7eacd-a877-4abc-9e10-650b4ee984ce", "value": "SecuriteInfo.com.Win64.MalwareX-gen.28071.20029", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f6eb04b-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751243809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243809, "uuid": "fa1685b6-d303-4e44-8a33-fda7da953e63", "comment": "Malware payload (Mirai)", "value": "116c0bb2b6387a6e0d4fd91d86c65374", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243809, "uuid": "408a8b69-6b18-403e-97f6-a07cee0c7912", "comment": "Malware payload (Mirai)", "value": "52ff92667d6c46fe09609ab9b1a9a3a17ac7e51d2cc13c2c503ee94b78de77a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243809, "uuid": "242e624d-6d18-489b-a5e3-e9ce4f6f655a", "comment": "Malware payload (Mirai)", "value": "f0422f31cbfbd4f341a59c06668164a45916e27d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243809, "uuid": "be36f08b-90c0-45c7-9512-a954d8f40613", "comment": "Malware payload (Mirai)", "value": "a8bcd5efae7b55ce1c0b65c37b3b0412de6eb6488d61c10bf7c8f4fa6ddf72601605475975ddb9bb4fe998942b7ec71b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243809, "uuid": "c3cf22e3-fa57-4bd7-be39-c32178baeb3e", "value": "T1DFA2E119BF28828BC832293544E9E6D61353FC71F2ADDC492940C11FF5A37A96874F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243809, "uuid": "7f4c47e0-e08f-4635-99fb-810079b5ac93", "value": "384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkfaHhib+502F2vwA9dWuMW21bAK1oTw:x98o08kxofBE+ZkfaEbp2F2TWul0c5Qd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243809, "uuid": "dd939511-37fe-4b81-8645-5c4a501b4987", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243809, "uuid": "c7b639ac-156c-45c4-8f5b-6e1a5fe7762d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243809, "uuid": "9369e50b-0a68-47a4-846a-55dd4c1eaab1", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be48c08d-55d8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751304984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304984, "uuid": "56da54c6-128d-49ff-a24b-e12ebbbc9b70", "comment": "Malware payload", "value": "91623ca21fe3155d1442f0e3cc1365e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304984, "uuid": "67ce39c9-5d86-4a94-8006-a6e11694acb4", "comment": "Malware payload", "value": "53240973a82a76ff4d5ffc7c7fe48bd0be5538e8bf017639944b26aa604b3bc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304984, "uuid": "716c853c-b70b-4ff0-b63b-6fe481cfa4ea", "comment": "Malware payload", "value": "fef4f88e3941a9a94af936f16ffdd3da61db3a84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304984, "uuid": "b7968b6c-2145-411b-82fb-0c3f8d72a690", "comment": "Malware payload", "value": "1c5397a667944d1a11f48e2f997288a27475772c944eeb992569b85442c1f237d3efef41f90eeaa7e47a7c5aeaca8f78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751304984, "uuid": "cd3b893a-0bd5-4fba-ab6f-5cbd7838add0", "value": "T1ACE31867E94290B6C06D897C82B2490997627C500F5EF3DB93D0A66E0D1A59FBF37332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751304984, "uuid": "602c4b5c-1fe8-4339-8d77-1fdf591f8108", "value": "50176b8a2a360aea700bd1b9d5cb134e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751304984, "uuid": "1fb5a11e-1b8d-42e9-845f-fd9ed9a856f7", "value": "1536:5cEiTw7vZF9pEmTuYUzgDawjERDO13t10Y8pFbtd08Xfo2GKQA:5tiE1F77TlPBMW910Y8pFbtd08w2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751304984, "uuid": "b3d6ea53-e6fd-49cb-a1d2-07d8423b2246", "value": 147968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751304984, "uuid": "72d9008f-9942-4537-a79c-53623a47c3cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751304984, "uuid": "4eabef42-495f-4f3b-8869-ac2d9e01b868", "value": "GSpots.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c7f403-55a2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751281592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281592, "uuid": "962aa7aa-7a10-4f0e-81b3-d8012391e8c2", "comment": "Malware payload (Mirai)", "value": "75bb9e3706c7b18e2d44215228f8c2d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281592, "uuid": "6c6611c3-1d43-40c8-a56b-78c4c72933f3", "comment": "Malware payload (Mirai)", "value": "53c3bd5128a2e671cb4fa4c9a5911e5c511d390de71bed3458be531332dae12b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281592, "uuid": "a9f6bbbd-5acb-4acc-820a-b7a3e6184bad", "comment": "Malware payload (Mirai)", "value": "8bd66b33c70fc9db0757c1d18d4692e339c24d24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281592, "uuid": "0a563d01-401b-40e4-bcf3-3355d048c93e", "comment": "Malware payload (Mirai)", "value": "dfcbca6a09e446a672c45ecc89298c0f8650757bafda37e2b0c8275afe3678c75ca0b3bf3cdca02ab784bf4edfd33c6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281592, "uuid": "b367b1f4-ee7d-43f0-967e-1a604410096b", "value": "T17103E0FB9213EABAE926417108586BECF0136CE66C431B530AC1B0FD1CBB799A591F50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281592, "uuid": "1fba6598-9afe-4a01-8b7e-8acdfc9dcf5e", "value": "768:higiFkZGBiU/xjQhSGJP9kzPmIKVuhj20VGeYyx0Y9:TZGNpkhSGozsVOj20VJXx9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751281592, "uuid": "50a4512d-577e-454d-9f2e-b177b31b6f24", "value": 40108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751281592, "uuid": "6cee2174-56d3-4a81-a6c4-ef422da2e27d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281592, "uuid": "e441eeb9-6fb0-45f9-b60c-d14da68ea126", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31fd1583-556f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751259651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259651, "uuid": "4e69189d-4bf4-46cc-94cd-637a1b64cb3c", "comment": "Malware payload (Mirai)", "value": "ae7b2cc6945ba7d0e7ec7e2cd3551883", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259651, "uuid": "5da90cd9-6f5f-49c3-988c-10d2d5c68cb4", "comment": "Malware payload (Mirai)", "value": "5405d5350bc6164d152044a5733218a72ccadcc26313af3d805cca6a6fcbcf5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259651, "uuid": "5ed3fd9f-6669-4656-b3c7-7ac5a6828235", "comment": "Malware payload (Mirai)", "value": "56c5e695fcf56c9e9c4207376c8ddf1f375bbdee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259651, "uuid": "af702d1a-2e6d-41fc-b21f-f27d76b7deba", "comment": "Malware payload (Mirai)", "value": "68c8b52e9e6d640d860f2a6dd8a481aebfb7291a02f028bb10dcf625ae6ca6b3777e38b9174b28fb0caa0cd3601fac3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751259651, "uuid": "56ef8c2d-bccb-4a13-98bc-4530d4ce1a0c", "value": "T15CA36B1A74C2D9FCC865E2B567DFA525CD20F36C3230B86E2384FB5628AC8613F5A5D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751259651, "uuid": "d687d213-bfef-4d81-837e-9617a9900ac2", "value": "1536:0376URzufZWT9HWJb4vvxDbZ+d1119kVDBbVUv3FxM:0376URpkJb4vvxDb01119krbVUfrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751259651, "uuid": "46861e08-731f-4b49-975f-d27a1b5a062c", "value": 98040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751259651, "uuid": "f95231ed-7c6c-4219-bfb6-2b7fd6c57ea7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751259651, "uuid": "c4deffeb-6b12-4c94-bb33-24c178227ad7", "value": "rondo.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76c295a4-55d9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1751305293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751305293, "uuid": "90c15094-55f1-4135-aa6e-ec426de64ae6", "comment": "Malware payload (SnakeKeylogger)", "value": "91ec9f9258d3e7be89c919e89c2240e9", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751305293, "uuid": "0530206f-a351-4396-a175-19ec9829f95d", "comment": "Malware payload (SnakeKeylogger)", "value": "54be816c4ffe69d6d52950f885f20f9566f6b209c479e01569af6ed6d641c91e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751305293, "uuid": "700677d6-0d55-40f2-ba40-d6ce9b19974f", "comment": "Malware payload (SnakeKeylogger)", "value": "e08055459fc9b9209b3da8cc2c652ba131502049", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751305293, "uuid": "8bbd678b-b775-4366-9566-89d9171e860b", "comment": "Malware payload (SnakeKeylogger)", "value": "c69fcd5f47128f6a845cc751e9dceb330cf94f230733c757cce62a94469b82f78d70538848fec48505a8730c98e62f0d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751305293, "uuid": "059d37fb-b490-4844-b6a6-a4b3327c2410", "value": "T1F7D4233B7246414CE76E4CA63D4252829F8D898E32F916062829F0594DDEDD74F8FACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751305293, "uuid": "ac609f69-db76-4681-a683-503551071295", "value": "12288:1H0/f9vrPKbTkaZOZ2SzO9kTNPKhRmebx5w8o6Gv60:1QxPKbT32thPGvx5w8o/C0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751305293, "uuid": "7c44b8cc-8296-444a-9869-ae910e9a584d", "value": 629108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751305293, "uuid": "a22cb19f-e0c7-455d-b9a8-539263d62f64", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751305293, "uuid": "75242b18-38fb-4edf-9284-78e1d721a55f", "value": "Order Confirmation 3727353.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51bc1f57-5580-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1751267006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751267006, "uuid": "6b4dc480-ea3d-4661-825c-8f003cbc54a1", "comment": "Malware payload (RemcosRAT)", "value": "5ca4abd0007c8c14893c685857389d7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751267006, "uuid": "5129e9ab-eace-4f70-97b5-7659a8d7f229", "comment": "Malware payload (RemcosRAT)", "value": "5548d5924c918833871e6e6d4d8d3c3647b10907a7618588f97d4d029671de67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751267006, "uuid": "80e77f93-9472-46e7-b9fb-ee8515fabbd5", "comment": "Malware payload (RemcosRAT)", "value": "675102efa1d58731e078f12f1f377f9fb2455039", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751267006, "uuid": "2446b2b2-0b5a-482c-b046-80f426880794", "comment": "Malware payload (RemcosRAT)", "value": "e0137f31909d861578f37e2e283cee8c9fa017e410e7f73ea6e691b443a9fcec9f1ac4d7c9f0e597d5d01e9c83ebc7e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751267006, "uuid": "24fe69d2-ee88-4a71-84df-17d9dfcd339a", "value": "T1302502927115DC83D9AA47F20921D1B403F69D8DA825D28A6EDA3EDF31F33132852F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751267006, "uuid": "d0745a9b-9203-4fd7-94f4-2911ac935c57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751267006, "uuid": "ee1ea4ba-5827-4673-b987-ff6f3e424ac0", "value": "24576:xN0ZOMIfb6hzmjROwbqR0TbTP0X/rs2rDnqJ6RuWjbv:xNlfbkq8w40TbT0X/rBfnqcgk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751267006, "uuid": "d46e40f0-58ae-4dc0-85f7-575e1842b939", "value": 1010176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751267006, "uuid": "26643ee4-4899-49f2-af2f-93c458b55ce7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751267006, "uuid": "4932500e-1b86-4383-9752-05805ee17e55", "value": "UTR-CMS1292506520425.pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5efffd51-5590-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751273900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273900, "uuid": "079d78a4-6449-4446-84fe-531dfbdbe7db", "comment": "Malware payload", "value": "04817431aedf7116845f651ecd597aca", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cisco", "colour": "#C812D6", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273900, "uuid": "a2483caf-4bb7-4697-8115-d8406109e7f4", "comment": "Malware payload", "value": "561edc0b90ce0e3deb11e2d4aecca1e674702da328c2098852c7d11928df18cb", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cisco", "colour": "#C812D6", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273900, "uuid": "72906179-a97d-481e-b32c-4e9ad2acaa87", "comment": "Malware payload", "value": "928e16059cad7d76a95f1fff2c61c301364a4491", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cisco", "colour": "#C812D6", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273900, "uuid": "1303d89f-97a1-4f41-a65e-12ef940d6176", "comment": "Malware payload", "value": "32bf34138269e883ca198ce12d49a2814cfd708faa9370eccbf4c8b52447f914999620d6d921ab1048d61d7ffac44abf", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cisco", "colour": "#C812D6", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273900, "uuid": "f91202ee-dfe4-46c9-b47f-13256c582680", "value": "T1BAC5CF8AF745D8AAC0E7C6368675462A650BCC558B43E2874A69F13C0CB7DC49B87ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273900, "uuid": "a0e37666-c5c7-4f23-b83e-d7ad84aff59d", "value": "49152:m0AB7kC1nKW7t6EjQSBtc9ZCWXCmDJiUnFwRGu11C7:Q7k+KKoEjQSBtqZ7Ca0UneRGt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751273900, "uuid": "f74c97bb-9448-455c-a145-5d19a1f2c440", "value": 2742552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751273900, "uuid": "80a546a6-aeb1-482e-9dbc-a75645b7d9c1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273900, "uuid": "8a218996-3b66-40e6-b4be-4ea1d04816ab", "value": "24H8AhXs7C_0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f52335fe-55b7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751290902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290902, "uuid": "5d8692bf-5c08-408e-8bed-38da006db946", "comment": "Malware payload (Mirai)", "value": "74c058a814cfbf107bafdc3766d5f231", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290902, "uuid": "c7c8a71d-52e2-4b15-91c1-3c95e3ff87fc", "comment": "Malware payload (Mirai)", "value": "56416350c9293dbf0412a907255138cebd4fef211e47ffd8995adc1b9eed9fae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290902, "uuid": "fe2c4772-9cbd-4b24-9121-13ae62e4b696", "comment": "Malware payload (Mirai)", "value": "c9468bd647d2635a6163b4cd367d0f8ea176bee9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290902, "uuid": "3260dd35-8a8b-45b7-89ea-02e1be31ac2f", "comment": "Malware payload (Mirai)", "value": "77ac49a11449004ec7f4b3943a89aa175a57b58283d5a381908d1bcc09706b4429c9191b88d63cfc5c3e047576e92ca8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290902, "uuid": "0a09ba16-926e-4b50-a3e9-54116b82eb1d", "value": "T1A2532941BC919612C9D463B7FA6E50CD372663A8D1EF32079D215F2077CA82F0E7B692", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290902, "uuid": "784503d8-c566-4ec3-9a96-d322a601cf61", "value": "768:OGl2xHRCqGSlAHpWYyc8THzaBDDABUYLtvXpVoqqg1JVPbp5CC48v37KI/gkJ9LD:XwxHEqGSKHpuaJuLtvpH1JdbH/VHq9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751290902, "uuid": "9108f3d6-4a1e-4c99-9625-70256193f42b", "value": 62284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751290902, "uuid": "fde72899-f494-4c8d-88d4-4216ac402cf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290902, "uuid": "65ad1007-b021-40b2-adad-d6f424a82889", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f1cae9d-5578-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751263539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751263539, "uuid": "d8704c07-edd2-4f42-a955-57262204a51e", "comment": "Malware payload", "value": "4f584175333d8d8fbf73be253845cca4", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ms-g4-com", "colour": "#3B11CB", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751263539, "uuid": "0b6d6845-99c0-4852-b420-ce562ed841d3", "comment": "Malware payload", "value": "5671c4c8066dafb00d30f77ad034d4438f6c2a87910696ab85f2371a121ba507", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ms-g4-com", "colour": "#3B11CB", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751263539, "uuid": "d4856dca-dfb7-4fad-912a-7079fed2adbd", "comment": "Malware payload", "value": "2bd938e976b1dc62e9c19454cae68763ee255c88", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ms-g4-com", "colour": "#3B11CB", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751263539, "uuid": "72611dbe-2c48-489a-a268-a0f1a5ce1ab7", "comment": "Malware payload", "value": "bc4c7d6b2216b0cb87b25340f45713ad4f9d9c6704c84dc7b1b6c1b65227da9cfb4f5220a13e040d884c87f6fa43c100", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ms-g4-com", "colour": "#3B11CB", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751263539, "uuid": "c095b3db-39bf-4f16-b77e-0ac3cde6bac4", "value": "T1EDC08CB2941A203B0748C878F4F72842818268E4AA4EC8C6FEF85D2A0D04652F551C8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751263539, "uuid": "6868c11b-17eb-4000-9414-afc786b78f91", "value": "3:VSJJFIXMzqrFGMFCHmMLLH5QwoKvIjveCRRATDOEFlo363ATDOhHn:s8XIXMFCLmwfILDRRAPOse363APORn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751263539, "uuid": "a96d1957-950e-492f-8351-7b95dff5624a", "value": 157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751263539, "uuid": "ba4c3294-bc99-4f59-a286-8a6359b69c6a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751263539, "uuid": "515ea14b-bac9-4061-9199-6258a3dab9f9", "value": "ps1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bb6af89-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751243830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243830, "uuid": "2b93d402-3d57-450c-9290-e0bba1ccda25", "comment": "Malware payload (Mirai)", "value": "d91053ec325a0431e369eb12935efe7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243830, "uuid": "5a38d730-ff42-42ca-bbe7-63d55c2fb2ab", "comment": "Malware payload (Mirai)", "value": "567bb24ea36481d3baa6c9ab563c69ea4340f8fc81964dcb2529040e16232c65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243830, "uuid": "f6c8c00c-7046-4cdb-92f6-f15a440e0753", "comment": "Malware payload (Mirai)", "value": "739c6f34850306440b7c79126d4d64da2784e002", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243830, "uuid": "f5e896ff-c515-44ff-b217-eade13fa6c0f", "comment": "Malware payload (Mirai)", "value": "714c6231eb2660dfb77439104df6f5cee9cdc242b15666d73c0c37fbd49cece7a81f15d4ec1db2a5e1fc2ab95f02e6e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243830, "uuid": "460e06a7-f4c5-4f88-963d-f18c6a9b4b23", "value": "T11082CF3051AB74E4DBF14430FAEECEC697160BB8D1FD36D217A9AB78C94610611F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243830, "uuid": "b27330c2-0369-4f85-809a-639662b2a3a8", "value": "384:MnozRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaDJhymdGUop5h5l7:2sV0P6+kom0tVAoNvm+to1ls3Uoznl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243830, "uuid": "298fc38f-3f8f-4eec-bed4-5c3a5d7e470a", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243830, "uuid": "79930d5c-fee5-494b-92f0-5de8e49eaceb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243830, "uuid": "be38efbf-ca5b-4ee2-96df-0e5c70406edd", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5180b2de-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751243813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243813, "uuid": "18aa6a73-de94-45ec-ac7a-9ffca7a83f25", "comment": "Malware payload (Mirai)", "value": "52cc8354526245f01379f9caea6917ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243813, "uuid": "292f07f9-b9e4-464d-a75b-d59d835c72a0", "comment": "Malware payload (Mirai)", "value": "569c3f16de1120cc7b16005fe3d5cfc1cf4dd2da36726aa93709522224504c0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243813, "uuid": "aad01514-7547-47fd-89c3-5245eea446e4", "comment": "Malware payload (Mirai)", "value": "534624091fff6fee8915f77586e2daa78d5b741d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243813, "uuid": "21e357f4-ff6e-407f-95cc-843402abdf4e", "comment": "Malware payload (Mirai)", "value": "78b998ca797acf9eb7602516f74d303ec72776738438ecf3bd2e1e06fa255df70aeaa57037b72d4218f3a7d91943c18c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243813, "uuid": "fdfbdc20-1f72-4cb3-8619-144cb10391e6", "value": "T11163295BB9819B11D9C1127AFE1E118E3313177CE3DF72129E206F217786A6B0E3B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243813, "uuid": "05935917-c41b-4902-a756-c7a6c461cabc", "value": "1536:hAnDpYdBHgdJTYkG8pWPH5uFQa0aln1FQSMRiBBxQJxYiWp:2YdBqYkiH4Qa0al5BGJxRWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243813, "uuid": "4f634504-7080-479f-ac4e-9f52c6eda73c", "value": 67068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243813, "uuid": "5ba405b5-a91b-4368-acdd-f69c926d8f41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243813, "uuid": "d285db0a-a329-4444-a9dd-b46fd1592243", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb32bd51-55a0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751280927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280927, "uuid": "262f43f8-8a50-4b76-9702-bdfdc56d05e2", "comment": "Malware payload", "value": "e8080e3ba9385b279784668adc8b0553", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280927, "uuid": "4b4e3b3c-5f17-43e8-8456-1133ea94d7ad", "comment": "Malware payload", "value": "56bb1605e879da8f3142bc82bfc17a08c6709d48624dfdfc4d12678b4eede01d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280927, "uuid": "67c92c52-22e2-4325-84f6-78cb9e981073", "comment": "Malware payload", "value": "e059db1baed533170fb13f53436c062fb6e570b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280927, "uuid": "fcf29bb1-df61-4a4d-9df2-94a211e3794f", "comment": "Malware payload", "value": "00ec35c167b3ed149879e2a05a971b9d7fad803ea976ff440a2693b0b79b6bfd4f38761521e2646e02f4fce48fd6a862", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280927, "uuid": "02f8834b-7081-4ba5-b788-41ca9e754fb8", "value": "T1B2B402118F881F8BC5AFCD750A2E167311AEDD9F46CA643E807CDD48B6A6D0D6783C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280927, "uuid": "e9a6053f-99b1-48e7-86e1-c45ea0bc3982", "value": "12288:7A84JF9Qc8GgZxTM6m1U3snB6NnVuqnAtSyBpywBdlEykR6LkV6N0L8AXwtZJHZz:/M6m1U3rVuqAtSySwY1gEIZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751280927, "uuid": "190c32c0-9ec3-41cb-9f54-188e2b78573f", "value": 509272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751280927, "uuid": "155178a3-df7a-41f5-90a6-827110300b14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280927, "uuid": "376d6a87-0628-46fa-b706-a1ff7bb0fc6f", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b479b795-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751291223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291223, "uuid": "4e5887a0-3296-4d54-a97d-2e12528710c1", "comment": "Malware payload (Mirai)", "value": "b915d5e87518f1b4789b98f4ac8e200b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291223, "uuid": "423f096d-a515-4e5c-9a1f-5cc1e7515fe0", "comment": "Malware payload (Mirai)", "value": "57b3c8dcf40b1ef06799f0f2175c88454b42093af89beec7478bd0c129ef7c90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291223, "uuid": "c6a035da-3c84-4c08-bc6e-33a626c2cc22", "comment": "Malware payload (Mirai)", "value": "69a15b1fc173acef90e105b1cbdd379388bdbbc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291223, "uuid": "0a8c0108-b8b1-4d77-a21e-b7ec2c6e191a", "comment": "Malware payload (Mirai)", "value": "b5d0c6061798406782de77845da669353a6020fa4ce80ef025cceeeae1975ed849f0950b72f87827086d9e744db08884", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291223, "uuid": "c563e28e-7f76-4cd0-b696-f413dc9dcdc0", "value": "T17A330907B95180FDC19CC2B4477BB53EC673367E0279B1E62BE8FE226946E611E6C844", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291223, "uuid": "a46b8290-412e-40c3-8bb7-4ca4e8a23205", "value": "1536:g2EXnr6PCnqpM7fqz3aFSjsv77E1xfXMO:gV6aqpM7fqzKFSQU1xvMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291223, "uuid": "a499500c-8577-49bd-aa4e-ff2ec4a0d7f5", "value": 54272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291223, "uuid": "37a009b2-51ec-40be-950b-9eee93c0c374", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291223, "uuid": "5e6c128a-b8af-4f1e-ac98-76984b82a303", "value": "miraint.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07aa3217-5554-11f0-8bd0-42010a9c0005", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1751247984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751247984, "uuid": "36b3823f-d760-458d-9a7c-9a2833460090", "comment": "Malware payload (VIPKeylogger)", "value": "a6e329e4ff8534b355a40ad968b9ef4f", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751247984, "uuid": "a75d9ee5-3994-4ea0-9def-32ecc9bdd1cb", "comment": "Malware payload (VIPKeylogger)", "value": "58486be0a951a111d0bcde01eaf8a3222331bcb89121e57191c67939c3eae4b9", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751247984, "uuid": "8a612308-0f6c-4714-9626-fecf5f2efb57", "comment": "Malware payload (VIPKeylogger)", "value": "bdd9fa902e53c19e04e1f45420099f831f384f4e", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751247984, "uuid": "10036aa0-0341-4842-88fb-737dd94f2ca3", "comment": "Malware payload (VIPKeylogger)", "value": "461fa653a770b656c61eed1af4881b6e008db6ef8a6ffc751d762d789ea8f38e3032b354a3b981999c1fb8ac1494b5e0", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751247984, "uuid": "2f9da404-b00e-4e1e-a9ab-b8e34134f0ec", "value": "T144D423F1A59DB7B250DB5F2DE1249361ED98C32E09CD4A9DB38B1422EAF7B0D4D21C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751247984, "uuid": "6ced8029-0bfc-46b4-9e73-24139df57c80", "value": "12288:g3xkGsqiKUw9NNh3+42OcRdRG1zXnkp6qsb2UMRt8+gSo7vHsgMw:ghZsqiYzu4BUR0z86b+Bo7vHww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751247984, "uuid": "f801631f-199d-49a8-902c-f01ab55f93c1", "value": 654751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751247984, "uuid": "70e43c2d-a996-4832-bbd0-1440c8e25731", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751247984, "uuid": "5ff43eb1-347e-42b7-aaab-30e68876a821", "value": "\u88fd\u54c1\u304a\u898b\u7a4d\u308a\u4f9d\u983c 27062025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475b4e2a-5580-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1751266988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266988, "uuid": "d7cf0863-aa9a-4b27-906a-dfcf0431fb94", "comment": "Malware payload (Formbook)", "value": "d629efd0f6ecb56ed20786c4a3c58e7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266988, "uuid": "18c02d0c-50ba-4838-9c9b-b66b7d0debbe", "comment": "Malware payload (Formbook)", "value": "5871aafc0ffe3d41857f81f3f9653a34e39b40540d33b24cb28d47025b1c6ec7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266988, "uuid": "a507fb02-4358-4693-bb14-64cd04076764", "comment": "Malware payload (Formbook)", "value": "9ef54e2832c8150e25f6c8d60a52dc137b3d7d07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266988, "uuid": "2257ea1f-e0bb-44df-ac77-b8c248311f19", "comment": "Malware payload (Formbook)", "value": "8bc952fb53609dfa7ff260577dc780e5997a92c5a8109025f083d492bb49a27a0b8050e6b98a5f3f5728f821167a2278", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266988, "uuid": "941b63ed-09b3-4923-bfb7-dec9d738b223", "value": "T1A255AE03738D826EFF9A91722B76E231467C6F270123A51F33D85D7DB9701A1462E6E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266988, "uuid": "febc0121-622c-41e4-b910-4451b6c31c18", "value": "0b768923437678ce375719e30b21693e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266988, "uuid": "3c2998cb-a9cf-4e56-bec4-aebdf3370060", "value": "24576:x5EmXFtKaL4/oFe5T9yyXYfP1ijXdalZy2+nI2h9wb1sE:xPVt/LZeJbInQRalh+nTh9wb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751266988, "uuid": "c1e40e32-f45a-4618-bc90-41d177d0b554", "value": 1326592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751266988, "uuid": "42fac3c5-4e91-4b4e-9a39-66f70d813aa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266988, "uuid": "fcb4d22d-5d80-4d2d-927b-ae04041dabb8", "value": "PO#126659.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c7ff616-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DBatLoader)", "timestamp": 1751291881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291881, "uuid": "7bed08e7-c907-454a-8473-89820367fe9c", "comment": "Malware payload (DBatLoader)", "value": "bd08ff7bf6bb6184744ec7a04fdf7b77", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291881, "uuid": "be9e1f48-7cca-491e-be2a-378c8d6e113a", "comment": "Malware payload (DBatLoader)", "value": "58c136e1accb7252ed4a30d860822d5221d9bed658bd5f6e6fa0566f3eaeb349", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291881, "uuid": "c9e8eef6-5c02-444f-b7b4-1ad1d2635e41", "comment": "Malware payload (DBatLoader)", "value": "aa5628541169919757b45ec2d9d911fade3c6292", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291881, "uuid": "3516875e-49f9-44d3-93c3-c0e074f3897e", "comment": "Malware payload (DBatLoader)", "value": "be874aa571df692dcc153ed9919917eacc7b4b1cfdf626c9d7074f5ea52f7f60c36de91ebadf75192008c152d4cffdff", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291881, "uuid": "55a59ae6-a2ad-40d0-ac52-e1b5a67235eb", "value": "T1B014F121DE361B98EF184DB50C7D67164C9D6E303E13CCF6DA9B394B42289D416B3A2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291881, "uuid": "44c2712a-2db8-44fc-a98d-d9f143e0356c", "value": "3072:Tqpa2tSrHLfS7DuvreFrjdb4E5PShDTg8dmARC2SvjbDnfJKwYj9LVDbTt68hbg4:Ga2eLa7aCFrjdUMPYDvcjn0LVDHcSg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291881, "uuid": "82179147-41fa-4b48-925d-0baeae772382", "value": 202521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291881, "uuid": "11ba5a04-c35f-41f3-8bd7-d7b26cb3cf1e", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291881, "uuid": "20ee21a6-f3aa-4be5-844e-b7a863ffea66", "value": "PY2932930542927623.LNK", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cad0d52-55dd-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1751306860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306860, "uuid": "2a3364c3-b1ca-4e9d-8ef0-e017f4ddb1ab", "comment": "Malware payload (LummaStealer)", "value": "d43134a847db23c60b8cac970a02c089", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306860, "uuid": "b6c1a47a-111c-4fba-8bfe-0f8c8759069c", "comment": "Malware payload (LummaStealer)", "value": "595c98d81a4038604bc22b922f1edd67983093f8978ae490df542e15b655f11d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306860, "uuid": "a2f544b4-4590-407b-b5d4-47ec17f1fbdd", "comment": "Malware payload (LummaStealer)", "value": "8a9fa0998c49287ee6677b43f9c80710b6cfd3bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306860, "uuid": "c2563404-e343-4319-946c-8fb88cfbb8b2", "comment": "Malware payload (LummaStealer)", "value": "89fa5d22cff89471e768976aa24c41debccf984837f6ad2baccabad7b28f0ae3d08afdf9efc1bbf4be0626e566dcfa9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306860, "uuid": "6cac8062-428c-4bf4-9cb2-ed44d2f1fcf5", "value": "T17F853320ED3940F0FB7E5DB2DD8F6EA5329889714D864161B308DB0D95CB3E6293AD4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306860, "uuid": "539bbadd-4306-455a-96d1-e5fc9187f6fe", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306860, "uuid": "3fe19383-ab76-46cb-b519-9ee63fd45580", "value": "49152:LG7DKsswkXjROD2HlCU/4N7I+84xjqH9d:LG7XfkXjR+Y4N7z74b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751306860, "uuid": "b6985ffa-b152-4941-8183-3211881ef20a", "value": 1848320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751306860, "uuid": "f71ab083-12b2-4954-bbea-bc6ef7dc0cd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306860, "uuid": "2ffe0ec5-5814-469b-be30-5946f9db063c", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f66a66-55b5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RustyStealer)", "timestamp": 1751290050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290050, "uuid": "db365ee2-62a5-4d30-802e-205508464b30", "comment": "Malware payload (RustyStealer)", "value": "3cfd54fd227c8b2c93c6b6224e4c04c2", "object_relation": "md5", "Tag": [ { "name": "meuacessoseguro-centrodeensinofundamental-net", "colour": "#11E513", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PDQ", "colour": "#B67AA3", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290050, "uuid": "2a1ccca5-a611-43c5-8a1e-870df025e489", "comment": "Malware payload (RustyStealer)", "value": "59cf3bde9192b6dfcbd432ba07291cc91e9217b048dfb1a442db408933f4345d", "object_relation": "sha256", "Tag": [ { "name": "meuacessoseguro-centrodeensinofundamental-net", "colour": "#11E513", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PDQ", "colour": "#B67AA3", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290050, "uuid": "153d79b3-16a8-4d9b-b6e9-3f9596595d19", "comment": "Malware payload (RustyStealer)", "value": "d4418b4b3ff5c43943cbc3bd8e60bd5b2b8e817a", "object_relation": "sha1", "Tag": [ { "name": "meuacessoseguro-centrodeensinofundamental-net", "colour": "#11E513", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PDQ", "colour": "#B67AA3", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290050, "uuid": "37efd891-7bad-4d0f-aade-ddcf50f03821", "comment": "Malware payload (RustyStealer)", "value": "86f08aab577072b47a317a1fb1c97039d01fcaa11916ef89443a91591a509a119bbcad76834976fd72eb18a543c80f4c", "object_relation": "sha3-384", "Tag": [ { "name": "meuacessoseguro-centrodeensinofundamental-net", "colour": "#11E513", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PDQ", "colour": "#B67AA3", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290050, "uuid": "8482dc0b-d18b-4f55-a519-6c89b07dbbbe", "value": "T112360115B6940CADD8E64275846EF614AE22780D233C85EB4E763DF83E2AFD063767C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290050, "uuid": "5f6651b7-2c55-4f74-b17d-fbb818943d21", "value": "98304:f8/mhXueqpBZ3XIFtHuabz1uBNcdG7tK8drs29D:0exueq1cHXbEBNcdGZKYYqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751290050, "uuid": "8a3aece6-3473-491d-8fa3-004c4549389d", "value": 5129728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751290050, "uuid": "4c2afd44-f252-49f6-8497-71bb07565ce6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290050, "uuid": "7b6ca1ea-63a1-4447-b566-e6a0b006e60a", "value": "INTIMACAO29166-pdf.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9814e0d2-55e0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751308356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308356, "uuid": "ac66d9d6-f36d-4329-9303-b48e4d656493", "comment": "Malware payload", "value": "1b34c49808da957c886dc07b6a543a82", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bitwell", "colour": "#C2DEB1", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308356, "uuid": "7657cb57-87f5-4081-9b96-58591843ac0a", "comment": "Malware payload", "value": "59e42e5a0155122e793312744f258ae934d953ca286dfe8a5d31429bc32de29e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bitwell", "colour": "#C2DEB1", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308356, "uuid": "e6b0c78a-3969-4336-9339-f76216016401", "comment": "Malware payload", "value": "6f16737407d1b56add8def43e3029cac6d5f18b7", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bitwell", "colour": "#C2DEB1", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308356, "uuid": "18c542e0-e1d6-4fb6-89a6-8a54dbbfda63", "comment": "Malware payload", "value": "c057c884a8471df95eec80a53c2362b700c99afa5ff72f66d98bb4420db3b3eaa95ef89c876d61b3db46b461804657b7", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bitwell", "colour": "#C2DEB1", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751308356, "uuid": "206fe9f4-1186-4b1b-a9ef-2b8a61414d4d", "value": "T1FE751297BF81C8AAC0B78236D421522212279C358EA7D3DB5E65B13C5E339D93F19DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751308356, "uuid": "34142f96-1377-41ab-a69a-87eab94bf94d", "value": "24576:iRFLSJnYaJa6pzqz0RY7yKMY30Wpr3LafE3mvl2ADLTCDSghC9yk:8F2JnYMzwteJYkUl3mvtDPClhCUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751308356, "uuid": "c3929abf-61ed-4c91-918a-a29eb03e565f", "value": 1678092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751308356, "uuid": "15e4b3be-ba62-47af-ac92-b0df2c78203b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751308356, "uuid": "f41d85ff-c99c-49ff-bc36-22a741ab8076", "value": "app (3).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e36aba-55a5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751282830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751282830, "uuid": "1a33aa10-fb17-4710-b634-e89eaa5b04ca", "comment": "Malware payload (Mirai)", "value": "8697fccfe789a47101b7929adde748c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751282830, "uuid": "7f2407c5-4a3a-4db6-a7eb-7bce3f8db20f", "comment": "Malware payload (Mirai)", "value": "59f3b0924be2929bf3e45890256faf088ea93cb4c3db5f4c634d1023cb6cf9e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751282830, "uuid": "639d4ac3-2e76-45fa-8779-a0668afc5794", "comment": "Malware payload (Mirai)", "value": "712309e9d214bb7a932bf49696151dd4886cd92b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751282830, "uuid": "c56a1b1f-bf59-4906-b19b-91e91c803b23", "comment": "Malware payload (Mirai)", "value": "e7f04f4dfd7c58fb9b8786302824b402dad3e805cbdf64c28b7258810bf4ba23f48bc017f334b9e7609cf79e7ee46cf0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751282830, "uuid": "e22b1345-37d6-432b-a295-86b4eb2f6668", "value": "T10C933A46FC818A21D9C512BEFA1E118E331357B8E2DE33129E18AF25738A56F0E7B455", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751282830, "uuid": "102a64e5-5b10-40e0-a76f-a80d540980ef", "value": "1536:EAnz5SKnk6T65rjtOABXfxxPGVQtKr5TcaxeLPzXwD8Ri31UncCrL7fP52Yp:j5v8Xf+qU5TcaxeaUncCrLbPQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751282830, "uuid": "bd7aa10e-ae7f-4dca-a151-5586ecd218ed", "value": 95708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751282830, "uuid": "a12cc9c6-2447-45fc-8024-50e7551bf876", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751282830, "uuid": "60ee6d56-f429-48e0-abe7-1e3a58d53240", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f81e87-55de-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751307473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307473, "uuid": "0fec3c86-65af-440a-8c07-4ccebf339b34", "comment": "Malware payload", "value": "28b6b6e76335143179167154638df1e0", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307473, "uuid": "ee02142a-09c2-44c9-b17f-76f2e11ad9a3", "comment": "Malware payload", "value": "5a27b0972a3d9c9997c9395192aa2734f8b1c9900cd1b0a969615caf7fa211a8", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307473, "uuid": "06885000-d21c-42b6-98ba-a5516514baa7", "comment": "Malware payload", "value": "2f6de0979611e50a22af27a2ea16db5d72363242", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307473, "uuid": "2d975b74-74ba-4a4b-8dfc-48b183286444", "comment": "Malware payload", "value": "cc832403b3a6d21f7598df759cc51c3b670c754dd41a43d57b4fcc1e8dd5ca6a429c6c110861906dc0ae839b85d7cc1e", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307473, "uuid": "076b9087-e47e-47e1-9bc5-709fb8b523f1", "value": "T19D41AF17D844884C01F19AE778FB8001F4E562E3891EAE26B56EF8376F343CF46D598A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307473, "uuid": "e8154703-a940-470a-8613-4f49d3c0051b", "value": "24:hPgRWw2dSATiFCdYh+ID5dkBlTy+i3VtR9xRAiS/C2QdEF3poypwyyDtPMCO:tgRNqSNHRdknmFtTxeHC2EEBAZpUCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751307473, "uuid": "f382937c-37c8-4930-9791-798b7fa505bc", "value": 1965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751307473, "uuid": "ee490af1-052a-4017-856c-86ba255be4db", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307473, "uuid": "e498b7e3-ad0b-4142-86b8-e38d7156180f", "value": "weneedgreatattitudewithbestthinkingsforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dec375f-559f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SSHdKit)", "timestamp": 1751280394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280394, "uuid": "7dde4627-5b26-41a9-8e62-46e2d97d7312", "comment": "Malware payload (SSHdKit)", "value": "52c500d0e0cd225d8696716e90973478", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280394, "uuid": "00f86a19-0c9b-44ce-bec8-913f1946d6d0", "comment": "Malware payload (SSHdKit)", "value": "5a76967f87683edc433e1a1b2f71147faf2cc6a667d0f927bad051c9d6587ec9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280394, "uuid": "01954327-dc7d-45a4-b26f-abab36271cda", "comment": "Malware payload (SSHdKit)", "value": "68f3ba7be65675774d14ff7903d8be81375ed2e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280394, "uuid": "81508c7e-5dfe-44a0-973e-e485e4ce67a8", "comment": "Malware payload (SSHdKit)", "value": "1d2188e78c4374c675889c886ec8035c7602939d38d8ee2914563de6565ab603490d3c17a2b27845419108cfa867779f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280394, "uuid": "49d6ac99-b4d6-497d-b0a7-17a4e5c2022b", "value": "T1C1356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280394, "uuid": "8c90ceec-5d1c-4d12-8976-ac5f1a38d590", "value": "12288:E8dASOYRNCAJump208iJftl7zmnSrlcaUxQ5TVFQGl9eLtRajZa6ZTxIV77bLv:E8dbbsO38+TfgRinIV3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751280394, "uuid": "3689f47a-64ad-488e-8fd3-5631e264ef16", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751280394, "uuid": "bca40fec-2aa1-446a-8d24-69343972fcd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280394, "uuid": "18524b13-8cd8-4843-9e35-d057e7479148", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68795338-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1751291955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291955, "uuid": "b14ab08c-0644-4d97-88ca-c8ed77a29dcb", "comment": "Malware payload (AsyncRAT)", "value": "83665df51f0e36328fc9d0b7975ad3a8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291955, "uuid": "eb2f984e-19c5-46b6-a57a-dd129ef82b05", "comment": "Malware payload (AsyncRAT)", "value": "5b3c39341d2a8d11bcb0faed02ae6aefab6d662715488b718a44647f7f828538", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291955, "uuid": "8a5cfc39-4586-435b-9622-405a251c463b", "comment": "Malware payload (AsyncRAT)", "value": "eccfed3c27bc822c6e2139351cbd35864a0b5703", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291955, "uuid": "789e6a84-c981-4f06-95af-75efeb9ea250", "comment": "Malware payload (AsyncRAT)", "value": "a132a2a92b85a25a4cb4284583be955d2759ac4c4e438eb6e3aa4efe54f2b5f4c00d606e0bcff46ede29a6523a45ec72", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291955, "uuid": "b52841e5-6dfc-4345-977e-3082f9c88af9", "value": "T15AE4E0CF6D49A688441272FA6818C152F2CD87EA7312DB62FDBCC45533A58F8C5AF391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291955, "uuid": "8433c30a-06dc-40f7-86f4-07818f32a122", "value": "12288:F1hunUW9nYqRias804M/yX1hunUW9nYqRias804M/U:LhuUFqS80V6huUFqS80Vs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291955, "uuid": "0828edc4-486c-418b-9d0f-1eba09d59f45", "value": 665760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291955, "uuid": "e2687bba-ad4f-4121-8baa-be06bc7d608c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291955, "uuid": "eb210e5d-e7ff-473b-b454-f4d917b9fa73", "value": "SecurityHealthSystray.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf92a77-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751244099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244099, "uuid": "d168070a-216b-42db-bf8f-095df9aae8e5", "comment": "Malware payload (Mirai)", "value": "d1d1ea522f3edfbd26bebb10265a8609", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244099, "uuid": "abc7839f-846e-4ed3-9eed-73daeb13fdbc", "comment": "Malware payload (Mirai)", "value": "5b5ed043e40bdfbd8249ad8abfcf7338609278e24fc677c0ec2f13d3b9d40549", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244099, "uuid": "fa98e195-e8df-434a-aa62-d79b61e37c21", "comment": "Malware payload (Mirai)", "value": "2e7d075037d48fb95b426677f6c94abb5d17a6d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244099, "uuid": "1ad61131-8f8b-4476-a442-fdff6b419cef", "comment": "Malware payload (Mirai)", "value": "6525b793df3928d0ec82b365e2102eb30c6ae58f6761ef83a10b8e0e366ae49869e98525a499c9521616caa554e3a94d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244099, "uuid": "2671a487-da22-4f3a-9362-990aefb8c1cc", "value": "T15B63951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244099, "uuid": "61077133-23e0-4be1-8e9b-011c6f019924", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAq:UnN4ZH2SyOyuIq8LMMIUq+cvtpvXzhL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751244099, "uuid": "1762b4a6-b1c5-4613-9d6b-cf517b47fb2f", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751244099, "uuid": "cbb9d87e-1e4e-43b5-94e0-fa34e997d379", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244099, "uuid": "2521cd76-41a6-42ef-b828-b5ac0664a318", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f244fb3-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751243836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243836, "uuid": "a9a5ed57-aff2-4107-a1a9-7201032b62e5", "comment": "Malware payload (Mirai)", "value": "83c9ad657f672d5e79e4a516fe59efdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243836, "uuid": "b5763a65-dcad-4bd4-895f-9231080c8307", "comment": "Malware payload (Mirai)", "value": "5be520eb0113672ca74c7b78e0cbcf7825ab576c61a1adfcfa08f605c9088693", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243836, "uuid": "827656eb-8d02-4de5-8932-23df25351eba", "comment": "Malware payload (Mirai)", "value": "303f8717383987775060128c8e50f42935683bae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243836, "uuid": "36054563-2f04-42d6-9531-497bccba6f0e", "comment": "Malware payload (Mirai)", "value": "2cf55b90e4277bf21d226b2c04a0a0268e8c9d1bfc1fe627476b0801a77b43de0a484d375f4d90bf4b30445273cded73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243836, "uuid": "80b7db5d-f6f1-4cbb-8a2f-598621e0a038", "value": "T109B2C0CC61543084CA8D7C7C178D4A664F6CA1D0BAED9F16E354CD9873B9A8F345D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243836, "uuid": "3dd70646-40ed-4e82-b6fe-b28e90c817f9", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpRJvZqSWvy:4QlS07FUXqIYSXQKquRJRq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243836, "uuid": "924308af-6f4c-4a99-a32a-53d6d0306046", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243836, "uuid": "b34346d6-8af4-44a2-ab2c-eed5825500d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243836, "uuid": "51c49280-810a-4003-bbcd-8b50ac90d077", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9bf53d-55c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751298107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751298107, "uuid": "0c2a4d6a-9de7-41e8-9bbe-887eb46003e6", "comment": "Malware payload (Mirai)", "value": "4b3b23d45b53814392dfda7b62dfddfc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751298107, "uuid": "19a73496-6aa4-48ae-b78d-c511a349be57", "comment": "Malware payload (Mirai)", "value": "5beab7abc350ae5536e9280b91bb241deea9e40f642174e4ebd95aeebd845465", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751298107, "uuid": "b8cdd050-709a-41db-8c18-565ce4bf8132", "comment": "Malware payload (Mirai)", "value": "61f069f69b6f9fb08b3c1e36e8127e83be9f90e0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751298107, "uuid": "2c975df7-40f8-43c4-bf3e-d65427f54f0f", "comment": "Malware payload (Mirai)", "value": "5bf803fae7e5dd206de0c9c6d584c2d6077960cd95cdb2a679acfc587c0bf4e5817cd7e83b516dabcc9732c4fc2a2051", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751298107, "uuid": "79b0f1a3-4f8f-420c-909c-dcbc5b55481f", "value": "T193216DFF03958023C45DCFD130698524A18986D3789C4BB93BDE8CF66E84EDAED42E59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751298107, "uuid": "1a0fcf8e-13cf-4134-b1c3-44fdaa1ff6ea", "value": "24:7+BI+MI+GNI6mI+vKVI+gN+7I+f2I+QcI+zI+QlI+TI+m3gI+oHR:uCQmNWWN+78OcZulZYQSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751298107, "uuid": "08e761c3-7225-43c6-ace1-d5f9fd09690f", "value": 1278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751298107, "uuid": "7623022b-7ab0-4411-b793-74e079827754", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751298107, "uuid": "0b078aa4-e49c-4b8b-b85c-ef87ee07c86c", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c87ca72-55f0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751315020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315020, "uuid": "10f9bd4f-f4de-429c-a032-d6bce3bb982a", "comment": "Malware payload (Mirai)", "value": "3a506e60de1097b2d0e63ece406b4aa3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315020, "uuid": "3ebc7337-9058-4419-a8d0-f7ae8cf02953", "comment": "Malware payload (Mirai)", "value": "5c01d13a7070c439d14a8b099de90e9da8f62c717e2a5b1879c96ba0ff33bdc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315020, "uuid": "0381a5c8-2721-461d-86b3-404895c865b0", "comment": "Malware payload (Mirai)", "value": "d2b02b2fa300df921ee60dbcb9d50bc32c4c1d48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315020, "uuid": "68282bdf-e6e7-4f20-acf9-311d0d32d863", "comment": "Malware payload (Mirai)", "value": "c889e7f9aa9a032028262b9039f9e80c4e95592f2b76c21be39e8337335d0483dc61ef5d9a61bc995f0040c0f7fa98fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315020, "uuid": "130ac1e8-01b0-4076-838a-11e10e312f2f", "value": "T12E53F1164BB6A429C84615F2CCB9758E68334B3D62FA7152A0432F4CDFEF8475E66C83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315020, "uuid": "0d6e1e93-cb30-4ac4-b575-177550a09f30", "value": "1536:jxohwSGRt2UwgrNGt4FZxLP458+dP+XzoOdg:yqSw2Uw8Nu4FXLP4e+dP+jFdg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751315020, "uuid": "d3bacdad-f7bd-4469-8d32-17a3f6c5d0b8", "value": 62636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751315020, "uuid": "3a101448-9558-4b71-a809-40ef82d781e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315020, "uuid": "8ddd966d-b733-4003-b2fe-f55da782f03b", "value": "SecuriteInfo.com.Linux.Siggen.9999.6959.11115", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8acb3ed-5598-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751277487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277487, "uuid": "2af089d6-f23f-4961-ba11-9da0b9f56c37", "comment": "Malware payload", "value": "b64096bcd104cc44ac58ccefee86e1bc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277487, "uuid": "820f5677-9712-4b6f-b854-1bd229eb0f63", "comment": "Malware payload", "value": "5c1c18608cdd8918648425cc85a29f254ca981c7c5a48b245686a47c0391ce5f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277487, "uuid": "83991bd1-109d-4b01-88df-a18f267d242b", "comment": "Malware payload", "value": "3fc620ea06262fba34432db67a37ebde21c421a7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277487, "uuid": "02f543e2-b877-4ed5-a60c-485fb665ea01", "comment": "Malware payload", "value": "e7fc58685d89a293a2637c3b6510973d56791c4abe9e52b3d2b1a46692da36985c85e12b7c057935b050f52a63bef3a5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277487, "uuid": "c84c09f6-68e5-4b8f-90dd-e6c8c6701bd9", "value": "T17D063C7093526166C197C030CF8A4EF561E1A17B82356D0E1BC9DD253ABEF31AB6D3E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277487, "uuid": "ba86b1a3-4dca-4e0e-8539-fae2edd61e35", "value": "7a6677d1f71f40911a0151483eab14d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277487, "uuid": "ea6355f6-eecf-4537-9130-e463ee85f5cc", "value": "49152:47ppExuQ0dbvh7JFSLBE18nnmGCzkvPkpRgVNM3XHcgODfItFAFYwe/A7JHLt11w:4Vp7IBE1YSC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751277487, "uuid": "34e54ebb-b9f9-4402-a0a4-ec794529f345", "value": 3726336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751277487, "uuid": "1a784adf-4b0a-4569-860f-6450d8ceba78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277487, "uuid": "2b9a5b85-6521-4f47-9f95-4f2e755f24ec", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ccf9bd-5607-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751325104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751325104, "uuid": "290cfea1-74d5-4f7e-affe-9bd65f52055d", "comment": "Malware payload", "value": "2e5e2506b49e2fb6dd7449f889c6c0a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751325104, "uuid": "7fa1e3b9-b586-4e73-9109-434c485911bf", "comment": "Malware payload", "value": "5cdf70394e0e2d3fffdda768ef5d34b235fd89e5b3a32fe7d7b4a1abe111731a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751325104, "uuid": "b4565ff6-78bf-4348-aa85-679c6443decf", "comment": "Malware payload", "value": "eed90445ff06a29313f21de652e3e6992657f0c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751325104, "uuid": "e72bb861-2dbb-4cb4-a4e6-556b4c14b42e", "comment": "Malware payload", "value": "18e3ea8231bfe1e52e24aeeed79984e9b8ac5f2b2c477cbda3fa4fa5667d9825b7bc98659b8cd06d6cfd859ad156c3c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751325104, "uuid": "13711f0e-9711-49a9-b88b-0e1eaa7283c7", "value": "T18DC42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6D742F661EDB1B424A9E66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751325104, "uuid": "796d548f-4747-45d6-8634-fdaf52932f33", "value": "12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751325104, "uuid": "24a20041-469a-46a7-8ce4-7ee110f29105", "value": 587764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751325104, "uuid": "1c04f932-d692-4948-a135-03c50f3755d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751325104, "uuid": "a53bb3d0-c6bf-46a3-ac41-648f642e11f3", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae6e3f1-55d9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1751305273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751305273, "uuid": "b8395d72-539a-442f-bbcc-1af7232c191c", "comment": "Malware payload (SnakeKeylogger)", "value": "43c1f601076e43b78ed1202ddfb745bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751305273, "uuid": "9612b701-31fd-4dd8-9132-0dcc4323cce0", "comment": "Malware payload (SnakeKeylogger)", "value": "5d260ab0a4bc8f99007f1cf76420599dcee8e77fc0e6e201630f7b2ec824f085", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751305273, "uuid": "46a091a4-b4bc-47e0-86de-fe862040ed18", "comment": "Malware payload (SnakeKeylogger)", "value": "5ee0a8e87be2c19b06de3d65be078eb54c46f9e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751305273, "uuid": "3f715852-b71b-4f71-8ab0-f49502ae3aba", "comment": "Malware payload (SnakeKeylogger)", "value": "53c136d1de37868abd73904b134729d67b1140ad044640ee24690f4f7a82b2870bde543ab40b171f5d686a2590a6f8ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751305273, "uuid": "ce5f0e93-35fc-4eb8-bd32-e1199fc5abc7", "value": "T112E41244B926DC13C5BA0BF14D51C2B853BD8DCDA522E3C3AECA2EEB74A67950D80707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751305273, "uuid": "ee0842f4-20fa-4f06-b72b-c91b12a5988e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751305273, "uuid": "627b10bd-db47-4350-b059-fcf0148b56c0", "value": "12288:gkBjuTwZD0xZ3Cp8DdsaDXgIr/4Hj3zS9pi/RH6M7wLe7GogUnBoxbdBEMUHWmfP:WIDWI6Dqv+/iUw/R67snBoxbHBUHWmFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751305273, "uuid": "f64c957b-265c-462d-91a8-3f2eaa16b837", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751305273, "uuid": "c76ce0c7-1efb-41f0-8392-883e14685eff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751305273, "uuid": "4a27f0e4-6c11-492b-93db-bfea197cad52", "value": "Solicitud de Cotizaci\u00f3n \u2013 Orden de Compra 099322.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b6f34f4-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1751291960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291960, "uuid": "59759601-0be4-46d9-ae73-6fc96cb02711", "comment": "Malware payload (RemcosRAT)", "value": "d4c984f341f84a66ab686ea4393bf9b6", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291960, "uuid": "df84b51c-4c51-48f4-9b28-ea690f94305e", "comment": "Malware payload (RemcosRAT)", "value": "5da646edf1eed3abc74e49e1a9daf4e4e5bedb7a1652ca3311cd7f8bce650bab", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291960, "uuid": "c7b2a55d-0baf-46d7-bc8b-fe95fc2c3497", "comment": "Malware payload (RemcosRAT)", "value": "2f7d11aa0d8efe5e11d875d9958197e908fd6898", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291960, "uuid": "69425d47-54a5-453e-a210-e895a124055f", "comment": "Malware payload (RemcosRAT)", "value": "5344b6af89aea33a0df2b1992115e299e2ed01e343e4db811475d25293dfae56d4d877297bacc3a46302d8548c9f54a4", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291960, "uuid": "407f4d27-b250-43c9-aa85-1a8b0278f151", "value": "T1BAD4F1CF6D099688486262F9A9188152F2CD87E67315DB72FDBCC49433A58F8C17F392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291960, "uuid": "5a6a9420-c32f-40a1-9c39-559a989d6ef8", "value": "12288:F1hunUW9nYqRias804M/rT3X7Xh/zSPZsKzNr:LhuUFqS80VX3X7Xp2PLZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291960, "uuid": "cb3ea57f-62a0-4de2-8357-7bc9d9f70aaf", "value": 633507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291960, "uuid": "4768f3dc-519c-4e99-8fe7-7344a9bada37", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291960, "uuid": "3e3e3aab-8c7c-4202-bad2-92401e4af1de", "value": "CopilotDriver.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7784854-55a2-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751281887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281887, "uuid": "c1680775-e64d-4913-8394-8386d50e1780", "comment": "Malware payload", "value": "7465044f29f70c5120d7d975ca789e81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281887, "uuid": "1b24495b-7263-4df7-bc23-5d4f21603c78", "comment": "Malware payload", "value": "5dbeb0ef3098fda0cb9307319ab7d2929a0682cf9818b1580dc670c5bc7ab88f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281887, "uuid": "7d2522eb-ae7b-41fe-995a-28d5f6cf7822", "comment": "Malware payload", "value": "a6d5a2a3baf443db74100fddb73cbeaca3c43630", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281887, "uuid": "2cb99630-dd09-428c-b6aa-a3ff0d74465e", "comment": "Malware payload", "value": "37c0b336a516f6fc51ad51729b03d673a48b5928d23a85d1ae810598ac84d33097e18baaf9c751a4704fe61b661fae82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281887, "uuid": "61ee7fef-707f-43e7-90f2-f263325a51f0", "value": "T14EA40294E9819B62C2C801BFFF0F45BC77A31F69E1EA71068D16EB1662D745A4F7E800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281887, "uuid": "516a6265-2325-42b1-b368-b81daf448986", "value": "12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751281887, "uuid": "5036991f-cb2c-48f9-93d0-e07fd21e5dbd", "value": 480792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751281887, "uuid": "51502fab-763d-477b-81b3-a5d9a3394d7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281887, "uuid": "923dafeb-e61c-4080-9224-e9ec2ceb397e", "value": "arm926t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac4f2be9-55d0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751301518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301518, "uuid": "5045d52b-06d2-4bd9-8d80-2eb31f6c8b1e", "comment": "Malware payload (Mirai)", "value": "05b37f3fb0fba32e9db3f24a07c146eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301518, "uuid": "731de5ef-5ffe-463e-b7ad-b9f9bdfd65c6", "comment": "Malware payload (Mirai)", "value": "5df2b5357b42bbaf21309d1695ee1ff5e67b29a99682e63671e466d24d9e04e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301518, "uuid": "6624be4d-4d9c-40d0-b402-1c1bf7b5d37c", "comment": "Malware payload (Mirai)", "value": "ace978efd75504d037901b0ea388a0b6e19decd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301518, "uuid": "66d56c27-3fbb-4791-b73b-1d893159a6e2", "comment": "Malware payload (Mirai)", "value": "cda5b492b23e0fbd1722d3e246f25caa09a9143c5f92f5065a902ddeb784ce5eb03964fddeb04e761d7a3f3edb58b535", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301518, "uuid": "3b53bec2-9353-4490-8c3a-039617c4a17a", "value": "T14A13F19D9BF4ABD4CC75CD32808C07604605A9E1204BABAE87264C8ADF7B59B3D4F434", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301518, "uuid": "2373d44c-fdb8-4b98-b7a6-ebbcf5730a77", "value": "768:P6ip54+llQ5MnSDFFdASKqD9rZeO1zk/JV1aQIbe0juwNcuQQtYBtef2Wp:Pjp5/n4HdA5qDjfzkxah1juwtQQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751301518, "uuid": "fa210604-fb80-4955-8029-49a2d4d86338", "value": 43272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751301518, "uuid": "dc890eba-dd35-4d75-81e0-eb0826c8419f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301518, "uuid": "095a1dcc-0ec0-4a2a-8c46-4a8d112306c2", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a599dc6-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751243828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243828, "uuid": "772adb92-c2ef-4c75-9b7b-bb2c8fe411b9", "comment": "Malware payload (Mirai)", "value": "bad1cc1e56344e1bc19d3865a0d3ec5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243828, "uuid": "f63a5c23-1d66-4500-9cbd-f9a74355d73a", "comment": "Malware payload (Mirai)", "value": "5e9c412cb5a68f44495f55f16bc44efbf2901135a3f50e966cf14c2b9087c33a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243828, "uuid": "80931c10-031a-4d5f-a2b6-a824ff6f0010", "comment": "Malware payload (Mirai)", "value": "c6eb5f0a893444637aeb7999677c3fbdfe4bd85b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243828, "uuid": "8ebf7798-5388-49e9-98af-a857e5ce9df1", "comment": "Malware payload (Mirai)", "value": "688d0f32a03d3813699e7fbfab520bb78701f48f1178682347f320ce45e0802f125932afe916bf1220ba57889268291d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243828, "uuid": "821d8fd9-92a6-4d4a-8a9c-647cf2c7835e", "value": "T15C336C36E029DED0C6560134A4E88F751F13F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243828, "uuid": "b03c6ac0-f8a0-41fa-a4d6-71108c265d6f", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9Wm3CZQoV/bnmCozw:Oa4U7G7SvT6ftBHm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243828, "uuid": "25ee1401-ad88-495f-9da7-b0f5a772d0c2", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243828, "uuid": "88013b5d-3122-46bd-b0fd-b82ded6ddc10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243828, "uuid": "31d996ee-2071-4fd0-ad68-f9b155f0d772", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d5a1d19-5580-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1751266999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266999, "uuid": "e0aecd78-3785-45d4-81f4-6eba8a6990ba", "comment": "Malware payload (Formbook)", "value": "8fa7e7200cf9214f9d8dcabd9d64a30f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266999, "uuid": "f89d6e77-44cd-4e9c-a957-f84c699f0e5a", "comment": "Malware payload (Formbook)", "value": "5f16ee8e5457480d3780ec03b7b37d9a43f0621a4e8bc0bea6fe77695f6e1ea3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266999, "uuid": "00382981-3f2a-4af0-9dac-f8416544cf65", "comment": "Malware payload (Formbook)", "value": "58632016aff71a3c74c30270afc9eaad1b1ae7b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266999, "uuid": "23191118-7996-461a-8539-179b0971d0f5", "comment": "Malware payload (Formbook)", "value": "03adb515cf504e6eaf6d9b91fde5e2bb23be7c806a91b14e9cd8d0a069b57bc1b3e366ad3eecfe8fbf5420c15a0dd7d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266999, "uuid": "c42fe091-a991-4daf-b42c-619c439ed4cf", "value": "T1A60512517798EC12C9DB4BF04921D2714672EEAD7815C30B9DC96CEFBC8E3A428462D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266999, "uuid": "7db525b2-6e7e-41ff-bc7e-3907cfd66c3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266999, "uuid": "ce5fd604-27b8-445e-aa02-5da0a0a77079", "value": "12288:ZD3scA5ZejAXfCV4n/2JhKVzq6DP5GjuBKiyKNSml5uXUCHhCOxIKjvd+tYaQDhr:C8884/SAD3B5p5adhCCIKTYPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751266999, "uuid": "44887992-ea20-4005-b8c8-43f5b5e0fd5a", "value": 846856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751266999, "uuid": "532aba9f-f3dd-4534-b4d4-dbc7dfbd8712", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266999, "uuid": "94ae36c6-ed43-45c2-9bea-c22043063ce9", "value": "SKM800315746009.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e653b108-55a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1751284006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751284006, "uuid": "0a6c7eb7-a18e-44ec-bfa0-b5768f754ae3", "comment": "Malware payload (VIPKeylogger)", "value": "735347ba7cda6150add4f27144a072f3", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751284006, "uuid": "b3c136c3-f377-4170-91f4-d016c2e015a7", "comment": "Malware payload (VIPKeylogger)", "value": "5f4a974787b1d2f2d43aca6b9753dbf8fa5b321808e4a5647c7d22e50437d1a3", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751284006, "uuid": "1609fb3c-5954-4635-97e1-46e6f4f7ac52", "comment": "Malware payload (VIPKeylogger)", "value": "a6eb4951c6acbfd6a6b5a5690d9ff9e138484e56", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751284006, "uuid": "330756e2-74ae-4af4-9b00-57e3182ae724", "comment": "Malware payload (VIPKeylogger)", "value": "7ce3a3271e6f56d6a9deb5ca736d4f915e294c56900e034fbc972fa041adce05ac780f99b626bc50f31545f4e8eee48c", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751284006, "uuid": "81b42d3a-b8ec-4715-8363-d1f03057c4b5", "value": "T1E912E726F7589333D7760772DC7366100773E257A4A3CE9E6C48502BAD123419BB3BAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751284006, "uuid": "d80137af-829a-4d9f-94ce-ab0a2ab5963a", "value": "192:5hizfACpru/6D/IjQLjSKKBvSZIeLc7r/c45tjN:5Qzf7prumgjQLjSKKBvSZQ7rz5tj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751284006, "uuid": "b0349bcb-64d9-4012-8e2c-c23c5c4e9eee", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751284006, "uuid": "845c629c-9980-4c2b-9aa9-cbc6e8a0e500", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751284006, "uuid": "b79eb2d0-c2e4-4305-962f-d96754188c17", "value": "DHL4704321510 Pickup receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b75fb5b7-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751292087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292087, "uuid": "a8b7a508-3ae8-430a-ac2d-e2819ba321fe", "comment": "Malware payload", "value": "8d4c93716996120bf1ed4b1e684701bb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292087, "uuid": "f3c68e5e-b563-4be3-9cc9-cb5131e2f51e", "comment": "Malware payload", "value": "5f8469ff520ad563203f02d05f56eb5733cac27fb4361dc15ff3bc80aa78745d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292087, "uuid": "506ac07e-c800-4b24-a69c-dfed09378c1c", "comment": "Malware payload", "value": "075bf5388a71039f03afa0469d8f05fbb591958a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292087, "uuid": "e95251c5-ad6e-4461-b0c6-f11dcfbd4c1a", "comment": "Malware payload", "value": "89e62f39a3711929d65f93305ccb7a510a46eca35eab267834bace4727cc835f1e89d67fa9b69287131122f61ee2197e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292087, "uuid": "86c7f046-4a94-476b-a9f1-3f8d5a302202", "value": "T11866AF8E8D0FF7433092DFE06A88B99AE03B66831B116B3074DC4D0AB75DD9A1DDD658", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292087, "uuid": "7c32e4a2-cb59-4af3-8ba7-8f9fc3f0978d", "value": "6144:GfHofoVqiiAeUyZ+TRNYPUJISd3Zy1nYAF8gVXVFRfjvnx3BhIz/VmhCoqEuOhHG:GfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751292087, "uuid": "baae17d4-d04d-469b-81f8-d9d564484512", "value": 6887919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751292087, "uuid": "4b24734e-7ed2-4652-a738-ad6ce03396ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292087, "uuid": "948337da-9afe-4a45-bd81-aebb873dec27", "value": "TEC-07A Requisition Form1_xlsx.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d5f58a-55a9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751284884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751284884, "uuid": "20b741b7-7b8d-4a7f-8049-28110c4d9c68", "comment": "Malware payload", "value": "21a2e0efb1eefdca509dfe9852831b04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751284884, "uuid": "4cadba32-3429-4f68-adbb-106fa903fabe", "comment": "Malware payload", "value": "5fb5737e789f855283923f209f845f4fc14a3deaa35f91413bf689c69af7e5ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751284884, "uuid": "b16b4a55-4f8a-4771-ac6f-bab40710cd34", "comment": "Malware payload", "value": "4e9a90783a3c21c4525a0a2d328a58b84bd7d0ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751284884, "uuid": "af335d02-b03d-440e-a9e4-d9c5092ecfdf", "comment": "Malware payload", "value": "8435e7f296422328ee070fee945f088849ebd1f44e5b4460ea96a91080d6dbd89f4e3e5e9bb7c737df9771566aa25097", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751284884, "uuid": "de2ddd6f-242e-4a0b-b522-4e7154b22c75", "value": "T1CDE4F1037308A756DF4BA83A82CBFD31B7C2799113D096667A80E29F8775726CF0D649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751284884, "uuid": "99494e21-92e8-4cf5-a54f-a7b9af800c4a", "value": "12288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751284884, "uuid": "70a15951-51c1-40d1-8a40-e1e8eb02b582", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751284884, "uuid": "4f7ba4f9-8923-4bb8-94f7-d0fd77778966", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751284884, "uuid": "e47a57c9-eed3-4663-ad3a-90e0b786dea7", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "310cfa3c-559a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1751278118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278118, "uuid": "72523705-fb32-475f-9fd9-59a330be5a46", "comment": "Malware payload (AgentTesla)", "value": "9d3703cf89bb734621ede17a6503649f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278118, "uuid": "164be2ca-12de-4886-a34d-18f26798dc5c", "comment": "Malware payload (AgentTesla)", "value": "5fb8620612197a7a06e6ec2a6aa9e43c10a0911f5774751d2b2fc97d4613019e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278118, "uuid": "3472226c-cae5-4ab6-a494-2470e51d271f", "comment": "Malware payload (AgentTesla)", "value": "4eb958b7e4ebabcd1e6f501ee89381e1b7a923df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278118, "uuid": "13e6a31b-dd70-4c90-8ce0-9ad72ee3f546", "comment": "Malware payload (AgentTesla)", "value": "aff00cdcec5aa1e6c8ede3d10029c231121413848b88b3dade05cf01582d5c6abd77ff781b1f57b2bd53cdaf34f790c9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278118, "uuid": "2c25f48f-84eb-4ea6-8757-26a33005279f", "value": "T1A4853374ED183180AA3651023A17D6ABBD0B0EB1CF5617BCA699467B1D237F8FD071A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278118, "uuid": "09e894f6-f2e1-4c7f-b6ba-9f2a0e75c47e", "value": "49152:/3RDGnNbEx/H4dfQ2KQoV9gwEbhMB7i1AE/w:/hDGnhEx/HmzKQoI1NI7i1A+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751278118, "uuid": "40367133-b633-43e7-b86e-3fe9f071b922", "value": 1817687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751278118, "uuid": "3fe63beb-01ba-4faa-938c-3df7e22d3c93", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278118, "uuid": "5eda7186-b3bd-4a2b-9e6d-d1da6a477862", "value": "Swift Copy PI_70082517 PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63397a22-5596-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751276484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751276484, "uuid": "bf7e5738-3ad3-4cc3-ae9e-2da2434cc8d4", "comment": "Malware payload", "value": "09b1b4f9317107cd7557fdc41b13fc0e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751276484, "uuid": "c9ead45e-3efe-4bc6-9215-cd2c32a6a2ea", "comment": "Malware payload", "value": "5fe1f09eabb1a5b1509d16b535edb2f32bb3a739e9546a624d14d7af704643e9", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751276484, "uuid": "7bde7c60-a339-4f55-b54b-3079e09df52d", "comment": "Malware payload", "value": "4da592d824e937efd18fe07a3badae6d22c57d6f", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751276484, "uuid": "ca2ca406-0309-4a4c-b0e0-10482eaca734", "comment": "Malware payload", "value": "fe9613ebb7506a9c51db4deeb78d187a2d04642e6bd35fa587f80a27bfb0f0144f52decb8176ef997b59f9a968a66517", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751276484, "uuid": "93b7bea4-ecee-4786-998a-c64d1103c014", "value": "T140D533DB93E550D1C9B7A1378650268421726D2C4CCB9DEA3E8DF15003367BDA9AEB38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751276484, "uuid": "4657e26e-7ee1-4edf-b3b7-016ba6637813", "value": "49152:9YkjB2rEWeKx9qwWjYBu/v0x6/ksy8fk7wJFEEwJFEFwJFEQwJFE3p:XjcAmxMMPvsy8fk7w7pw7yw7dw7Sp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751276484, "uuid": "9d133266-5d16-483e-84e1-77482f63d7ff", "value": 2770730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751276484, "uuid": "2bf847ec-4620-49b5-bb21-4df5508e22ab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751276484, "uuid": "757ee88b-27b0-447b-a991-998c295d5924", "value": "lbo66.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e295d6d-554b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751244156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244156, "uuid": "2058df5b-f66c-4c87-9514-1ee97331cd90", "comment": "Malware payload (Mirai)", "value": "115d5f9665f785e53e6ed5d5be058692", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244156, "uuid": "3de66495-c19b-491b-86a3-36bb57fff278", "comment": "Malware payload (Mirai)", "value": "608e2386fc9ebe24320492edd6d8cc3640c62c3744efa5833806edc1869d4a74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244156, "uuid": "bf5b5e1e-0f14-47ba-a44c-320f4e88a0fa", "comment": "Malware payload (Mirai)", "value": "2f8007cb36d88f7ef49e73dd6a61356279553e34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244156, "uuid": "1dce84d4-14ab-468e-9347-0ebc539ff944", "comment": "Malware payload (Mirai)", "value": "4d47783224730407e409729238df4a6168729cdd31396be66db9ccf7ab47ac034097d923e363a886c3371087a083a427", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244156, "uuid": "319e2b61-5b5b-42f0-8bf3-4fd4421549a3", "value": "T105C35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244156, "uuid": "412844f4-9bc6-430b-b95f-104c655e2f46", "value": "3072:cowpuQyNSG2WRa1styK9flTQPHoArScVM/9OAvjik:cowpuQyNSG2Aa1styKdlTuIArSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751244156, "uuid": "c1ca6c6f-5938-4c37-925c-df581ff4d11e", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751244156, "uuid": "24a10928-0722-4b98-9632-00354d2eae59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244156, "uuid": "60b799d5-9c9b-49fa-b859-c5364ccc4059", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea80052-55f1-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751315561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315561, "uuid": "076347ef-b0b0-42ea-9e61-f98738c2ee62", "comment": "Malware payload", "value": "1acc559f3c4cd7514cf6c1f379c9a166", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315561, "uuid": "d6302f01-503c-4cfd-a858-5bd19a8a0077", "comment": "Malware payload", "value": "61010eb743f73f571ee50aa3a40386db2712ebefba70f65a6c6db935097db90c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315561, "uuid": "dd1f805a-c2ac-4297-9fa7-60312c17b471", "comment": "Malware payload", "value": "79f02a337276cb13331073332730bcdc7d136cc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315561, "uuid": "e4c80b86-69d2-4769-aec6-2d0f64bb127a", "comment": "Malware payload", "value": "4eb957735f887a638fd131b964b53062b509ead4422cf425e975ba7ab46ff466cb3d77dabd3892b25bedf40e3ff2cf67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315561, "uuid": "b4e2afd9-faef-4703-9af6-e56628b5e99f", "value": "T151C42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6D742F661EDB1B424A9E66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315561, "uuid": "9cd5065f-25a3-468b-8e35-812e4f3262ba", "value": "12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751315561, "uuid": "7d9159c9-9677-4469-b645-0c1d61f1580e", "value": 587764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751315561, "uuid": "c64a969f-c6c8-446a-8d16-d4b24fbff2e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315561, "uuid": "3e2e66e4-90ff-4ef2-8e48-7f4d997011b3", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6698e3d-559e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1751280140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280140, "uuid": "768936dc-a195-4901-b771-6df873facee1", "comment": "Malware payload (Gafgyt)", "value": "6238fec11bd49e8c6b7630c1e0764a86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280140, "uuid": "5187340c-2e0e-41b1-bc85-f6bfac81e41f", "comment": "Malware payload (Gafgyt)", "value": "618f17563781c551a2bc693f893d2746ba70e0dd080ffa257aeed7de5184fe4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280140, "uuid": "43c38161-aa2d-4848-a48b-edd4c40b08f7", "comment": "Malware payload (Gafgyt)", "value": "24eef6b327ed12c571f0334f1fa1759284d592d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280140, "uuid": "6b962307-3a9c-45e9-b224-cfc2777e7971", "comment": "Malware payload (Gafgyt)", "value": "69ff5ce261c8c8ff6a1422482294f6af33f44fa3aa8d072925d64bb3278498fbb5419bba557afb5fb0843fd171035664", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280140, "uuid": "74be5667-e35d-482e-b49e-32c7ab2fccff", "value": "T1E6546E46E203C5F3CC420EF1225BBFA90522BB3A4D2B9986FB197DB0AB504C57219FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280140, "uuid": "c2b9ba00-fcff-4271-acf7-99df44d775e8", "value": "6144:WbR9ZTFtAYn1mUHLsn709J5wGtwifI9jZ+SsZjgKGSNnMawCq79g0DY:WlxthQWAS5wGtwFjASsZjgKGSNnMawCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751280140, "uuid": "4af4d664-f174-4bbc-8db4-c7e70890cd9e", "value": 304053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751280140, "uuid": "3b48d4f3-4d66-4592-bf43-9223d5fc764a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280140, "uuid": "6cf51f35-ad54-40d7-b9ce-f75856ec40c6", "value": "x-3.2-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c29a9002-55cd-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751300267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300267, "uuid": "9b7b99e4-244b-4731-acb4-d092caeb0280", "comment": "Malware payload (Mirai)", "value": "d921d6358f8e93cc551f23a80fcdaf83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300267, "uuid": "53c50419-a809-405c-a69d-d936af0d218c", "comment": "Malware payload (Mirai)", "value": "61b7c859316ea98f83307d221ebb0200002399cc6ec182371e49829133d12bf4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300267, "uuid": "f9ac1262-0e28-480c-b91e-0f84dc217b6a", "comment": "Malware payload (Mirai)", "value": "7bd31ac3d6afadd22e5fba07db5ed7f8d91c9ef0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300267, "uuid": "99618f99-deac-4d3e-bd3b-686b9ea48f89", "comment": "Malware payload (Mirai)", "value": "1387e94aed7a6c024180470728465a67858c7ec6b0d051de895644177fd6ff3ce7ea3b21a9e56d29a024768edd14ecfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300267, "uuid": "ab551133-c3a3-4b9c-bca9-bb4d2cca0359", "value": "T15213F24BAD22BC6089711C72DE2A4DF40E625EF5B4C5E1672C5A834839F30E627BD2D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300267, "uuid": "56bc5359-e722-447f-86ca-d8cf1b27913c", "value": "768:pqwcE77f4mkLJMLSmrKHSW7XA2A5V0zOwGSXZATtvNIWXvsCO9q3UEL09:QvE77UMLSR/XA2Az0PG6ZATHFXkCzLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751300267, "uuid": "78e52137-303c-4a94-835e-536fe6ab06a0", "value": 43788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751300267, "uuid": "31448bdc-22fc-4c9c-b509-4f922cba01a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300267, "uuid": "b884109b-7a05-4f0b-bc2b-e832d9905642", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6379e993-558d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751272619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751272619, "uuid": "33fd6467-47ff-4e3c-9b83-ba624238cc8e", "comment": "Malware payload (Mirai)", "value": "988a17a1b8309190de920183f68d7e3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751272619, "uuid": "cc772aa3-07fd-4aa9-827d-c334c8728be2", "comment": "Malware payload (Mirai)", "value": "6249119f9a09b04521d12bd39d8b97407e8312c0ff7137392fe647a179137214", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751272619, "uuid": "859b913c-63e3-40d3-bf70-9e5277bae96b", "comment": "Malware payload (Mirai)", "value": "cb52fb2ba4750c5002c0bbbe1fda46fa5d0d154a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751272619, "uuid": "e1ee38b8-9a9c-4000-b688-1ba1d12d1b9f", "comment": "Malware payload (Mirai)", "value": "0ef27c3e83274008267789c91ef5116ac9dff7edd8c77003ad272e9787bea678098d6f88cdef0471b9ccb07d909f3fab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751272619, "uuid": "a4779a96-f87a-413c-8bd4-e3f133004159", "value": "T171B31A45FC505B17C6C612B7FB4E428D7B2A1798D3EE320399256F60379B9AB0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751272619, "uuid": "112c92f5-8c95-49c0-ad2a-d4a70085774f", "value": "1536:s/hmlgYuky3N220mk26B/J4V1vYJTr6LZZoBtovw/SlwBwywSldT2Wd9xAsLxVFV:chmniMmkr4H6/6L+uYF9Les", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751272619, "uuid": "a8b7c881-f575-478b-983d-21bc4db10a13", "value": 117164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751272619, "uuid": "e8029702-d9a6-4e55-a737-0a44610664f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751272619, "uuid": "6018dcc6-cede-4ae5-aad4-2e192206232f", "value": "cutearm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee9015f-55d9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1751305307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751305307, "uuid": "3a0c65c3-f781-4f63-aa6b-7aa25251baf6", "comment": "Malware payload (RemcosRAT)", "value": "6050e90028e36acef93ebe7544a5e3d9", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751305307, "uuid": "be9ed779-5a54-438e-a921-e58f65587760", "comment": "Malware payload (RemcosRAT)", "value": "624a2bb900ed2b0c54d8305a95394d4641685ffec630776cb4e2a09d9f1c9670", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751305307, "uuid": "a446857b-c9eb-4b5e-95b2-98065e70fce3", "comment": "Malware payload (RemcosRAT)", "value": "9c95053a29a55505a509bce483192ae9276b60db", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751305307, "uuid": "416a8657-e969-4f16-bc4c-7905eb58e298", "comment": "Malware payload (RemcosRAT)", "value": "64e4d4424e808b7b473d77f41fe00b12679b75a29a83a3b3d41490795bbe940aa89b86c9be23b9ac8b87c4ca140cee8f", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751305307, "uuid": "2fa6ec17-83a5-445e-8d3e-5a2a2d57cf91", "value": "T1EE232970D9A6D939080B5194DD0C3435C8AB9466293E0073EDEA93EA3117D4AEFFEF19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751305307, "uuid": "964de70b-7af8-49a4-9c82-caf410f0f51e", "value": "768:uzLGcAKRg698opDS7s8V822ZEXn9zPQbCef3HxfUBT04xffWkm:uzycAcg69BZSI8Vx2Z+xeCe/Rfuvxffs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751305307, "uuid": "e57bdfcc-2c75-41c0-a746-51848889d8f9", "value": 47379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751305307, "uuid": "3084c457-3245-4aa4-afa9-aeea8b259af0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751305307, "uuid": "768c7b4c-558c-4034-87ca-749ed2642bb5", "value": "20250611054726648.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "283642b3-5602-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751322771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322771, "uuid": "73f8aa8e-c9e6-480a-b5a0-b6211b1cb81b", "comment": "Malware payload", "value": "725f5283e34e99eb6fd7d41e301b3edf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322771, "uuid": "2f32008c-95f0-4756-8a06-2f4643781105", "comment": "Malware payload", "value": "62b91c8deeb46ef894dae2f56b555f1cfeca00208f03da05a79c568de34812ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322771, "uuid": "2e29b7e6-a01f-447c-993f-a623eb6db621", "comment": "Malware payload", "value": "375c997c627eee4db422d7e818709c24a77739b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322771, "uuid": "4d7868fa-79c9-468b-affe-b9bb5c022413", "comment": "Malware payload", "value": "dcb86ea23dd5f2b910ef09a447826eb1637b18e90c7f59372fec4dd3fd501019abbedc65fc11de7718ad64194865efef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322771, "uuid": "4e62263e-478c-4d77-8de1-72a3b60754ac", "value": "T1E45302678A7CF3BEDDB0B4F26588464E056A67DCC5495724331A78268B043AE0DCF396", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322771, "uuid": "dbea5021-e542-4b7e-906a-b581d20e20d3", "value": "1536:2nx7pSTlZ3FtM/KFz+EhPVyw77e6tZ9TErGwHQsTKfj0WY2z:2glZ3FtCKXhkmHtZ9TEKzjfj/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751322771, "uuid": "11b784fe-407c-4745-bb35-5a72ccaa1240", "value": 65168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751322771, "uuid": "fbe1bb28-36b0-4e64-9b57-b7b59ebc54ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322771, "uuid": "883f29a1-4272-476d-abe3-5ba68585c048", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb63592-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751243805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243805, "uuid": "e3539db7-4ee0-4000-bf1f-8cad58e2ee54", "comment": "Malware payload (Mirai)", "value": "77ad51ffb1fd086995d199471bfb3b68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243805, "uuid": "6486b4aa-15bc-4077-bf8a-14d724375df2", "comment": "Malware payload (Mirai)", "value": "62eee2a1d9b16ca6e0aac4ec5ebae93ec711f93de4b852fbb35e9e03e51d7355", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243805, "uuid": "afa11c5d-19ad-4e47-9a67-b88365db62c0", "comment": "Malware payload (Mirai)", "value": "4ab484eca3da6330e0d1e25ef34119cc91acfc00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243805, "uuid": "be795b4b-12c2-4f74-bd30-332087221c59", "comment": "Malware payload (Mirai)", "value": "fe295976a3f107c23e473648ddc2bbcf510e9f11af4438a7922f1e8e236e21e5f86aca4fb05e1e3d9cbf3b2f31db80a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243805, "uuid": "87e15504-e071-4fdf-8e3f-d553618d5455", "value": "T1B4338CA3C9262E58D94C66B474249F711763E419C2974FFA1626C7BA9043F8CF60E3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243805, "uuid": "939cb43f-d126-4cf0-ab57-14446459801f", "value": "1536:wa1ciV7C9s/mRwPbaobw7zxuonK3IFsAuO7CCzkx:w3iV7C9s/mRyUuoK38uO7yx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243805, "uuid": "58355849-ac94-4dc5-80c6-eb9f42ad2781", "value": 50680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243805, "uuid": "6a8b33cd-1391-429a-baf4-e04afd92d38d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243805, "uuid": "0a905783-89e0-448a-bf5e-31b0194216b4", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec1b10c-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751243808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243808, "uuid": "4cd91483-52e4-460b-aa20-f7b49083bee4", "comment": "Malware payload (Mirai)", "value": "aa8d30f0179bc6e1796c2429058a16a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243808, "uuid": "bc0523bb-4910-47ed-a9df-2421c21c0ec2", "comment": "Malware payload (Mirai)", "value": "63a2374492929c971bbd0b39f624ddbf90a97b13018b796ba56928e3ef7e8bc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243808, "uuid": "a511431a-9758-4dc6-9c17-a72397321b5b", "comment": "Malware payload (Mirai)", "value": "3ca183d936a42cc469a9d69ff9e6bdb787a50bbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243808, "uuid": "d1837365-691d-430f-bed7-859d48f59c7e", "comment": "Malware payload (Mirai)", "value": "73012d940ac86489255deaf5b556753cde3422ac4df9469e314803c6a3e7944c8f7889a0d406cb97d4bbc9d6902a5f55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243808, "uuid": "81816632-5dab-4d7d-aa6a-d5989b327096", "value": "T1F8A2E13CE2D6AEE5EFBC4F344A52E382B7A80EDA65596D53D5569F0041330532344DF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243808, "uuid": "add7d525-bb75-41a8-9c61-654d143b1b66", "value": "384:7/JywWc84Tp2YshxqlDCvXyA8G1qMJ/Owe7bNtrLMfyjFkQM4uVcqgw05VxJ3:7RxsSVsMDCvXyA88vJ/O5DLMfqFkP4uA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243808, "uuid": "b60c733f-ca59-4d28-be5f-fda2a9c8e022", "value": 21892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243808, "uuid": "e7073db8-d0c3-4c04-81ee-3f961d148a24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243808, "uuid": "d27c4810-4e73-4e15-8b75-d1f6027c89fe", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c648189-55b7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XWorm)", "timestamp": 1751290727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290727, "uuid": "931ac481-0143-4653-9051-bc9442d57bbe", "comment": "Malware payload (XWorm)", "value": "1247bbf35b7f65b0421960f7cb33ee8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290727, "uuid": "4a9c39ad-3d5c-4931-ad77-42ca3c03f5d9", "comment": "Malware payload (XWorm)", "value": "63d9d59c9f36e2496a5842f5fba7a171c270d17319271d6685afda7c38417349", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290727, "uuid": "a9a36a02-cfa0-48a6-af1a-ba0072f5b9ec", "comment": "Malware payload (XWorm)", "value": "1df090cccbe86aaa055474f46d3cca40f530a70c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290727, "uuid": "78b8263c-a4d0-49cb-b7eb-52b068dac311", "comment": "Malware payload (XWorm)", "value": "af54e69325482e4d0251b326875d2438c57802496f95d652ae34784f780711c30eb74d6fbaaf9b7945024a5c94ceceda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290727, "uuid": "f3fd4e0f-d51e-4c26-af10-c908262d7360", "value": "T1DB25DF29E29252E9FD2A80B54562A191B0727923CB391FFF43D4D3339E07AC41B3B765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290727, "uuid": "693ec849-db45-4714-8f46-ab1c25326d18", "value": "74fea8d9720dbfeca2a3ee9f97393036", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290727, "uuid": "4a3c74f9-df88-40aa-89bf-5353fe99a105", "value": "24576:jac2RLuQZ1MHbVbQsatx4G8Icsatx4G8I:g2bVUsatx4GVcsatx4GV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751290727, "uuid": "82eab49c-52eb-4879-8dc3-f4a8045d7164", "value": 991232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751290727, "uuid": "9618fd77-a672-4e87-bb8f-262bdb53459f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290727, "uuid": "ba7a74c6-57ee-45b5-a644-d3f44d8a014b", "value": "1247bbf35b7f65b0421960f7cb33ee8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49182856-556b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751257972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257972, "uuid": "18505bed-ee6d-44ca-83ce-6d2d7c304b5c", "comment": "Malware payload", "value": "9b00e68077218ab66f704542dfec5df0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257972, "uuid": "04b25c94-d6cd-4d74-a2f2-d47554a58918", "comment": "Malware payload", "value": "6416335451fe63c66527a8f50268af15afbb1440839333cc718605b13d85832d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257972, "uuid": "5e7b1d4a-94fc-484b-bb5e-9649b51ca594", "comment": "Malware payload", "value": "3091058f98dee9a2f76119368aee262b3e6b3a9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257972, "uuid": "95b50298-4031-4f83-a9f0-08a47a5bb399", "comment": "Malware payload", "value": "c363fcbefd9021c8a5d69597d0ea1581e0bb405ea3a228da85c2712f92de2f318358cf0a16a06a0f0cf2b92bc2a83b43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257972, "uuid": "2f11585f-d4e8-41ca-8eea-8595915a007d", "value": "T166B402118F881F87C5AFCD750A2E167311AEDD9F46CA643E807CDD48B6A6D0D6783C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257972, "uuid": "b0cd8174-170d-41e9-8879-0169937c0c9d", "value": "12288:7A84JF9Qc8GgZxTM6m1U3snB6NnVuqnAtSyBpywBdlEykR6LkV6N0L8AXwtZJHZz:/M6m1U3rVuqAtSySwY1gEIZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751257972, "uuid": "e4b77dda-083b-4ad3-a9ec-1728889970ad", "value": 509272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751257972, "uuid": "919d9ae0-3e82-4403-bab1-af5c6e4e4d13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257972, "uuid": "560698ed-3788-4e9d-ab7b-565a25cc2cf2", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ea4492-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751291226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291226, "uuid": "bdd33d4f-64d9-4d31-94d1-8a078d8890dc", "comment": "Malware payload (Mirai)", "value": "4c44de8001d2e9deee5b6a34df9e17db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291226, "uuid": "fae6d249-e7be-465e-b864-c250835d6536", "comment": "Malware payload (Mirai)", "value": "644f643b6c947559d4f88298092f8356496a8575492ac1a504d12e065fd313db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291226, "uuid": "2f959dbc-13f4-4e72-aac4-807e642f288f", "comment": "Malware payload (Mirai)", "value": "8c5acbfd3c184c00e6e4e060c934239ee3b9f39e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291226, "uuid": "596350c5-8d7a-4389-8764-a6d02c5bc78a", "comment": "Malware payload (Mirai)", "value": "8af7afc61776795b8cebe1457659969ad8bac007546629d0313bd94ef484b3102b30e1b8bb4bef7ac58d3c10c9282d18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291226, "uuid": "97839525-b1d9-4e42-8bc6-682fa81d7fb8", "value": "T1D9639409BFA10FF7ECAFDD3749A91B45248D641621A87F39B934D818F34B64B09E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291226, "uuid": "3e99943b-dccd-41c0-bcd9-c5a4198d9859", "value": "1536:LYFomVTrnNiBBei4Je75Q7sjwZol8M1poG4/KVYmO:kFomVTrNioeGum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291226, "uuid": "d484da16-c0e8-4aa9-bc9f-fc4f6d4e1fbc", "value": 73048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291226, "uuid": "11b2e780-8bc4-4967-b319-032e8a07bc41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291226, "uuid": "c12f6986-5045-4062-83c2-1e1e3497a388", "value": "miraint.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d8321bc-556d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751258812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751258812, "uuid": "c9ea5a30-31c3-4805-94d3-2a1c8f337420", "comment": "Malware payload", "value": "3c649bd4bda4a53a4a9d793e88ade6db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751258812, "uuid": "bb5196ce-67b1-4615-9ef1-3f289942b011", "comment": "Malware payload", "value": "6450d61f84cff07d26ef7a9ef66964b1795e742f8749ffda7b9a6bc981105151", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751258812, "uuid": "82a5ce4c-794c-4b32-aee0-3d4ec58d52d2", "comment": "Malware payload", "value": "7437969909c4e56901d193a1037cf9ef84f3334d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751258812, "uuid": "7924fa06-fa67-4ba4-bf00-49bfde29bf12", "comment": "Malware payload", "value": "3064d1fe6cd371d4f8de5f0936cc6d82939981807bebf64e6a4a3c5e85451b99795e8380686ce825d87118a7fb368f04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751258812, "uuid": "a5fafe0a-5b6c-4a28-a1f7-4b6ac7d73b97", "value": "T159E412017F152032C9D21AF0A8B747B4EB914CD650B4D6777749EB222BF36362C8BB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751258812, "uuid": "5706981c-1754-4c04-9a5d-10eb14dc7563", "value": "12288:XeBWVNQiXY8aap1qXG2YmzwcyxDKsFM+t9j+9+X:uQQAYLapnLmzwhtLy+t9j+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751258812, "uuid": "67b07d0d-ad1b-4a3e-b328-ee45c7c58e64", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751258812, "uuid": "81a2ee4e-df79-43f3-8c8c-0a1d19578727", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751258812, "uuid": "1527f319-ba61-40b8-92a8-a4f7580ad202", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b827467b-55bb-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751292518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292518, "uuid": "552adb9d-06ca-4ae0-8298-f363a90ad4d1", "comment": "Malware payload (Mirai)", "value": "2ed0b2677c5d433121c45970d6a6f659", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292518, "uuid": "497fa01b-7f6a-4003-aaff-1f16a4a6cca6", "comment": "Malware payload (Mirai)", "value": "64d584cf6157fa4fbb35e383725df209e9313ead7e58ece6f45a4e1da79f17fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292518, "uuid": "d47acd75-ae1b-4695-a05c-63c9443d0336", "comment": "Malware payload (Mirai)", "value": "41bff16a49e3d9417cc4537f3bc02480cfbe81fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292518, "uuid": "bde93177-a9e0-464e-a607-a460655ef40b", "comment": "Malware payload (Mirai)", "value": "3ed7c6bad2387affbb1288f5967e025986fbcf1a79b7553d2cd307e8e6091fe548990c79d93531966e0b7ac95c191915", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292518, "uuid": "a00795c8-2c4b-47bb-b32c-8be1969071da", "value": "T1B21302CCC2ECD887DD8E5DB982E6031486C9F082C4E58EED97678DDA4D7596BB4024AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292518, "uuid": "d4cf9e5a-9a17-4410-8901-a0f654aadc66", "value": "768:D90zMgpBt/+ohMkB2F66R2dNf9mjwP/widQHd0StuHW53v/bzvOsVLUT6RecBr4I:D90bpThMkugdlhHw+MK4//bLnqeUcSkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751292518, "uuid": "5d5cf1a0-ad84-42bc-b1c1-3c9eb07cc94a", "value": 42284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751292518, "uuid": "72373bc3-f43e-4c5e-81c9-070ce8e13245", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292518, "uuid": "de366b6e-2997-464e-bfb3-e28ecdbfd50f", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad037a99-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751291211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291211, "uuid": "a707bca6-57e0-4144-9c40-7b5124dd5fb4", "comment": "Malware payload (Mirai)", "value": "9baf8a0d4c8152bf878aa0af82eacbfd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291211, "uuid": "85cba81e-d4e9-43df-a2eb-aa59343ff718", "comment": "Malware payload (Mirai)", "value": "65c02bb577f9ddf74f459a357ce0922270f70d2a870760d9a99d2d7582f85893", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291211, "uuid": "bca51d2a-df1f-46ec-9eeb-f0265184e9d4", "comment": "Malware payload (Mirai)", "value": "fb8088db9158ee61d2c7aaa6d64aeeaef58336e3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291211, "uuid": "8460cf38-8a7d-4156-b907-d85a333ba306", "comment": "Malware payload (Mirai)", "value": "23133682acb894fd42ecf930b7f5cc86e347f6f773fbf40a862591eb488616cbca9294a9d3695436fce988d8b87e8df4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291211, "uuid": "bad04228-bd51-4bc0-ab3e-17a8f709a397", "value": "T104513BCA14A229B82EA7DD93717E4AC07181DE9A50C65F2DD8DD78F444DDE087060BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291211, "uuid": "26324544-fc63-4057-8b0b-611e589fb67c", "value": "48:vOvmvssSja9aUks2bGOTS8J5IO6PuufuB:vOeSmUe26OTSG5IO6PuOuB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291211, "uuid": "06551548-3a52-4b92-8d55-3111ca8f28a8", "value": 2460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291211, "uuid": "648bf538-f879-42d3-ba2b-0dc53c3aa81c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291211, "uuid": "084848b4-50f9-4062-9167-7e6a4277a10f", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb0dfe98-55ae-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751287047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751287047, "uuid": "c0f8f32a-a035-4eac-9a76-70edec380367", "comment": "Malware payload", "value": "27a6004e66430246d9a913c9cdc525a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751287047, "uuid": "f27897b8-cb29-44e7-bd19-379e3b1d9020", "comment": "Malware payload", "value": "660ffb40a47c97a704cc2195b799df2e233fc2b5573f3c69cccf2d14011877b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751287047, "uuid": "5cd44ffa-0711-4323-a190-cf6bbb22aca5", "comment": "Malware payload", "value": "4059af21b36e517d2bb2dc419759a9ed5ca831a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751287047, "uuid": "029cf6d4-a3c1-4dc6-befc-ab7caab26701", "comment": "Malware payload", "value": "6af38e6a56e1a221299ff3a24f80cb40ea5fb8779f7e504066d06cda55168a4a72c6ccfef0c6458c603fddc23cfe8a12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751287047, "uuid": "99a7f748-c10d-4cbb-8525-f904ba4f4813", "value": "T14EE412017F152032C9D21AF0A8B747B4EB914CD650B4D6777749EB222BF36362C8BB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751287047, "uuid": "842afee3-874a-44f7-9321-d115309dfdff", "value": "12288:XeBWVNQiXY8aap1qXG2YmzwcyxDKsFM+t9j+9+X:uQQAYLapnLmzwhtLy+t9j+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751287047, "uuid": "3bbb1a8c-af6b-47b2-9bc6-55e6e767712b", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751287047, "uuid": "b391a6c6-8f0b-4137-9c25-1478438e6b85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751287047, "uuid": "d20172ed-1688-4118-bf12-26e9689a982e", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ae2818-55d7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1751304615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304615, "uuid": "0e15e03c-f812-4cd3-8d4a-63450d4c0d34", "comment": "Malware payload (AsyncRAT)", "value": "c14713185f416e03d6847fa372814725", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304615, "uuid": "852abe90-8a76-486f-9b5a-df61010d0860", "comment": "Malware payload (AsyncRAT)", "value": "6729b2ff4690b89dc85f5cea710265ebcb43b00356e9d8a0e901aa335f79776c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304615, "uuid": "25533275-7aa5-49d5-9880-df0e0d2a7604", "comment": "Malware payload (AsyncRAT)", "value": "b38195730660aa834137c9fcfd5daebfab0e8401", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304615, "uuid": "05d762b7-8a9d-425e-8c8a-01d8c9547386", "comment": "Malware payload (AsyncRAT)", "value": "1ba8766b2981282b9c05bf1b6b9ba98f93e9fdac39ac5bac682a999886880e37aa985ca21ab0e89e72382a92f69def36", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751304615, "uuid": "87b927df-3700-42b7-bd07-1e4941efb619", "value": "T1A6232C003BE8822BF2BE4F749DF26145867AF2A72603D54D1CC451DB5A13FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751304615, "uuid": "4154016a-cbe0-4736-95ee-3b90b348a2a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751304615, "uuid": "5bbbcabd-3327-406e-8e28-8c705d8075f1", "value": "768:LuyzN5T7w0vqWU8Cuzmo2qQWKjGKG6PIyzjbFgX3iw1cSBsMHRYekQBDZbx:LuyzN5T7XL2mKYDy3bCXSJSBvLdbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751304615, "uuid": "cde3dd00-8167-437f-9378-78d8b79b5b95", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751304615, "uuid": "e96a04d8-4fa4-4c1e-8edb-569e54e09e54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751304615, "uuid": "ab847fd9-c16b-4b46-a045-68d740d3da6d", "value": "async.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c729bf-5580-11f0-8bd0-42010a9c0005", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1751266977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266977, "uuid": "0b2492f3-bc55-4374-9474-cd5d765401a3", "comment": "Malware payload (VIPKeylogger)", "value": "34c15e101298120a22019d387a6b524e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266977, "uuid": "fd060fab-7124-472f-8db8-9c3dea53baf6", "comment": "Malware payload (VIPKeylogger)", "value": "674173e5442f7f335b491c2fda768a473a0e4c86dc60b1373b367961af715533", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266977, "uuid": "711b6c0b-80dd-44a7-b151-a50be33f898e", "comment": "Malware payload (VIPKeylogger)", "value": "98e727817df98e5c588f671d21cda7fefb16c36b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266977, "uuid": "3a0cced0-2f5d-4087-8e63-f9a03302fae6", "comment": "Malware payload (VIPKeylogger)", "value": "e531d4691ac1d4cc347ad1c0f92aca393b6aa90a4e8f0193e22c6f6a90532d3592339c5af416efe7dc0341c5e79f06db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266977, "uuid": "eff51fad-b569-4857-837e-4b24d46d4380", "value": "T1760512033764579BFB7602310E2454563F95AD591B84C28B72E03E2B38F7FC2636AE5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266977, "uuid": "897b5a0a-4d38-44b9-8c57-62367ceb96d2", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266977, "uuid": "594c8513-3ce7-446d-b3ee-41b01d6a6bfc", "value": "12288:ZgTBQ3wQy+nMs/EiMOkcn0jBqKSkB8Xvf7eMqclb3kCjP51Mi4kpWhEFUkDfd2:ZglB+Mz4n0m/LNvjPakpWq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751266977, "uuid": "b655d89e-8a2a-4e6a-8618-175f053b94fc", "value": 840344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751266977, "uuid": "c6280e63-45d0-441b-b7b5-1f5a56d82b6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266977, "uuid": "fffab42a-6269-4cad-8cad-32101ed079ef", "value": "Intraprocess196.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46fc8f71-5572-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751260975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260975, "uuid": "4adf4e61-6959-4b3d-9390-592b2fc57746", "comment": "Malware payload (Mirai)", "value": "043b1e7257b9bad4e9a66c140245808e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260975, "uuid": "fcfa8a1e-e3fe-4758-8d0b-f115919aeccb", "comment": "Malware payload (Mirai)", "value": "67a419a891bdf6362e9e7f2fac036b688fcd2f25dd101d393c275329d9c5be1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260975, "uuid": "02d559dc-cde9-4d5d-bce4-7aa9a3a69795", "comment": "Malware payload (Mirai)", "value": "ce74b5e7c7b2066190d9cfd9155d28d8990af0f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260975, "uuid": "d629b945-d1a9-4054-b548-8277515a7fb7", "comment": "Malware payload (Mirai)", "value": "0433d8930078ab2cc4d0cc9aaa9f46cb3200315e6c6d1287caaf37eaac613403152d5240746008aa56cf65c05a4ef699", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751260975, "uuid": "4eaad455-53c9-4b1f-8022-e30e19eb81fc", "value": "T132D3A30E6E219F7DF2B9D33447B74F31A29973D622E1C585E26DD1012FA024E681FB68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751260975, "uuid": "12eea161-e96b-40f1-8845-972108f6f7a8", "value": "1536:/2jA4lWmnxhsiBhnHk/bXnPrY3EJIp8iUlely07Hd/UAXQqUt/DpZe8kdbwIK8EU:ybsLhiUp07Hd/UiQl/Dp2wQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751260975, "uuid": "f509d37f-5772-444a-9061-f253ac748dac", "value": 133116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751260975, "uuid": "11b909e7-764d-4d6f-89d5-89ddd00de531", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751260975, "uuid": "09285097-ee89-43f8-ac2c-8a3d012d69fb", "value": "rondo.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4450c70f-55f0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751315087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315087, "uuid": "a626bcb1-62ed-4b8f-b49b-d69bb42ab7e0", "comment": "Malware payload (Mirai)", "value": "622099323c81361f6ed1e55a88f4e624", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315087, "uuid": "c4071b28-e0c4-4c6e-aacc-0ba6fe655db8", "comment": "Malware payload (Mirai)", "value": "67a988d5fa296769a3f7c81d78f8e48a89afe0df9d324f4cce1d065f387802dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315087, "uuid": "2fabdd81-2d03-4bd7-ae24-45ae439b58f2", "comment": "Malware payload (Mirai)", "value": "9babc7a1011d98b239a7a28515b49c9f252ec112", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315087, "uuid": "fb30f023-ddf4-4a85-ac19-c8980fa0a44f", "comment": "Malware payload (Mirai)", "value": "67d328c8b9422fd0d4c2617d14018ca8f413fb2a41f90f18fa75139d0807b51a32fec7c3359ed29d38e77dfc8c7c1538", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315087, "uuid": "3397b281-49cd-46d3-b898-f698c0fa171a", "value": "T13AA3D809AFA10FFBE86FDD374AE9070125CC692A22B93F757574D418F24B24B19E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315087, "uuid": "1ff18f9a-03a8-439d-b390-fae9aec2041d", "value": "1536:9+TtwN5BdhsS5qxmKOvHb8KO0dKkdA5Eb5x37jZWQZT1l4:9+WTdhsS5qxmp2eb5lj7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751315087, "uuid": "b6ebae88-da7e-40fe-95db-a9d4374804d8", "value": 102116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751315087, "uuid": "00d7f29e-b3e3-413a-a389-f215513d8ada", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315087, "uuid": "4ac22762-025f-4486-923d-09e38d44949f", "value": "SecuriteInfo.com.Linux.Siggen.9999.29054.32207", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e283cb-559b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1751278529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278529, "uuid": "eb667544-c998-42ae-96d5-6271d278e1c0", "comment": "Malware payload (Formbook)", "value": "0a43a76fee01986588269079f77a5b85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278529, "uuid": "24afc5f4-4294-454e-8d90-78ab817ff54b", "comment": "Malware payload (Formbook)", "value": "67b5745d7215d4b982cab9660025a15f49bcb6e97924955278f5bacd1f6d63e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278529, "uuid": "0d34d511-8292-4083-8173-9feaf6c38f1c", "comment": "Malware payload (Formbook)", "value": "53ad414633a6c2ba2005116f78fbadb9272d4212", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278529, "uuid": "925865e3-9dcc-4220-936b-b1a04474c4e6", "comment": "Malware payload (Formbook)", "value": "409b706d504d55f1c666c6797207aa9f1f624b29d76e62b8ce2c962820bbf41b9ad1dba38f73e5a5dfcfb66c6bb06634", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278529, "uuid": "178ee083-219a-40d8-8517-98c7a3ba1963", "value": "T1BE85CFC96281C972E1121F34FD2AAFAC582D392A1B1C7541FFB25C4C8E3AE5155293BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278529, "uuid": "e92e5174-ff57-41c0-9064-692a91254032", "value": "c22ad9a73fbee1dcfab5f458e0faa7ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278529, "uuid": "daa13193-7132-429f-ae77-0b0c8034daa3", "value": "24576:QurjPj9GcVUCIrfsqmIJebXLLJP1dmhVAeU7Zap/FtqmJ8F3ZVHYt/:FvneRJeQnEd+TqmJ8F3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751278529, "uuid": "132c0148-bca3-423d-a891-a2d859bb35bd", "value": 1720320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751278529, "uuid": "8601f7d1-f1b6-43c6-a8e5-c0b982960163", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278529, "uuid": "03f22ca7-b60d-446f-8440-d55eac56bc49", "value": "invoice details PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6a8d615-559f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751280570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280570, "uuid": "8ba5cf4d-0451-4cad-949c-3a118135d30e", "comment": "Malware payload (Mirai)", "value": "271a648b641e9f5dad0bb6a3c06a81ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280570, "uuid": "a674dbc7-9fa5-4168-877b-57a2ac717f52", "comment": "Malware payload (Mirai)", "value": "67bbebd516075688af254fe02b1018e8d63bf58f4d9b93788030579d1e0b27f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280570, "uuid": "4fea8775-2b9f-4b12-b49c-5856d5c5bf76", "comment": "Malware payload (Mirai)", "value": "cb18995b3bb89443655de4e94a468fadb7c51093", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280570, "uuid": "f30c287b-ed55-478c-b387-add1942d3e7f", "comment": "Malware payload (Mirai)", "value": "e368087ddc485b1f6e642021b01355e9dcdb45541a558ae4e07a1fd607a52b60047c7ab0b29b7a1d4c6b1bbae293ed49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280570, "uuid": "d9f6548f-453d-4e91-bcf9-4af079272b9f", "value": "T16AF32B46EB818A13C0D62779B69F424633239B54D3EB33069928BFF43F8679E0E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280570, "uuid": "cc930ffd-3d98-43ac-bb10-047ac7f70f24", "value": "3072:iI0sMIrUhQaBqqrBmdMOlDPQCw/H0FMXyJT0M/9CW4:iI0eKQaBqqrBmyOlUCoHKMXyJAM/9N4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751280570, "uuid": "35439aec-6b12-4dd5-8f50-72eaf76a72fb", "value": 170820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751280570, "uuid": "ee4849af-45be-4b7b-92dd-3bacd42826c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280570, "uuid": "9d3fb03a-b37e-4638-8273-9d02238a0754", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81658506-55dd-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751307029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307029, "uuid": "d7a2cb34-bdce-474e-a12e-e0cd377d0e68", "comment": "Malware payload", "value": "6b31bd1e81f7699215e6bf91522ffce8", "object_relation": "md5", "Tag": [ { "name": "ai", "colour": "#8C207A", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "KBC", "colour": "#C2D063", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307029, "uuid": "d42dc609-21e9-496f-afa9-a5b522a30143", "comment": "Malware payload", "value": "67bfeff206d078ea46106d590dfe1aedf62656f82c49b18478d4bc74a1bb335c", "object_relation": "sha256", "Tag": [ { "name": "ai", "colour": "#8C207A", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "KBC", "colour": "#C2D063", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307029, "uuid": "a3cbdb9f-1528-416d-9adc-b871f22b8dfb", "comment": "Malware payload", "value": "34a1fe0cd7aa4fcbe9e3fb68ea7604fbd766eacd", "object_relation": "sha1", "Tag": [ { "name": "ai", "colour": "#8C207A", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "KBC", "colour": "#C2D063", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307029, "uuid": "30a78cdb-c8bb-4061-9f01-07d33058bd5f", "comment": "Malware payload", "value": "11a02200c385ecf7b997a0db7e7f37ed78c923d21aff2274072cfd5d565487d2de0cf0789429895c41d3ec233edf1972", "object_relation": "sha3-384", "Tag": [ { "name": "ai", "colour": "#8C207A", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "KBC", "colour": "#C2D063", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307029, "uuid": "9a744e4b-846b-4ef8-ba5b-347aaa7e8bf5", "value": "T14F472397FB44A85BC0F797B2417A8322514B4C268B83D6C39914723C29BB6D07F5AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307029, "uuid": "f51b25d6-8c29-4633-a76c-c48f8f0d30c5", "value": "393216:LU0kpjyutNCXLKjXSitezRZzGeLvpW7749O2cw5lZB5Enz1UZA2GLMGMIwCsugQt:LUVjjYqSxHGerU4A2cw5VNIFNp8cL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751307029, "uuid": "be79d8eb-e2a3-4fe0-ac7e-aa5cd24c129f", "value": 24830816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751307029, "uuid": "4e81a16f-5eaa-45d3-b698-1ef20b2cbec5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307029, "uuid": "2f80a1b1-0c0a-476d-a7a8-d7d02daffcad", "value": "kbc.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e15bc2b-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751243807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243807, "uuid": "493aad00-a3a5-4ce3-bcaf-c6f8a53c7a8f", "comment": "Malware payload (Mirai)", "value": "44dc7a6c6ae654d97004c1c237bd813c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243807, "uuid": "f48fed3c-5ffe-49a3-9d23-388f404b3152", "comment": "Malware payload (Mirai)", "value": "67f845d63c328c5db9cb64ea1a835e7338ba5ee9c406af6d2f6a67e3ac318fcc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243807, "uuid": "1a0ad109-bf68-412d-b3b8-5e5d15601dbc", "comment": "Malware payload (Mirai)", "value": "93430d707c36272488224f03862bb70376ef6751", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243807, "uuid": "413a249d-3863-4213-8a7c-810037df557c", "comment": "Malware payload (Mirai)", "value": "72fef67b8170d6ff2438905470a87d93e5d0a2594738826fcf45e6975d61e03389b0cb3e2400bfd3282f7770fb82de97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243807, "uuid": "95c34521-fe4f-4853-85fe-caf582acd717", "value": "T1EFA2D11572532D65E3ED2C3DC96E8367B9A71BFC80F5327679415620C90D24A3E38A4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243807, "uuid": "7bb24a8f-c720-4a68-ab48-7d863e35aed6", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxj5hhymdGUop5h3:vvQn4j+ZO5fKAlxTs3Uozd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243807, "uuid": "61a525ae-aa20-4955-9aa1-28671354e3bd", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243807, "uuid": "e3303171-d48c-4c6c-908d-6cccaf465a81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243807, "uuid": "9e54def9-7d80-4138-98d2-f0fd080c28b2", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c8df9d-559d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751279406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279406, "uuid": "3700b113-4b22-464e-aa83-f4293db79197", "comment": "Malware payload (Mirai)", "value": "1c0c36e0be387cd8d20ca5e02dd41db5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279406, "uuid": "cfb56c31-1789-4cdb-923b-27feda0f402a", "comment": "Malware payload (Mirai)", "value": "6826c146e45304506c616518c6c35b38bd556bc14edd6dbeaaa1c9fa915aa964", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279406, "uuid": "98ce5d5a-298d-42a7-b0c0-c6637e506072", "comment": "Malware payload (Mirai)", "value": "17656b8b4b55160484185a48e18431d38e935659", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279406, "uuid": "731e3c6f-6798-41d0-bb41-79090cb2900a", "comment": "Malware payload (Mirai)", "value": "aa3595412c94ac8277251e38e833370c49d8138bc14be93ab5757266b202eaaac2d9ffa94068feb7c0fdbd79fff7fa7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279406, "uuid": "361e31e4-2dfc-4f7f-af95-e313dd830761", "value": "T1C1C30A45F8518B13C6C611B7FB8E428D7B2A17D8E3EE720399256F60378B86B0E37546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279406, "uuid": "c13ff95f-58f3-4ead-b8e8-5df040981abf", "value": "1536:l60DmDT/kDfk4k3N4A2OrPQ4VQsQTvrmFsM7cvE86gUvg+hpCwlOEwywXR2lHJ+n:l60zFO4Ao4VQHmaMIvYxvg6AS1Ji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751279406, "uuid": "4a9181e1-34ff-46f6-b617-5e017b759f6f", "value": 121632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751279406, "uuid": "6073348b-a7b8-4207-9ac3-26c4c2c174fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279406, "uuid": "34571415-3eab-42bf-85dc-0dd650f70ae7", "value": "cutearm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f60f1c-555d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751251979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751251979, "uuid": "10b20201-1f5e-4764-a556-218ca1d0c0b7", "comment": "Malware payload", "value": "4d6f432da8f5e36b8b49eb5b9278b51b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751251979, "uuid": "372476a4-1377-4516-b5b9-8f97c2e55929", "comment": "Malware payload", "value": "68678892e205ad4ef59a0d0a91e2387dcba929985b66c157fa13a4366347834d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751251979, "uuid": "2382a952-d92c-4584-a249-cf2a2a3f212e", "comment": "Malware payload", "value": "c3873d4f50a540fd1d829c7afaba9ba0809cabaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751251979, "uuid": "9fe5abfe-96e0-4da3-8283-4d8acb92d8fc", "comment": "Malware payload", "value": "fbba146e739fbd7c07261eaeb566d2deebd6f1e911f30682614750b81a8fae8afa697104b8ad7d625ef63ea3f371539f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751251979, "uuid": "00b0ed22-2e43-4125-9dc7-0df50b18e67f", "value": "T161B41228EF4E3881F3D1E378DA0A4BB1B05B79D0D166C1B2BA41E25D95EDDDEC5D0212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751251979, "uuid": "c054b07f-9593-42a6-ab93-55e9e1624f64", "value": "6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751251979, "uuid": "5d0baed0-e94b-4b43-b892-b0bbdf89f113", "value": 509896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751251979, "uuid": "688cb5fe-29d0-4a7f-9c82-0fddfdab735b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751251979, "uuid": "3b295eb5-0a8b-467d-955f-edba57a29811", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c785bc-559f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751280547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280547, "uuid": "b1d854dd-b1b0-41bc-b953-fb5cf966a820", "comment": "Malware payload (Mirai)", "value": "afa1be8a96b488e728755c57e18a34b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280547, "uuid": "4ed31c1c-2b26-442f-b2f5-61012fb98fe8", "comment": "Malware payload (Mirai)", "value": "68d72f36d3b2ca05cea6c04174bdc681067ad213ae861dbec33b7e11face4701", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280547, "uuid": "a936e04e-18db-4e5f-97bf-741cf5967e1d", "comment": "Malware payload (Mirai)", "value": "dc75b66266fa277a53f2f40db7dac8054487350f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280547, "uuid": "971c13f3-6e16-4bbe-a30a-2ee36885b387", "comment": "Malware payload (Mirai)", "value": "f772ca00dd9ae0eb496c89ec17caeb88ff88a0cd1d7df939546e73be714947eaccb076c99b23bd122327383210aaf017", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280547, "uuid": "a747ee54-7dbf-46f9-89bd-02d28d4f0517", "value": "T13C03F19BE6F90356C11D42394CCFB98F1E41901E2EE549F6E3D038B86483B6C5B2C791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280547, "uuid": "69235895-9969-41ab-a10a-41e7a7b290cd", "value": "768:Qc9tl10qru92z7klcYlMiYxvkcOsLZemYH1C3PByLpVUpwonbcuyD7UHQRjY:1l10qPzwlcs3sOsAkP6pVUpwonouy8Hj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751280547, "uuid": "8a0ada63-2e69-41bb-900a-42054a101486", "value": 37860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751280547, "uuid": "c8b2b74c-1d3c-4c9d-bf3e-51803d5f644f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280547, "uuid": "ccc12697-3769-42a7-af4a-b6e1fb17a26f", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461dfe8b-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751291038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291038, "uuid": "9b547700-0dfb-4f6b-9c45-f7abcb515dd0", "comment": "Malware payload", "value": "e52d2a071b928408a0a0960d9578ee94", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291038, "uuid": "eed04751-9ef9-433d-9287-71280ea4065e", "comment": "Malware payload", "value": "69ba1107f48ebec826472c3ec904241ebc5413c0b725628039e0ae51b22dcc4c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291038, "uuid": "e9adaab1-e10d-403c-a0e9-a757dab765a6", "comment": "Malware payload", "value": "cb72d775765c3f3210132e43054d857468c1177e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291038, "uuid": "7dcd0dc0-a4dd-48ac-8784-29bdc660e960", "comment": "Malware payload", "value": "cf7429803d150e120c1883709809b23bac6e999e90fbdc02c733cf53d03074b6511d26569a10ad5b28fa9a6d297a319f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291038, "uuid": "1768f86d-6c03-4462-a7af-0c19e93def0b", "value": "T156658E07B3B401ACD1ABC179C9175A0BEBB2740517749BDF57908AAA6F23FE1167E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291038, "uuid": "5ebd4eee-6bed-4772-8960-74bb98e17065", "value": "bf5c4fc53c89284579e9ef13e4eac16c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291038, "uuid": "cc4fb5c7-ec58-420b-9348-809ae8d5aeee", "value": "24576:4++rRXhPERfmWZgX4CbErekQt17wIvrwk6Ms:uR89H8sIvrw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291038, "uuid": "ca774c13-8ba6-4736-a1e6-69a211f5e06d", "value": 1454080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291038, "uuid": "f7529241-dd5d-4eaf-a4e3-ffd1fc2e4d4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291038, "uuid": "fdb9c1ef-b67e-4ed6-8fdd-9a2d0a2abb61", "value": "e52d2a071b928408a0a0960d9578ee94.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5b9bf4-55b7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751290911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290911, "uuid": "33ad0cde-dc12-46de-977b-704ec221dd2c", "comment": "Malware payload (Mirai)", "value": "03d1d1233b205284e02f8df93e99c67f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290911, "uuid": "ebef212a-2636-4b3f-9f1a-9056430c6397", "comment": "Malware payload (Mirai)", "value": "6a3ada7e04861794eccbda3a4e93f8f5671c35d9dcc5414b0ef3bec782dad09d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290911, "uuid": "ecf5366e-7bfd-44e1-be49-308e9f343d24", "comment": "Malware payload (Mirai)", "value": "c0acdc121198cf83fbb1fb9e060ec66ba0997dce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290911, "uuid": "e69c954a-f25a-444c-84e0-a26490fd20b1", "comment": "Malware payload (Mirai)", "value": "78b2ac18c9767ae305be57e5b79b3ae93102160e0b250bc2fdc97d893ac0706eae83f982d9148984483836654ae9c089", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290911, "uuid": "933a2f06-626b-419b-bf59-6d96a4945f89", "value": "T162533ADAF400DE7CF98FEBBA80128909FA25631151930F2B6677FE932C720A54D97D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290911, "uuid": "3be2d31f-e612-47d4-b122-18b3218161e8", "value": "1536:4sb2cXq9x+xXs5biTYIoKsI9cppTz8qZMf+Roh80L:k9gxXs50ZcplzE+CV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751290911, "uuid": "fccf9cdd-2338-4d2c-b502-a86505d83d4a", "value": 60724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751290911, "uuid": "dd53959f-0f2d-4926-8afe-e6a8ad377471", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290911, "uuid": "83834195-b26c-4de2-9464-8d3f5f4e9cde", "value": "mirai.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f1e0bd-55b6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751290337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290337, "uuid": "f5b3a06f-663b-42d5-a310-bec464f5ffc9", "comment": "Malware payload (Mirai)", "value": "dbbb7ee1914ad122afdefbe87b000135", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290337, "uuid": "ba32d79f-497c-4b9a-ad06-a0398973a079", "comment": "Malware payload (Mirai)", "value": "6aacd36d6c59333405dad210656dd979245fe5921ad10982a7b61b292380b68e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290337, "uuid": "8d932bbb-66c7-4de9-b3bc-72244043a28f", "comment": "Malware payload (Mirai)", "value": "90c04ade2d39f00b918adc141edc61d039c0e4c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290337, "uuid": "54a88304-b2e7-49b2-97dd-718b1a5b38ac", "comment": "Malware payload (Mirai)", "value": "9d4d7a0300863a476bd3b1fb386e605487ed0bb5b16745ccccd895a2d7e2ea8797cd29c9b4b1e147fb80c95b6ceb71b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290337, "uuid": "3504b648-0a3c-4fec-babe-cc939b296135", "value": "T11E933985B9416626C7C146BBFF1F028D371A57A8D2EA7303DD281FA0778B85B0E27746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290337, "uuid": "43e2dc9c-8e1a-4af1-b4d1-ad3b2256e51b", "value": "1536:q7gRT6WMmcNlL433Sv4rUx1vzRfU2+s0RNucNcX4ClrOB9hMvVQkfvzWnO:q7gVxczL4yZxLM23QwcNcJjXCnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751290337, "uuid": "a6c832bc-d5a3-4d97-8ff9-d5bb69d8bc0d", "value": 93568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751290337, "uuid": "13f9b150-9424-4bfd-b1d7-bddfb0f3153c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290337, "uuid": "061a3f76-6fb4-403d-ab53-38b204cc7c45", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5229608c-559e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751279892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279892, "uuid": "c154906b-e256-4315-94ef-1897fa2befb6", "comment": "Malware payload (Mirai)", "value": "a9bddd7c6f2367a5f9230dcb5b25fb95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279892, "uuid": "6425c5c0-87bd-4069-a200-bb35f2451451", "comment": "Malware payload (Mirai)", "value": "6acee7726fd32427c9fdfcb97633a3e89e545745f64a0f389a929c82cc4082c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279892, "uuid": "189875f7-1c18-4c07-9962-d9fa0cd2a9d9", "comment": "Malware payload (Mirai)", "value": "9f7e978407555bafbc63f2d546f462da9e7de5a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279892, "uuid": "61c5bc04-b532-46d5-a3b9-59a2bf426d94", "comment": "Malware payload (Mirai)", "value": "21e139176098485e4e97df6980943d6189bb881a480c48e802afb39610bc9b7fbb735396af52f1f009944d49f8b61870", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279892, "uuid": "29d6f3ab-c59c-4020-8a67-3b048e3c3495", "value": "T19803F14170D18661D9345CB18B79DE1F2D334FC6A27D70361B366FB0A8DA6112BBD44E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279892, "uuid": "cba3abfd-75ec-4197-945f-7c47ebef4351", "value": "768:LHRLSTa5JtmEryska5azulfC6d1lkuB5i5MxOsSwTuJZYOqh7s3Uoz8:LHdR5WsyhruNC6d1lkuB5oMnSwIZYqz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751279892, "uuid": "2f36e269-7fc3-49ca-a9c5-b8a25672a6bd", "value": 39988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751279892, "uuid": "afaa3ec4-ad51-42cb-b57e-b1a62fce91b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279892, "uuid": "2ec0f744-6692-4adc-8336-f16d28faf911", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c188f22-5584-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751268768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751268768, "uuid": "f4088068-24fb-483e-b148-78f548e07631", "comment": "Malware payload", "value": "7eba9142682b11ebe7b92921446c2199", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751268768, "uuid": "4d4e1abd-57c9-4e68-9605-65cffa7f5bd3", "comment": "Malware payload", "value": "6b9e133f462024ebb27bb042156f8404b65af1b4dae4b208395f84e6be70b763", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751268768, "uuid": "86dde96d-73e7-4c61-8ad4-a1fff21c3f99", "comment": "Malware payload", "value": "e00c40c97b7a935f88dc78321809eec3a8cd694b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751268768, "uuid": "747184ab-51f4-44e1-8fba-3de86f0c8d96", "comment": "Malware payload", "value": "d3c19c311cf5ad2b62685156cb17658c296b786c0c9854314f80012176fec153e20a4e7c601e3f28ba6afbbd18d11899", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751268768, "uuid": "835d23bb-99b6-4029-a896-58d3d587fe50", "value": "T1A9B401CE9520D295C4B02D33C57BA2F282AB6D3609596E1CDDD8FF6B2CF67450638B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751268768, "uuid": "11156d4f-8797-4696-9902-9623919e0aa2", "value": "12288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751268768, "uuid": "e66827b4-87ae-4ede-a9ec-6d7efa2a69ec", "value": 502120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751268768, "uuid": "6709d1ee-befb-40e3-9d73-8fe05dac9999", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751268768, "uuid": "5c875abc-fdf3-4010-8c1f-ccc53d2b302e", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8989ecd5-55b6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1751290292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290292, "uuid": "8ddabd4b-69d1-4492-94b8-d57cf8b9d81f", "comment": "Malware payload (Rhadamanthys)", "value": "7f55db13e4ee4899f3747fa1a859eec7", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290292, "uuid": "9d7caf39-3fc9-4e1d-bbb0-a1f3d054ca16", "comment": "Malware payload (Rhadamanthys)", "value": "6ca24d9042356cac950018e9c3f3cbd5f6e7dc4a57742939287ad9ea1f9cfdb9", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290292, "uuid": "9ae879a1-7688-4d30-891c-2e29f07b9ae1", "comment": "Malware payload (Rhadamanthys)", "value": "2bd72570122e578d5aa00b154b48f493356278b5", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290292, "uuid": "86e368d2-6049-426d-a3c2-2865f390222b", "comment": "Malware payload (Rhadamanthys)", "value": "d42ef413af4b7546d1c8f288bbeeedbcf78c5fb20a81f00c817dc1caa65312286ef90c01c619b53aea518df5fa367762", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290292, "uuid": "800fffb5-5bd6-46ef-b4d5-23703b43d568", "value": "T1BCE5B1AE571C250FEA521735B0CC171B6B74ED69135387834851B2368C3A3A6CEA62FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290292, "uuid": "590da896-4f90-4150-94d6-a44cb73d1dbc", "value": "6144:xCo5Mek6Co5Mekdao5/CE52Co5cCo5kC75LCo5MeCOCo5CCo5MekpCo5CCo5X:XFuNiwbfnCGuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751290292, "uuid": "ef282524-a03b-4b50-98fe-595f18182fa4", "value": 3042263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751290292, "uuid": "562c55fb-b30e-4052-a075-9cc1b6bcc884", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290292, "uuid": "e44ecfcd-2ee9-47cc-83a3-bbaf0d769f63", "value": "htaking.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed5f079-5605-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751324205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324205, "uuid": "e737dfbb-ad70-44bf-aada-f3b4c6a77068", "comment": "Malware payload", "value": "c32cb0794ba6ef444883980a47b5e9ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324205, "uuid": "ce4380ba-737c-4e58-9831-bde47d13d270", "comment": "Malware payload", "value": "6cb58358788c327ce050ab7591f55c11a46201d7596c2f3d5430d2700d30d6b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324205, "uuid": "6f3a8d15-68d1-4667-a58f-ea973a313862", "comment": "Malware payload", "value": "20abcff1a88a17b912d76fb95be2f2826a2c728d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324205, "uuid": "600774ba-6f0f-468f-985c-e5da0e1f1ae5", "comment": "Malware payload", "value": "0ce927158c8d7d74c0ff32d79a3e5d79a80fe917ffa8ff290e550bad8417b0c60c33083c5194bc985d463b3b1fa2cfd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324205, "uuid": "60c96065-3fc4-4c52-85d6-af46086fab70", "value": "T14CA40294E9819F62C2C801BBFF0F45BC77A31F69E1EA71068D16EB1662D745A4F7E800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324205, "uuid": "a1a4e92c-28e0-4e07-9164-b450d5dcd961", "value": "12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751324205, "uuid": "d53cee28-08ac-4b3d-83e7-3a54a2b00785", "value": 480792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751324205, "uuid": "41473ff2-833e-4151-a189-a543bfde7241", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324205, "uuid": "e8c15e5a-4369-4840-8e11-3607e9113bde", "value": "arm926t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46bb5f5-55dc-11f0-8bd0-42010a9c0005", "comment": "Malware payload (GCleaner)", "timestamp": 1751306739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306739, "uuid": "a02db78b-e707-406b-90ba-1eec38e2ff0d", "comment": "Malware payload (GCleaner)", "value": "41a2300017044c81dddfc01529de8601", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306739, "uuid": "41a7e232-a6be-4ddc-986d-4518a9b08226", "comment": "Malware payload (GCleaner)", "value": "6cb852252bd2c139c287968e9b3fc186d280dad584e5ea2787aea6182823a0fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306739, "uuid": "f8cfe79c-30f2-4882-aade-9212a6d813fd", "comment": "Malware payload (GCleaner)", "value": "565ec984d90230edfea61b3e3d7472cd0e78eaab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306739, "uuid": "8f6d1369-27d1-4df2-9efd-c8c1431df606", "comment": "Malware payload (GCleaner)", "value": "eddc190d4dfd474bb2742f9e4475b20812d16678b56a87b2af87d4159c77e960a5ac9449dbc87c22376f5ed05b5575e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306739, "uuid": "56b72872-f9a6-43bb-a625-4bd28e1d31ed", "value": "T15236E1DE2182A437E47316BC8D9B2A578C2C5B197E1D06DD76D8089C3E33362A5FB463", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306739, "uuid": "298eae6d-8374-464f-8df2-48af194b63e3", "value": "9f17d5c56b2eb5ca92679aaaff669661", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306739, "uuid": "3e27f18b-e838-4648-8605-db73bbca8384", "value": "98304:i9i9ukd2SSTANG6wjbgTKDBqsSezZTWiBQEHI2:i6ukwNTANG6wPgWDBqsSezZTWiBQEo2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751306739, "uuid": "e94368ba-7e64-4cff-9da0-ec8b70ef19f1", "value": 4967200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751306739, "uuid": "28daaefd-dce7-43cf-bbc8-3bce36a49d58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306739, "uuid": "9ddecc6d-2ebf-472f-8e64-6ae5156f5b21", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "981e9a9f-55ce-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751300625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300625, "uuid": "586c17fd-2267-4502-aa2e-bd6ba923b7f0", "comment": "Malware payload", "value": "a6a4e6fb7af79cd6662e86889a24fea3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300625, "uuid": "83bcd061-6874-48fd-96ff-aad7340c2e02", "comment": "Malware payload", "value": "6cd921550d4167a7e9af3e97e5826a8cda1bee23c5c781c4ffaed09d657ddca4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300625, "uuid": "d83616b5-e9fb-4a76-90dd-79ff1b84aa44", "comment": "Malware payload", "value": "9ab399dc228903e460729db3e771eb6e9230c443", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300625, "uuid": "6e48edb9-6763-4302-b0a4-65f0b0be44d4", "comment": "Malware payload", "value": "c1ae6b525078a90aa8004820fd461f68b67454734160ceaca0dac63a9c396ae2a57e1edccd509b7735a18d09952830f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300625, "uuid": "7eee399f-2223-4228-a582-09791e79cfe0", "value": "T1A5C42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6D742F661EDB1B424A9E66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300625, "uuid": "fdf9373b-bc39-461b-92fa-664e2895bced", "value": "12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751300625, "uuid": "e13ee74d-6f09-421b-bfdd-3d2804b40696", "value": 587764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751300625, "uuid": "738123a9-b1af-4dcc-8a67-28700ca09503", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300625, "uuid": "cde448a1-295c-40d6-bc32-5192721f280c", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a023f05e-55e3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751309658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309658, "uuid": "a6d7a004-6af0-4077-8181-ae34999706ef", "comment": "Malware payload", "value": "b42cdff17ba993261334303bec5bbc69", "object_relation": "md5", "Tag": [ { "name": "DustyHammock", "colour": "#E157BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TA829", "colour": "#FA6C2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309658, "uuid": "e1e78a26-300f-4b2a-a3f9-f80dcc443316", "comment": "Malware payload", "value": "6d5226cba687d99ce14eda8de290edd470e79436625618559c8db1458a53666c", "object_relation": "sha256", "Tag": [ { "name": "DustyHammock", "colour": "#E157BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TA829", "colour": "#FA6C2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309658, "uuid": "38ca4e90-fabf-486a-bac9-896da6a69e0c", "comment": "Malware payload", "value": "da65ac787fe00161908772879869837823775afc", "object_relation": "sha1", "Tag": [ { "name": "DustyHammock", "colour": "#E157BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TA829", "colour": "#FA6C2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309658, "uuid": "75b2b865-abcb-45ea-ab8f-6e8cd5043443", "comment": "Malware payload", "value": "a512ee31b43129800443485a69d2865d1d9880e2935e66075ecdd2e6ac748d0151e9192ec0cee4455d6bac9339cff695", "object_relation": "sha3-384", "Tag": [ { "name": "DustyHammock", "colour": "#E157BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TA829", "colour": "#FA6C2C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309658, "uuid": "1c74d50a-9d1f-4c94-a00e-1508a7b92dec", "value": "T149D44A15BE855C79D18ACC7082078AA35A2270CB0B36B9BF02C5513A2FAD7F55F3E758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309658, "uuid": "07030e22-bd85-4304-8687-3d5eb2f29c88", "value": "679e06823d5f58f3c68b3f9267f63eed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309658, "uuid": "85fce52b-cb73-428a-9bea-4711e30c6469", "value": "12288:n1JqcctexC/mcHWxy7d2XGqKjip7H9yNUOT3vonQjP7:icctexC/mcHWx6nqK+pxyN5T3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751309658, "uuid": "a6a35a02-d109-4764-a326-c7ae572c8f41", "value": 621056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751309658, "uuid": "2487157f-234b-4a85-bffd-4dcc7f0f363d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309658, "uuid": "353ea888-4f24-4090-ba55-c13e1d8f0a99", "value": "b42cdff17ba993261334303bec5bbc69.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e67921-5609-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751325993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751325993, "uuid": "5385fc5c-bdcc-4090-aeea-8153e0139de5", "comment": "Malware payload (Mirai)", "value": "0dc54e842afded1fe8767d5250fe611f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751325993, "uuid": "46121d44-5a99-4845-9315-30c35f9ec78d", "comment": "Malware payload (Mirai)", "value": "6daf4c98cd8670a12e8ff614b6114db67bc7dc1c4b2834a2436a1e71e8a15789", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751325993, "uuid": "4e50af92-31c7-46a6-a58f-8251631cfdc4", "comment": "Malware payload (Mirai)", "value": "0c62860b135e851f9413c88d39176cdfb298f0a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751325993, "uuid": "c767b853-528d-4cdf-810e-4dfb9bb709f2", "comment": "Malware payload (Mirai)", "value": "5930983670bfc8706ef50d679695d136d4b42cdfdd255d2bb11bedfbeea49c5f4c89d7f8bcb2746acdc9d5dd29316ced", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751325993, "uuid": "88c2f73a-623d-4b5f-bade-8973457f7942", "value": "T1BC834BC6B402DD7DF84FDA7B4463490AB130E7521A831F3A626BFDA3AD321A41D17E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751325993, "uuid": "c602f8d5-35ed-4809-8103-6d3689d61e39", "value": "1536:EqyLb3TSOtwDrQ9y8qkQ7nTBQkL5VntUea9JOSK78ZtDf4sQ1ICychhbzG6M7o/r:EaUurtHkt+hU59J59k6CNhtp/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751325993, "uuid": "4510fc01-ef18-44de-a431-cf9630294911", "value": 83124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751325993, "uuid": "a0743b9d-83f4-4339-a746-5be094f9d4e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751325993, "uuid": "65fc71da-ccce-4284-9dcb-317f6284a24d", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3eb5ce2-557e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751266419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266419, "uuid": "0ff6a61c-723c-4749-ae19-b1c194bdeb95", "comment": "Malware payload", "value": "7784be358766a2839a7dda9d5a3cb4d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266419, "uuid": "1855a9be-01c7-41fb-98fc-fe55a6711733", "comment": "Malware payload", "value": "6e31c3003706503bfacf8f9310eeda14420f0c106ad9ca8996b8fd579a0b87c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266419, "uuid": "536ca586-32de-487b-8aec-f84d251b48d3", "comment": "Malware payload", "value": "424a7ad4d4d587dc220ee2dfa9c63f9c8e2afd52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266419, "uuid": "67da50fd-5637-4788-903f-9cc6cfb35273", "comment": "Malware payload", "value": "81f1fbe02cbf381acf317d305373a898634c3ce5f06e578b1408c6b49961f8f7532da164c98f528f913f1a61a474fa36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266419, "uuid": "601fd47b-f3c4-4e5c-a14d-f5cbb7f422a5", "value": "T1B424CFDEB913F8D8D4A595B5C967C5B0E990FE212B1016337290B3AF2F749386E09F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266419, "uuid": "7e2212ff-3fa5-44b5-ac2a-87b5a6394963", "value": "ad2bf6a41f62f7e8cbac76e31b403ae7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266419, "uuid": "4b98bbf6-f66b-4c5a-b359-49b1934f84d0", "value": "3072:M0GYs/zhpvYTMcf91voZPGk8zF8CgDsygOxK:GLLYTLTva8B8XDsaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751266419, "uuid": "7ae5beef-ce50-49b0-940d-349285441963", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751266419, "uuid": "33d199fa-c536-4326-ab0b-8d5441d6e16f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266419, "uuid": "7313cf76-3fb1-4143-982e-576656ccbf14", "value": "Windows Roulette.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47098937-55a2-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751281591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281591, "uuid": "8557da78-252b-40d1-ae90-036660c18682", "comment": "Malware payload", "value": "7f08104168cd0888ff85b325e8847239", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281591, "uuid": "ea0eb129-1b58-4382-8787-4bf2ed83be5c", "comment": "Malware payload", "value": "6e8534d597ecb36a8ca58ada3875de755120f160d4090b61bd0ec0ed5d04bfc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281591, "uuid": "ca624200-6fd3-45b7-aca4-ef46124aaac9", "comment": "Malware payload", "value": "a85163c419e099577e14b51664cdd56929d119a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281591, "uuid": "c6ad173d-7557-4c5d-86a9-496b31da0054", "comment": "Malware payload", "value": "59b5dee52bcf69a9cf8b3f070f5fb8cc6cf232d7d3c131e1ef30e55871755044eccc57098bf8f639a711bc38a06db0b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281591, "uuid": "112c4ede-370b-43bd-b30f-1d25f47a9de7", "value": "T180C42241EAB7C0F2F65349320103E7BF8F33C9099165D296D742F661EDB1B424A9E66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281591, "uuid": "2a045882-a081-4b72-b537-0786a49b6468", "value": "12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751281591, "uuid": "32c82c8b-bac9-4990-90bb-381965e48923", "value": 587764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751281591, "uuid": "f1ec593b-ffe3-4313-a84d-8995f80df397", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281591, "uuid": "c28dd85f-1bbf-4752-a22d-409400bc4b7a", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4197d57d-55a4-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751282441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751282441, "uuid": "73d65abe-9f07-4b4f-8413-9d6daaccb078", "comment": "Malware payload", "value": "6a6acf5fd9f88b72a29722018a4a82b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751282441, "uuid": "8cdfab80-fbca-4688-bcb0-9411f9c7fadf", "comment": "Malware payload", "value": "6ec7b2e5df5b321b4318eec4b90e8591e3f8235a040b0c0b76ee4d28e8ca2b8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751282441, "uuid": "ff13f9ea-f94a-4ac0-8e22-eb4be0b885bd", "comment": "Malware payload", "value": "b3eb2804b6e41623660d57b354a33304915ee4c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751282441, "uuid": "547f13d9-b647-45c4-b305-64336ceae10a", "comment": "Malware payload", "value": "2d728f8ff7fd64b66b3b89aa08870ec5a3a31efcba92f34e57d0b5c6a19fd63417307fa17342299240cb3f06ce1a3ba9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751282441, "uuid": "0372dbcf-df52-4474-949d-756408c11ec2", "value": "T1B7C42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6D742F661EDB1B424A9E66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751282441, "uuid": "a3bfc4f2-da07-4400-aaa5-41d96c32e45e", "value": "12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751282441, "uuid": "5b4a59d5-92a6-4094-b544-c593e6a77462", "value": 587764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751282441, "uuid": "76837623-f1aa-4063-bebd-8f660edd2682", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751282441, "uuid": "a5098245-6235-4a1e-a68b-aa197ae1a4c0", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61010f39-55a1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751281205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281205, "uuid": "8d12eeb8-ed47-4dfb-be3e-4f5d4f66db43", "comment": "Malware payload (Mirai)", "value": "07f425bcf2c372d5e9bc1b2e8aa561e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281205, "uuid": "d7c8545d-66ed-4d74-a9b7-6a400531e84d", "comment": "Malware payload (Mirai)", "value": "6eda659dc3a193161d13581119f394f6481733c6009dc22d9e2e574c10913452", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281205, "uuid": "f1285c7a-a7be-43fc-89f7-51c70d0a390a", "comment": "Malware payload (Mirai)", "value": "a1b42abb12cd740ad9fb1ac15b98939d1804ffc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281205, "uuid": "405dd126-dd95-4e05-bcee-0f3c41621bfd", "comment": "Malware payload (Mirai)", "value": "1f9c30f4049eef6920914fb6da62b03de710745e3008b568c92816ac8611fc813b8015de24043bc1a1dc261d4b6ed812", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281205, "uuid": "80c4f9a3-6d77-4baf-8d1a-8522476c9cc6", "value": "T15B836D22B839193BC4E4A57722F34332F1F6478A24A8CB2E7DB50E8DBF1559036476B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281205, "uuid": "a81b09a7-d970-46e2-90da-6e87f82f0aee", "value": "1536:5le6AvLEokR3h0ipJrtgLsd0BEt1aYm5v8ok9yttk:4sRd0q3aYOEWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751281205, "uuid": "b4388e24-90e2-4b50-83c2-19850d88a21d", "value": 87352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751281205, "uuid": "2cc00dba-af3e-4c26-95ab-a4d1a9f4a640", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281205, "uuid": "1ab76269-4f96-49b2-aa46-3a07d8aecbc1", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e8c257-557b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751265050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751265050, "uuid": "bdaff5c4-a757-4b4c-b77c-dd19e44ccb10", "comment": "Malware payload (Mirai)", "value": "c4c3267a852e059f7d469fc2cb1bd50b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751265050, "uuid": "5c577a60-f514-4438-8d5d-9bb4ede50d0a", "comment": "Malware payload (Mirai)", "value": "6f10608b087649632ae046cb2e15db9759d9bee16e8a04c56761dc5eacc4e8a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751265050, "uuid": "23aa2484-f6e7-4d22-9313-cb25b34e7dfa", "comment": "Malware payload (Mirai)", "value": "95ed1ca8b88b6bfe74d85964238bf5f633302c18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751265050, "uuid": "4c7723d9-87b0-4d7e-9e44-ccc60aa6a875", "comment": "Malware payload (Mirai)", "value": "05a80383c2acc553d3497403ece206571db250e17744d4ca6841c4a0eaaf9cb9dd1fcafad50472c72b9c3ba305bca65b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751265050, "uuid": "adee1dd4-edab-4e62-aef0-b8fa60f3997a", "value": "T15603E1B2E360CE95DEF67D70398A82CD37CB1BEDB3548F9390945B914E2D80C941AD98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751265050, "uuid": "c3cd7fb2-40db-45dc-80cd-53fd5fe5ef7b", "value": "768:+AsySmDpMm6Mm4VB0+7VBJS+j+8rM4uVcqgw09f:9DDpMmvm4VaQjXvM4u+qgw09f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751265050, "uuid": "f0222a84-2427-4834-8c3b-c8d2e8b2da00", "value": 38176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751265050, "uuid": "f95e7bec-3d6f-4cd6-ad2f-3d19b6d953f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751265050, "uuid": "d1832e26-20cd-4df7-afba-27ee3a0b92a9", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbfad904-55a0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751280928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280928, "uuid": "28c17a12-c7fa-4146-8246-5e3e833672c8", "comment": "Malware payload (Mirai)", "value": "0269cc591749ea57c05ef8f3b8c7a655", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280928, "uuid": "356c79a7-7a6d-4f35-b973-78a2ba828220", "comment": "Malware payload (Mirai)", "value": "6f3dd7405902728a3dccc6d5c8339be8df84718db36d3018f1eb32a4cb532d45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280928, "uuid": "c0554571-f0f6-4d94-81c8-af2c8b2564d2", "comment": "Malware payload (Mirai)", "value": "b0ede9f05da201160072e4bf865e754c4ed9b877", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280928, "uuid": "3b3095b8-6252-480d-969b-e05052d1ac9b", "comment": "Malware payload (Mirai)", "value": "81d00795d3ff3975fede0d21cb1e413050edaffa077d06149f065e0f8336792c881b4b3bc8345c1d38621d338c82be7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280928, "uuid": "13450aa1-70ed-4d83-8a0f-84db8fc3853e", "value": "T1CC846C05E9504F67C6D127BAFB5E428E323B1FA897CB72128D389EB027C2B5D263D550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280928, "uuid": "9067bbaf-ffcd-4b31-8645-f3e1921000a0", "value": "6144:+uDaBhUT/sZGUWCoq+MN2axVwB0Ve6HKeRy65w+twifItlaUPJN4AT8uJSm+J1dJ:vDabmqhs42axVDtHKeRN5w+tw17JN/4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751280928, "uuid": "728aeaf2-5943-4abb-9767-14329ad5c164", "value": 385376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751280928, "uuid": "0593df10-8b15-4d4f-8b9f-0742ec46791e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280928, "uuid": "f6f44f6b-c6b0-4469-8752-500cf168bb95", "value": "a-r.m-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a082f2-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751291227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291227, "uuid": "38feae7e-dcd1-41ec-83a1-2a3d982d2210", "comment": "Malware payload (Mirai)", "value": "53e078a2cca8ab529656fc698d01909e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291227, "uuid": "154219de-cef3-4be8-b349-7e09a2c066b0", "comment": "Malware payload (Mirai)", "value": "704fda66a38d8c8cf48c89b2cac2ade9f9a7fb715eaf2baa31af937e63fdd977", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291227, "uuid": "7592486c-362a-4f7c-8a02-34c8a2adf3b1", "comment": "Malware payload (Mirai)", "value": "a04bfe05a49b04238c7eddff119db77ae9d7fede", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291227, "uuid": "5f0dbf2a-fea0-47eb-9354-cf45c149cd3f", "comment": "Malware payload (Mirai)", "value": "66c97655a74332ac0651da5a0db938ca88ba8a6ef57f33035940b21f372c29220425e352dac23c663c1e07ce6f970ef3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291227, "uuid": "1bb8b7b3-919c-4184-8b49-7714346db90b", "value": "T12263971E3E619FBCFBAD863147B75F20924933A226E1C944D15CEA011E7034E746FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291227, "uuid": "0e0bc0a3-882f-4e86-b872-6874178328a0", "value": "1536:cQF4iL54FpuqHweoL4IGqrSqK4v91zBjNGyxqGVHHhpNgbyhUqz1:ReoLQ2K4vPJoiVHHh/v+e1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291227, "uuid": "29e39820-d5a4-4cfa-ac13-273748c8290d", "value": 71528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291227, "uuid": "a0760f33-3ab5-403c-868b-26d95ca9be9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291227, "uuid": "e1e02f82-bf51-4974-bba7-41423f4c1f18", "value": "miraint.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f665e1ca-556c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751258692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751258692, "uuid": "f36a10cd-dad6-4e6a-ae09-5c755d04226a", "comment": "Malware payload (Mirai)", "value": "4e566733043dcc11846ed6ad4a63f43f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751258692, "uuid": "e5200f74-240e-4d05-a7ec-a1412571f9a8", "comment": "Malware payload (Mirai)", "value": "70cddc0a6c24918bb16a4db01d74f6e14b76655cfcc3e119df3d47fd0d026b7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751258692, "uuid": "7cf59eee-76bd-4583-8853-10527146413c", "comment": "Malware payload (Mirai)", "value": "a89c8fc774250207242ada094af38f214936ebd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751258692, "uuid": "b94112be-01a5-49ce-9422-870098766aba", "comment": "Malware payload (Mirai)", "value": "730e841d3846b53f721f497337dfb72d9e89ee2d0da821a135bce34088e2d3d93802d1bc321f86d5d2543a62544d1164", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751258692, "uuid": "a6fefb27-95bf-47d0-b780-631c33c80b32", "value": "T14DE31985F8818F22C5C612BBFB5E428D7B2A17A8D3EE72039D246F25378785B0D3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751258692, "uuid": "4ce5dc94-c095-45b0-b7f3-a0dde2992c28", "value": "3072:buCBooggjXZoY29O4d+lgisBFO7v6tUp:buCW0TKYIO4digl3O7v6tUp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751258692, "uuid": "502d0f97-9f51-4e34-b75b-87c1f48bd82a", "value": 143456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751258692, "uuid": "875ed794-b901-42df-99e1-2e56af766fdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751258692, "uuid": "2d1f3b94-0ed6-4a8c-a2b2-7138f1e1a077", "value": "neon.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dd535db-5596-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1751276556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751276556, "uuid": "d4be3044-4171-4ace-9a31-a63852364213", "comment": "Malware payload (Formbook)", "value": "821d25ae6e177e851e1207d32e4a94c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751276556, "uuid": "5ae42a55-2f94-4697-aceb-801aa124461b", "comment": "Malware payload (Formbook)", "value": "710365964c51c17a78c59c9c80716dcea16bfe4f75de862c2a128c24739a92f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751276556, "uuid": "6abba951-7ecc-4e8d-b2ed-b62b8d82b352", "comment": "Malware payload (Formbook)", "value": "5d6fb4e40d2e07e67f040c72be0c44669ee8018d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751276556, "uuid": "aeab5207-051c-4376-b368-f4885f776914", "comment": "Malware payload (Formbook)", "value": "92cc47df93dbd0ab311ce5faf902e1c766766417cbc13b7dc764f660fed068b0a4f90d8b2d9160e2bebb35dc17bfeb44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751276556, "uuid": "a7b1f339-4d1d-4097-bf71-849f2fb3a7a9", "value": "T1FE55AF03739D826EFF9B91322A76E221467C6F270123A51F33D85D7DB9701A0563E6E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751276556, "uuid": "d8de7f4d-6b06-4de1-b6c5-38eafd7372e4", "value": "0b768923437678ce375719e30b21693e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751276556, "uuid": "3f1b0cbe-01af-461b-b3ee-0a7a1db3e64e", "value": "24576:Q5EmXFtKaL4/oFe5T9yyXYfP1ijXda/w/Rb2ZlWUCHqvcD:QPVt/LZeJbInQRa/IwWUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751276556, "uuid": "163780d6-f25c-4aa1-97e8-57ef4ca38ded", "value": 1335808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751276556, "uuid": "553df891-b3de-4290-80b0-9219d71ed5ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751276556, "uuid": "8db2b528-8122-437b-9490-f5d66b65a04b", "value": "WIRE -$2,912.00 INV#SI25040059.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c02d2133-5606-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751324744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324744, "uuid": "3b59387d-b755-4433-86c7-75270543dd1a", "comment": "Malware payload (Mirai)", "value": "6986306865cba047267151f19981dc5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324744, "uuid": "1bac955a-97a8-4046-8463-5300ca5de7bf", "comment": "Malware payload (Mirai)", "value": "7105890078df306ac975acd9878f027502268105a88efc5a26a7bf1c1e589ba1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324744, "uuid": "235a4e14-66c1-4842-be45-1991132c2bf7", "comment": "Malware payload (Mirai)", "value": "bc686d9eb3defdd951605b504a59946bec224f13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324744, "uuid": "d198a63b-ad20-42d5-a48d-7c88c5a606f4", "comment": "Malware payload (Mirai)", "value": "f9e31759dcc01a5a3d5c95256ac18435b9e14d2c2e444dcfba491bf104bcd4cef33b618656d7ad9578789e6d8138fd0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324744, "uuid": "7e138fec-d749-492b-8836-9a916667a42e", "value": "T1B903F135A21BE1A6CA341D7ADEF80608981A0EFDF7A1741326BA075465E4DC160F77F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324744, "uuid": "dfc61ebb-83e6-4ff2-914b-37e249952b0c", "value": "768:B/yr+Xn/WspSsJNK4RXQjx+zJ8kgpH9XR85q0C03X9q3UEL/7:B/C+Xn/WspJN7KxufgpvkmLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751324744, "uuid": "cab146b4-728d-4248-9bb4-6067edbac804", "value": 40184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751324744, "uuid": "5da45d58-0c19-4698-9a20-6b836643e322", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324744, "uuid": "437e895a-6b87-4623-aca2-451c504af947", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "817f66e2-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1751291997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291997, "uuid": "82b72465-e7e0-4af8-8f4c-77470f4345d4", "comment": "Malware payload (SnakeKeylogger)", "value": "29da5a8f7e1aa1855c4130c9b38a99f9", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291997, "uuid": "4852d40d-d5e3-4a3e-b9ba-ac98c8ad4223", "comment": "Malware payload (SnakeKeylogger)", "value": "711be8c6c25de4274bc8116caa7d443668aedcb534b5830f3370a9bc2112be0b", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291997, "uuid": "baab242e-3d27-4ed7-9b1a-c9b8f7ff3e86", "comment": "Malware payload (SnakeKeylogger)", "value": "a7fa6e5c5f3ed793a9cdc3030a942094579b1528", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291997, "uuid": "5ddbff5b-86cf-4a97-88b3-9d2c78138bac", "comment": "Malware payload (SnakeKeylogger)", "value": "fc9abc9e555dc6182c87736db9c3ad1e5819e36b4f1877b0d5ee3d0fd9bc694376c83b9c17b66fb0536793a83be4984d", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291997, "uuid": "69b31ef3-a35c-4f2b-93a6-3a95163d8a09", "value": "T193859A9D94709DC26014FE74EA50EBD788DA438427274A121FE2B5EA6306C43FF9B7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291997, "uuid": "20fbc9ce-dcb8-4f4f-a32f-5b3f43eb9d3f", "value": "24576:IPSnNbCSf9QdaZIMsYek1EDZIc+wnx7FTz1RikrAwX09yrtJZCOrL6+Q4AVxBqYL:7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291997, "uuid": "00dd717f-cb09-428e-b93d-2747bf52a5a2", "value": 1725258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291997, "uuid": "3012f1a2-c397-4c7d-ae82-5ab1183f254d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291997, "uuid": "23f5e4cd-7812-4d3d-a79c-e8ad9f2c44c2", "value": "f-66748783.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452626d6-5572-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751260972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260972, "uuid": "27e09a25-e5bd-41b7-aad7-30f1fcbd724a", "comment": "Malware payload", "value": "dbb12a89a28001b677f5bd2e2c02c58f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260972, "uuid": "c47ba5c5-8bc7-4e82-a7e0-4c407862b1fd", "comment": "Malware payload", "value": "7128868254064e747c2ffe76b1b429e17c2d12cf43b548cba8ff42aa289e110b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260972, "uuid": "c08cbc8a-3957-4184-8832-a48b080759d2", "comment": "Malware payload", "value": "287eb3c7fb1c35ae7dfbeaa78778c67536b8a782", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260972, "uuid": "e16d1a76-29d6-4c95-9ff8-22b662c18b9b", "comment": "Malware payload", "value": "142ab022f4e084cef18972ae8ca53c00477e20ba91744559941e5fbc0cf112d371ebbe8e70355765768d8e2ed630a3a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751260972, "uuid": "3c85c2f1-082e-46e3-9383-edadbf2b3ebb", "value": "T196C4F1A377204F91C35195B209F389335AF6199706F39982537DEE107F20A68386BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751260972, "uuid": "6274c50e-c874-40d2-a8f1-c3f50ad2a248", "value": "12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7zE:W7v+mrY2xzf03yvZ/YIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751260972, "uuid": "2bcfe215-e715-48e3-8f4f-e875de31a0d1", "value": 592688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751260972, "uuid": "121d1b80-674b-400f-8e70-7a3d41e9e74a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751260972, "uuid": "53da1805-7854-4492-9551-9dc2817263e6", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e28f43b8-55a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1751283999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751283999, "uuid": "026dd83d-752c-49f4-8df8-6daf98bfd987", "comment": "Malware payload (VIPKeylogger)", "value": "1b6a912ed7ff5a66d6c5858676489153", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751283999, "uuid": "d3f83126-3fda-4e7c-a496-0d9885be0161", "comment": "Malware payload (VIPKeylogger)", "value": "727fdb0ed6fce2ea8ebb4c191731eca61bf722fd8ecf9662fb576e68e288f628", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751283999, "uuid": "ca07b52e-e3bb-463c-8ebf-b39c29391277", "comment": "Malware payload (VIPKeylogger)", "value": "d2713e560857fc10aa4c78d67f8e44490f2a6755", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751283999, "uuid": "09e7a5ff-0944-4e09-bcd0-8dcedbe94b52", "comment": "Malware payload (VIPKeylogger)", "value": "03649ddabc61769e789962af9af834794dbaa31345854a516f84f13eea75ba65a603fc5c725832ce7472c42fb615e9ee", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751283999, "uuid": "ef125fcc-23dd-45dc-8881-f85232a98962", "value": "T193A1B0546C4D038D72531A3E95DC427330D9510C966C3F959A55C368331357E2F92BDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751283999, "uuid": "bca271fc-c058-4597-bb6f-17f5f1c4f5a3", "value": "96:C51xV143E5w4vKEGxIQxFmhxYfMsj7flCA6ZZA5yUcQ7VHFuyrEPpfZd5mXaJsTV:u405mvxIQaEfMs/MA67UcQ7VNaphPaa4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751283999, "uuid": "09b98b73-0152-4a01-ac1d-30ede2afcb1d", "value": 4871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751283999, "uuid": "f8dc1ad8-d833-4725-98c2-11d1815039c6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751283999, "uuid": "199fcccf-23d6-4125-896d-2abb105dd622", "value": "DHL4704321510 Pickup receipt.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f9610a3-5605-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751324206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324206, "uuid": "0dbb3894-3897-4f52-95f7-2b78b6c074e5", "comment": "Malware payload", "value": "f1a625f8b9b06b013beb33f0db107c95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324206, "uuid": "7153c41f-aea8-4c27-ad6d-48a12393a498", "comment": "Malware payload", "value": "72f32b62319a3fa1e677dcfe2cb5eb7a8e3c6aba7b660e2889d623999f043836", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324206, "uuid": "19fa086b-13ff-4730-a416-0bc37319d9c2", "comment": "Malware payload", "value": "24f4056d3f103e619ef19d9025ae98d14ce5e25a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324206, "uuid": "77b3da00-1d9c-4d32-8a3f-578b3b7e7ac2", "comment": "Malware payload", "value": "30990adffc53e4ca400c802ddb79853853e0444c584bce29368bcd6bd6dd315e1d2152b8d8c3932aeb3ba101a0dc703b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324206, "uuid": "2a811077-c622-419b-bf9c-4836099553d5", "value": "T1DBB402018F881F87C5AFCD750A2E167311AEDD9F46CAA43E807CDD48B6A6D0D6783C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324206, "uuid": "df99f534-4673-4c9d-9db4-8101b90d839f", "value": "12288:7A84JF9Qc8GgZxTM6m1U3snB6NnVuqnAtSyBpywBdlEykR6LkV6N0L8AXwtZJHZz:/M6m1U3rVuqAtSySwY1gEIZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751324206, "uuid": "8af54dde-2ad6-4d56-b03c-b846c16a9bce", "value": 509272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751324206, "uuid": "2cb41501-67a3-4fcf-9062-6bfba7d7de17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324206, "uuid": "0a3c584d-7124-47d3-af51-5485fc5c9ce8", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88945b37-55de-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751307471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307471, "uuid": "a3bb930d-e555-4a82-8a6e-0d7ccda0532e", "comment": "Malware payload (Mirai)", "value": "1965c6034b59c4f5dcd5684084c9a13b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307471, "uuid": "74997173-a62a-4f66-a560-4ecacb8b7a28", "comment": "Malware payload (Mirai)", "value": "72f6704fdb711d1ba20c96a7ef73e7ac2cd41943cc4bdd417cab03417be1eb55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307471, "uuid": "694e31cf-34ab-463d-8d69-619dcd46c1b9", "comment": "Malware payload (Mirai)", "value": "d607e0be5283aa0593128fbe39d1a9db55d5da8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307471, "uuid": "da6786dc-7429-4b4e-8838-3da6ea62ae67", "comment": "Malware payload (Mirai)", "value": "32a66bbc6f607c542f8acd02ce99bf3c0b121d5d1a3259c3b487f0553e502698b70a3ca3ba23c287add71154d4205713", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307471, "uuid": "1f5e2d05-fd55-49d2-b629-addacb63a86c", "value": "T1A5836CC4F683D4F2E89304715536EF329B33E0F9611DDA43D36A9A32AC92511EA16F9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307471, "uuid": "cd31c85e-d87a-45a9-9e6b-d38eda27f2c0", "value": "1536:WcoXvLgO8OEtTMXOoRcYeUZTBgvTIxS9UU+L:WcofUh//o0YTkcYSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751307471, "uuid": "faa8bb54-f409-4a75-a5af-5abeca293cdd", "value": 81448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751307471, "uuid": "b4351242-4494-4a70-8aa9-1b32149ad88b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307471, "uuid": "68b8398b-7df7-42fd-ae01-7f1a158fe49b", "value": "cutex86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f37a1445-55b7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751290900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290900, "uuid": "67b54a41-0ea8-433b-978a-4e5c344f6433", "comment": "Malware payload (Mirai)", "value": "51988a9a330d19e78835d09b45ea2ae1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290900, "uuid": "9ad322a8-1ce1-4934-9fb8-21f628d42d40", "comment": "Malware payload (Mirai)", "value": "733063daef1427e08dbbea186650c9cc10aa8cad4eeee069b6e70ee4519555f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290900, "uuid": "ad6f4b8e-fc94-4226-ae08-2caefbcbef03", "comment": "Malware payload (Mirai)", "value": "dc7754150fbc9c481cff5d292a25cb9a412ccf3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290900, "uuid": "130a2e0e-887e-4b16-aa09-376137d74946", "comment": "Malware payload (Mirai)", "value": "0b570784e5189706c58abde14b33c9ae07f0f7b97fe98bcfa92fa280b5e27cd167d48dce94c1dbba5cd73250c519ffe6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290900, "uuid": "467d16d7-c19c-4fda-8521-4cf514bd6551", "value": "T1A373A74E2E219F7CFBAC863457B75E21938933A626E1C584D15CEA011E7034E786FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290900, "uuid": "a131b561-652a-4e8e-bf75-b3a7aaf328e2", "value": "1536:5K9WxKyWH+6Yo5O82XsQ9nNPHboE+1tJPcjBuV8U/l3b1aEOq0Rb:EWxKZB5O86sa17o9NV8U/lxaNFRb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751290900, "uuid": "29e804b4-a5c9-4988-934b-c3102e1a4103", "value": 80324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751290900, "uuid": "9620b8b4-e0ea-4020-836d-e6520c21adc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290900, "uuid": "2a01b70e-cc68-4052-b193-4f7f52e3ba58", "value": "mirai.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc04fa3-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751243833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243833, "uuid": "022ab89c-46c0-41c5-82c0-f00c944a53a3", "comment": "Malware payload (Mirai)", "value": "10570ce54d7105a4bccfe409e5e576d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243833, "uuid": "1b1882af-226a-404e-916e-84665ce612aa", "comment": "Malware payload (Mirai)", "value": "737fd7f6b2f51ad1909dce50780b17fe8476070d3045fa9a491ab480757acff2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243833, "uuid": "d97088f5-11f6-4450-bd8c-dee496287b4c", "comment": "Malware payload (Mirai)", "value": "74962d5ec16fa6135f9900bdbe53b9dd3718d3af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243833, "uuid": "3fa3af69-0900-4d00-b130-7a5c50aee934", "comment": "Malware payload (Mirai)", "value": "186c42d580498093374faefeb178c24630c95edcfe123c82d16ef7cfb0453d4d9dacd17a48de959d725d294c27866a2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243833, "uuid": "d46bbfa8-9ee9-4901-a9c0-4e38fb74396d", "value": "T1ED432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243833, "uuid": "6958ff38-91ae-456b-9956-4125288c7afb", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAw4:RqtmZPuutfbltZFBSJsBcfDSTFI+BE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243833, "uuid": "b33d6129-d6ee-4123-8e09-7aeb247b3f13", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243833, "uuid": "1be0da60-6892-4e42-8db9-f3da80f821a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243833, "uuid": "551b8853-c469-4530-99bc-3e592e595a8a", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e90ada1e-559c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751279286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279286, "uuid": "31d7def2-0fbe-48d0-b420-97b9939251df", "comment": "Malware payload", "value": "3ece543963654ae8425751aa5d794ce1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279286, "uuid": "4ae9e172-23ea-4647-82d1-7fdd4b43fe1b", "comment": "Malware payload", "value": "7397363831b0bb1f2c1721001cd462ce45cac6721a850c1c95f0dfcc6b2149d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279286, "uuid": "9ae0dbaa-298f-4964-8f94-58f6bc45d0cb", "comment": "Malware payload", "value": "8fc5bc1a4f5be43b68b521d028204ee59830a108", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279286, "uuid": "74004688-4d0c-4f4c-aa62-cd77a77341e0", "comment": "Malware payload", "value": "474fbf865e941ff1695a49152dd5c7ab511f5d8cbb85dc234315e7089c1fd05ac129b1dbae1b27bf90e400de01c4a4db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279286, "uuid": "a6105b49-e88d-4be1-a868-1265f92ea50c", "value": "T10EB401CE9520D295C4B02D33C57BA2F282AB6D3609596E1CDDD8FF6B2CB67450638B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279286, "uuid": "d4973917-bdc4-4188-bcf8-dac444729fb4", "value": "12288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751279286, "uuid": "8eeea74e-7ed5-4497-b1ac-b6c4ece6a65e", "value": 502120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751279286, "uuid": "6ec448c1-71c1-400c-b1ea-74884d50d84e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279286, "uuid": "a66fd519-c6de-46cb-aa89-4cbf9ba7cdaf", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9fa1a33-55c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751298105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751298105, "uuid": "388aab01-ca48-4b8d-ae1d-576f01b65e70", "comment": "Malware payload (Mirai)", "value": "693af39ccd2e6c77731e0be812839802", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751298105, "uuid": "2fbee9f3-eb94-4e94-859c-ac7d1768afb5", "comment": "Malware payload (Mirai)", "value": "7439805251006f0ec11b4fe27c5cf4891e505da0949625cf002047eb4ff90bad", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751298105, "uuid": "49416448-9cad-4306-bd57-1ab6513e4626", "comment": "Malware payload (Mirai)", "value": "25f25db0db70e42292fc4d3c298d54abdd1c8cdd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751298105, "uuid": "1736c34c-8e8d-4905-a772-5c10a30b6489", "comment": "Malware payload (Mirai)", "value": "8b9d29b406de6d6e3af45e32bc2701898dcfabb52d57ff24601dd9dff3565e8d4119088c131bbe6c05ad640810add193", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751298105, "uuid": "7ee5fd25-79ea-4094-b376-40d7607cd152", "value": "T1C921C6FF03558023D51DCFD170698108A18582C3B8AC4BB1B7AE8CF56E84AC6AC41F76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751298105, "uuid": "ac03df89-7a0f-4095-9c48-a29ddb510c99", "value": "24:3J3B+9+I+GNI6q+vKh+gN+X+fa+Q4+f+QR+/+m3M+oHR:ETsN+ZLmOx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751298105, "uuid": "ef4c1f03-618f-473e-9a18-f9c85c2d996c", "value": 1180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751298105, "uuid": "29068dcc-642e-41c7-95f0-158d1b7ce8f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751298105, "uuid": "047322e3-ba53-4e13-a86d-c55a8b01bf58", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "204afaa7-559b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1751278519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278519, "uuid": "148657c3-9cfb-4ab5-9e8d-8fc0e8220633", "comment": "Malware payload (Formbook)", "value": "d8ee9044788df34ed752be59a4fa4678", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278519, "uuid": "123d5a12-2b33-4982-b583-6c215c82767f", "comment": "Malware payload (Formbook)", "value": "7457a0baeba3dfc9e1ffdae6aa053f943e188fc76eceba962d8e1423c96eeed2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278519, "uuid": "8d942e7d-93e8-4929-a373-857ad9da750b", "comment": "Malware payload (Formbook)", "value": "196909ffe10003ac97b6c518657ebde7de7d1597", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278519, "uuid": "3fb1d082-2afb-469d-9da6-1aa5007cf3a3", "comment": "Malware payload (Formbook)", "value": "e9ccbf846ec39ecfd2f0c3fc8efa7812c07a522355db9772b0a6bbf48bdfb132e8962793fbf5f37099886d029dc214ab", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278519, "uuid": "fd02c613-dee7-4ec5-90c2-f24b9399dc02", "value": "T1C5253380698FE109931726D45FF885FFE64598F7CD73E404DAB229BFD81B92212307A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278519, "uuid": "030cbb16-e795-43c5-b0ae-0b4503bf7369", "value": "24576:jwGPA5PSi5YRp1RniF5ySd0/S81Zzq3QDctnUiq1R87IhcMe:jwp5PHYRp3I0KSq3QDcRUL1g93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751278519, "uuid": "40bdb630-45e6-4f5b-bc1d-dcfbcd0a35a9", "value": 997913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751278519, "uuid": "8c895980-41c7-4437-80e6-96ce2f7592d5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278519, "uuid": "285eecf1-130f-420e-87d3-0cfabbe02326", "value": "invoice details PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e4bf467-5603-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1751323211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751323211, "uuid": "1e0a4da4-9cb7-4f8c-a956-f57e6612c59d", "comment": "Malware payload (ValleyRAT)", "value": "0fa187730b5792703923edefaf208bc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751323211, "uuid": "109c1439-31a3-4133-bb11-c280f887bba0", "comment": "Malware payload (ValleyRAT)", "value": "75ba04635157c65babcd8bc3b3a44a37dc07ba9375bc9c07c6df3e3721701dce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751323211, "uuid": "da7eb200-3075-45c0-a4a5-62485c61e279", "comment": "Malware payload (ValleyRAT)", "value": "8bb8d55aaaa873dd7f6ebf9d4e953ff41f52c8e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751323211, "uuid": "95ebec13-39dd-4094-a399-70a573576bd5", "comment": "Malware payload (ValleyRAT)", "value": "dd47b442f2c9fa044463ffb8e1efcfd0a444b6569ce523cd3370f4ea5302ffb58bb240b8920a78d4f2cb72ed0ab7b4fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751323211, "uuid": "b01fe5a8-1577-47ca-875e-360c468a40b9", "value": "T1BDA46B4E2B8D1EFCD186D0B884961601E57338E60B709EBB46D5AD3C2E391953DBB3E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751323211, "uuid": "1b0ddc0d-efe6-4e11-8a06-88828eb4775d", "value": "3269b25b3de4eed8d9468bfe17c0c6ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751323211, "uuid": "509cae45-aa74-4498-b479-0633f35ff3aa", "value": "12288:22yDgU4qrwEpFNNqOfn+AqEw04y2yP+6dbgvRggQHuUrGJG18p8o:GIG18p8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751323211, "uuid": "10fa6212-c8b7-406f-9078-6f5c1d8922ba", "value": 452608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751323211, "uuid": "afd53680-0df0-4a91-b107-d1b3c3b89d18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751323211, "uuid": "01d44e32-d7bc-492e-9752-6c4a4f334035", "value": "0fa187730b5792703923edefaf208bc7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ca6de3-554b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751244108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244108, "uuid": "6bb4183a-343f-4209-801b-ba733e179fe4", "comment": "Malware payload (Mirai)", "value": "951784e41ab8e34b97e1ec14f467c85e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244108, "uuid": "7d20c5e1-a433-4875-9118-177efaff6410", "comment": "Malware payload (Mirai)", "value": "75bca63a59a2869e28da768cc93616823d146bbf2b09f2f6d9a98e5151cfc6d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244108, "uuid": "6e8d448a-1b3c-4250-9ef7-81f485cbdee4", "comment": "Malware payload (Mirai)", "value": "c580ee3da3423c3934cd13dc0f2b2096a6e2224b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244108, "uuid": "83bebc2c-1668-417b-a424-21b6e8708358", "comment": "Malware payload (Mirai)", "value": "851d5f91c4dafeac5efa764a48604239905c981e69e60a2842de399b2a9881bbbe8cf7f1da5d2c2ece1748e386bd7a0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244108, "uuid": "86a2cbe1-61fd-48b7-bf9d-49d8ca01b6cb", "value": "T11173A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244108, "uuid": "a3bdff72-d93b-423c-9584-c689863476d2", "value": "1536:zJPEBmW5iNWqcGTIwnXHZ84OqdZerEStu:zJPEB8NWq91qqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751244108, "uuid": "18fe9524-53b2-44d6-8cd0-3d72a43cafb8", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751244108, "uuid": "8a42752a-2be6-4a12-b624-3c1ec72a89b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244108, "uuid": "8e82c5a6-9433-45b5-8567-1083e160c485", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28fceff9-5602-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751322772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322772, "uuid": "8d4d0a80-76e3-4327-84d0-84fc5eb9aca8", "comment": "Malware payload", "value": "a7b05b9b8b04a5763c046d8ef698bf2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322772, "uuid": "31fa1d38-3333-4e67-8209-af098407c305", "comment": "Malware payload", "value": "765873d885aa250b9c064d7a24451d5246b77680e893be73741bee9b97652dfb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322772, "uuid": "803242a0-cc5f-4ae4-abdd-c5f0b98ccf0a", "comment": "Malware payload", "value": "563b601eb72ff0ed0e78345b814961024f3a5c35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322772, "uuid": "d20ed2a0-ac1a-46fb-8ea1-7f4aef043c43", "comment": "Malware payload", "value": "25c1568889e119b474d3c43f5325727c8f6ab0416edb898c1ba65c68844bd683ef9da020b1c85a8428ea2d6b5d337763", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322772, "uuid": "e8646e9f-6b35-4dcb-9be3-d689f06d34ec", "value": "T12CB402018F881F8BC5AFCD750A2E167311AEDD9F46CA643E807CDD48B6A6D0D6783C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322772, "uuid": "36d51f87-43e5-4bcc-ba2f-e7d3ca5c2d15", "value": "12288:7A84JF9Qc8GgZxTM6m1U3snB6NnVuqnAtSyBpywBdlEykR6LkV6N0L8AXwtZJHZz:/M6m1U3rVuqAtSySwY1gEIZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751322772, "uuid": "2032e775-c3d9-4e9b-b351-fd65fcedc043", "value": 509272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751322772, "uuid": "3e4ddcad-35ce-4279-9eb7-1d2c47ded904", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322772, "uuid": "b7a22878-2ff4-4620-a712-317ea4fda1d5", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "277c61d6-5602-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751322770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322770, "uuid": "2aaeede7-37d2-4e36-8207-8d6a6e8808ce", "comment": "Malware payload (Mirai)", "value": "2e80f8204329bdc4aa5b846bbb899b77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322770, "uuid": "c44f89d5-1dc4-488e-9c3a-878f64ae17d3", "comment": "Malware payload (Mirai)", "value": "766f32886fdb60f4612a37e778db6659215ac6394503bfac17f3e4a107ac4d7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322770, "uuid": "8f79bc14-efad-48b7-a1d8-294e9ea8c9f0", "comment": "Malware payload (Mirai)", "value": "17624aa7eb3f61741666bb39398fcf86df9709d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322770, "uuid": "e68be75f-fdd9-4ebe-814c-4111f009c8bd", "comment": "Malware payload (Mirai)", "value": "8e2e7d70ad0a1c52cf701b8f1d063b70aa08120b158c117930e17cf69bb9e1465ab0f143830270e3a68a5407e46ba974", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322770, "uuid": "0bcd0e0f-35f8-4de6-9891-364d9a638250", "value": "T136335B21AA762E27C0D2B4BA11F70324B2F65B5E25E8C72E7D720E4EFF54A4061536B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322770, "uuid": "22fd42b9-cb97-45af-adeb-866673914491", "value": "768:waoBNYq9+LzZswZUIM/G7lh31sDQReO+QbeHiLO:waYYS+LzZsgUIM+7fGDQRsEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751322770, "uuid": "4a6c906b-8d14-49c9-8cc5-f8673ae414ad", "value": 54336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751322770, "uuid": "48726ea0-b5a8-4a00-a26a-9099088c9c80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322770, "uuid": "1f4d040f-b120-4928-ad1a-03baa874df9c", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fcda3ef-557b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751264775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751264775, "uuid": "e4d8ac84-a66c-4688-9a7d-13e0157e1627", "comment": "Malware payload", "value": "b18c289d8ad390df03c949dd9fb6caf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751264775, "uuid": "f19b0b33-210e-444c-8670-99ed93c4f02b", "comment": "Malware payload", "value": "76acc48bdb39734f5acb1ff7903f09d7b7b804c52f4ec731655a68796ae6cd3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751264775, "uuid": "efd0ed05-a252-4f90-92a5-ee2a4f59abce", "comment": "Malware payload", "value": "48107f79e56cf14fea4a0564d78224cc914a4179", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751264775, "uuid": "6d09a26f-5002-4e41-af05-97543eac92fb", "comment": "Malware payload", "value": "db0c37c734303c5eb8f005aaaf0fdb1673acd416dd93500065cbb7b39f41c2017aea0763865eac80786e3be1a81181d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751264775, "uuid": "2117b640-4fc3-4630-94cb-014ed04675f2", "value": "T1BDF23A08AB9CC12FD6AF0E7D75621A215232A7521103DB963DCD28EEEFE77404616BC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751264775, "uuid": "ba9efd27-4343-437d-85d7-d418a71e99df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751264775, "uuid": "0ef95f1f-3ef9-4bc1-96f9-2e84841f34fe", "value": "768:2mQZqx1lYcJnqnaF4we7x77UPXbOfC1kkJ6z:20lYp/7V7UPbOuJ6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751264775, "uuid": "605c6bd2-9b07-4ab7-930e-26bb0a52dddd", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751264775, "uuid": "6eba6806-6621-451f-9561-9d951d3f2cc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751264775, "uuid": "faf351ab-fd66-4350-99bf-84225c84d13a", "value": "SecuriteInfo.com.FileRepMalware.22461.6328", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2650ecc5-55dd-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1751306876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306876, "uuid": "51998272-b5ea-4e1f-8170-8ab439122c2e", "comment": "Malware payload (LummaStealer)", "value": "e51ea40b424b5447893ea1dd4e8bca1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306876, "uuid": "2fd4d1af-bc29-4b16-aa0a-164cb75033eb", "comment": "Malware payload (LummaStealer)", "value": "772e1cd48237d3aef035078a61c271f32b1d8abc04a2a257f17590dc8dbc972d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306876, "uuid": "16f6662b-f1dc-41a7-a405-558ae4e94e60", "comment": "Malware payload (LummaStealer)", "value": "492d223b7018fb7242ab0dcd3233cb503bc7d90e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306876, "uuid": "9ed799f1-4fc7-4566-aac0-504d15191895", "comment": "Malware payload (LummaStealer)", "value": "5812011e7ec031a0c99efc848799075a09078799ebb2d6801633c2e25e8ef785680a83f8a2f691e17066b1a60b1c8df0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306876, "uuid": "cd981e73-3f90-461a-a3d7-403822879fb7", "value": "T1C48533182F89D4ACC50DCC315427590BB7BDEB7B61E36202893B74B0CB3A5116AF5B2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306876, "uuid": "38637ad6-fe22-4412-b9e5-6af2efa04d1a", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306876, "uuid": "327ae086-418f-40aa-9795-3ff80795ca3e", "value": "24576:jDFHSW+B88VMZ1YB+NrscCuRDPQYfiA6FwU/Bf1sTg44dew+IduewhyYIqjbBuR9:js+uMZusHLQYfiASBogLwwduQXeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751306876, "uuid": "0dda7554-4fac-4b0d-b3a4-4aaed9a42a0c", "value": 1874432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751306876, "uuid": "bd93505e-eb39-4e82-91ab-2328313acd7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306876, "uuid": "e37d215d-910e-4818-b481-6ea49f111693", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10038f85-5551-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1751246709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751246709, "uuid": "897f29b0-aa14-49ad-91c8-5a34b62c3e7a", "comment": "Malware payload (ValleyRAT)", "value": "3047c86d63e0c047da3fb982315914cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751246709, "uuid": "6309b51e-d94a-4b43-a14a-323c9b8a176e", "comment": "Malware payload (ValleyRAT)", "value": "78073d05ad9332199eea1f51bc30ae648745d4fe2e725f1ffca0d164369822f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751246709, "uuid": "1d514a66-1703-4045-980a-91a94f19d83b", "comment": "Malware payload (ValleyRAT)", "value": "a4d91f594cfe4e5d3eee76d3fd699927221914a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751246709, "uuid": "6999f6eb-f086-4621-9b80-d059cd579a01", "comment": "Malware payload (ValleyRAT)", "value": "39a111bd6d8ce2d5788e268d7e2574a212ddfce643e874dc179670f5b05dd135fb502330ce51a3c4023ffeba717f35d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751246709, "uuid": "7ca13fce-cd0f-4770-8ce0-f821433ba561", "value": "T1C2A47C0A32A844F6E9678139C9938A06F77378560721DBCF13A4477A5F237E1AD3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751246709, "uuid": "fb9cb9ac-794e-4782-95f8-cd12cfcb81e6", "value": "aa4eb9fdeff2aa13951b349b94f4f6ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751246709, "uuid": "51338fec-35ac-4e9a-a9cd-3ca806d61623", "value": "6144:M7ygx3/bZn5E43kQ8RCS85ITkSdkrTWz8DvumZQ5xQol0XAD35m0ampO83rvdcak:M7JvbZbkTCSIXaeKQG5+YVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751246709, "uuid": "cc3d0918-68e3-4b0b-a52e-22249b9b6c65", "value": 470016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751246709, "uuid": "84e6c0d1-baeb-4ee0-882f-26478fc85817", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751246709, "uuid": "8cf96cd9-f9f4-41c2-80a4-ad1b06a10429", "value": "DASDJAD DA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf5bf04-5607-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751325138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751325138, "uuid": "8b78e56c-3a48-4e4a-9967-78f2c2f8ee4b", "comment": "Malware payload (Mirai)", "value": "1d4e2cd006fe0e7f63d687d602f5e736", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751325138, "uuid": "6436a57e-c983-4209-9079-89b0382cb55d", "comment": "Malware payload (Mirai)", "value": "7819f29ddb9555bd58cbc40c139d1e2432b078d9ca147cf753e785d42287fefb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751325138, "uuid": "5f3c2197-a5d2-4918-8840-1e0580a82842", "comment": "Malware payload (Mirai)", "value": "b537930891cd487257d39a37c2501a504096a56e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751325138, "uuid": "5c805058-f277-4add-9c13-181e2fb7dcc3", "comment": "Malware payload (Mirai)", "value": "ffa1b90b169a992ab12a5ef25dfb5a12f923731dfac1c021469c3cdc0c4bc340831d4725433b43dc6b9d6cbfe92ee339", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751325138, "uuid": "4b224060-4204-4981-81e2-a7a51c64818a", "value": "T1A5733A85FC919A53CAC5137BFB2E028E371623A4E2DE3207DD199F21338AA1B0D7B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751325138, "uuid": "b5ce7ee7-d008-434d-b348-1e7031ccc182", "value": "1536:9QgVBWu89M7aVSPfYGHf47gHTu++f5zhc2UpXyvZ:9QQBWW7sSQg4uTu5djUeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751325138, "uuid": "3401ffcf-5a7d-47e9-ab26-d54ba6c4641d", "value": 79516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751325138, "uuid": "2077e0a0-2d66-4058-9379-21865c91c155", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751325138, "uuid": "4c91b51b-6829-4c56-8401-6bc1b05903aa", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d98d3ebd-559f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751280548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280548, "uuid": "b9355ee7-740e-4f6c-9ab5-7c1dacc84cce", "comment": "Malware payload (Mirai)", "value": "1f39b89ef00b84a930ce60a6627ecfc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280548, "uuid": "929d50f5-e4e8-4a9d-a1fc-89633e03cedd", "comment": "Malware payload (Mirai)", "value": "7826fe611769cfa6b4687ed3f8fec7e2d21377ad5936c344f1f461e7e496af0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280548, "uuid": "2c2d6013-111c-4c53-a031-ed38db7ab027", "comment": "Malware payload (Mirai)", "value": "be83055ba4762be969fbc78590f65896e8577b83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280548, "uuid": "543f53d7-cf84-42ec-b084-64aa0b537053", "comment": "Malware payload (Mirai)", "value": "925ebc7ad17fc091a3d3fa44a96cbcf604a91a65b74c3937bc7d3261a218a004874dbec656f03c5a44835ac838594b42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280548, "uuid": "e9d881a0-23f8-4a51-8595-fde5ce96e1bc", "value": "T1C3745D83F802DDB6F40B9A3204DB07126231FBBA0A435663B2177865DE6B3D65867FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280548, "uuid": "b9c9b8c5-1c84-4fc0-94e5-d7b606c21286", "value": "6144:BHFyyaWw/1H4QBokJTh2yZaPnz32ZpktLbcAMJiCRgOgVT9uScjjmLGR9FHnwHqE:BHFyLWA1H4KokJlDEDMJiCRgOgGScjjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751280548, "uuid": "53121006-f592-46f8-a068-7d8a5057f573", "value": 355534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751280548, "uuid": "40446398-efda-48a8-905c-32ae7efcf1a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280548, "uuid": "f745299b-b1ec-4b02-95f3-91bbb9750c9d", "value": "m-6.8-k.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a00779ef-55ff-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751321683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751321683, "uuid": "9471af2e-3923-4536-b9df-4d36390f37c7", "comment": "Malware payload (Mirai)", "value": "1b040b740b0bf654235749de166fc7ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751321683, "uuid": "86677e08-d1c6-48b3-bae9-0988a1707c5c", "comment": "Malware payload (Mirai)", "value": "789bd58b6abdb4736c56bc4c0882ecd9d0f320cfb361a0cc3d0216a327d014d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751321683, "uuid": "1f0f5fe7-0e3e-435a-83ec-d1577bbbc808", "comment": "Malware payload (Mirai)", "value": "3a6b6d4125ef74f7dededa62412b797f7d011ea3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751321683, "uuid": "819e3764-c4d6-4bce-bf35-74b5e91a21fa", "comment": "Malware payload (Mirai)", "value": "e2e045e97baa0f27be30a2457fcfaa64ca0616c787794dcc491eb78a2e6f842752995cc71198d524ea0bc76375d2ec76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751321683, "uuid": "c9f3c52a-df2d-4342-ab61-9c88c474d568", "value": "T17BF2F130D1791DC6C5DE7FBC5E7B9A9636AD9B22A3A3DB011204CEC99B60CB917006D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751321683, "uuid": "fed3a776-e1be-4445-b6d1-88630e557f9d", "value": "768:LqRO0ekt0c4nvdiVpqLvuCyKhNK4uVcqgw090:GO0ePc0w0LvzyKhNK4u+qgw090", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751321683, "uuid": "744b24ab-b4ca-4b02-b7ca-33dc8e04b444", "value": 35472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751321683, "uuid": "06e6f269-d663-4151-9e44-c274df84e660", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751321683, "uuid": "e5535df6-3faf-4371-963b-cb85c9a06885", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e76e74-559e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751279893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279893, "uuid": "7fffdd4a-4517-4ae6-adf8-5bba9c4bc12e", "comment": "Malware payload (Mirai)", "value": "49fb5e31bd7f7ed89dbd5e59b906b8d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279893, "uuid": "fcb6454c-89cf-49b3-b190-7216a4a0be23", "comment": "Malware payload (Mirai)", "value": "791a2a7fba70a33ce2fc43fe21dd2f693412674d6c8c7642b9ba426d7fb16583", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279893, "uuid": "e2eb20eb-534e-4dad-8d7b-b04f1fca9200", "comment": "Malware payload (Mirai)", "value": "ce828adfe76eb28bdb7704a05611213bf8f60c87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279893, "uuid": "be2565a2-ce6d-4d1d-9eca-5265fcb00bb4", "comment": "Malware payload (Mirai)", "value": "13becfff6a950986e83a06dacf5704a07dc0fdbec31597cf9634be292d1f34eee177ca390595d8448cb7fdfeeef0eb7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279893, "uuid": "3dd814db-b0ce-4819-acf9-c4eccffcea80", "value": "T152F3881A6E228F7EF668833147B74E25975C23D627E1D684E1ACC1102F6029E645FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279893, "uuid": "38eface8-fd47-4532-a048-f67c315c9b45", "value": "1536:Am76gOZtQ26gMpYq5rrMCj7jAlpWZeJ+2ggirDTP/6Q9han+GGQWswO:t6g6u3rMCjfWpWM+2yHP9hanxnzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751279893, "uuid": "499a43a1-5a80-4500-87fb-11c3ed11f11a", "value": 161620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751279893, "uuid": "6ba366cf-a1bc-4017-945f-fb10bba205ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279893, "uuid": "d1e02434-7555-4b71-9518-d97ee0e7d727", "value": "cutemips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b99335b-55f0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751315072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315072, "uuid": "5ffd7d98-1eb8-4387-a38c-1398417c3725", "comment": "Malware payload (Mirai)", "value": "5bea82026ecedf99254c2d876222665f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315072, "uuid": "7480a3d4-091a-4ff2-b001-7d5018e68fe1", "comment": "Malware payload (Mirai)", "value": "79f7eece6fb63d1fc643ebdadfd85c0a5958f39b1b4c3663beef4d0a387fc054", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315072, "uuid": "c23571e1-564f-45fd-82ea-101667ea953a", "comment": "Malware payload (Mirai)", "value": "5fc74f6bbf6bedc3d75bf903451962370175b762", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315072, "uuid": "51320023-0f0a-4ac1-ba49-7bdddea6c5ee", "comment": "Malware payload (Mirai)", "value": "0c172d18329ab800788396ee84ade28c348ace66340bdd6cd737d1ee7be646eb9831955aed11a9d3c86216844cfe7bd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315072, "uuid": "a58db0a0-fcc8-4418-8621-62f4f2afe58d", "value": "T1D8832A4AFD819B21D5D512BEFA1E118E33131778E3DE72229D18AF2173CA52B0E7B815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315072, "uuid": "856c7bd2-99bd-4467-8edb-b8654c4f7eb3", "value": "1536:4D4nC2maeEU5nJ7IIjV1Jd/IomkWeaO18i1XmDLiIztu345HYY:4p2yV7OjkWeaOKztu34VL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751315072, "uuid": "80493cf3-ac18-404f-9349-df7fad7d443d", "value": 87620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751315072, "uuid": "81cd7c2d-1906-413c-b8c9-24579a234d5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315072, "uuid": "d1726af5-d689-4fed-9adf-37a65b305d3c", "value": "SecuriteInfo.com.Linux.Siggen.9999.11198.21650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5aee9d7-556c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751258691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751258691, "uuid": "6610f759-0419-4be8-b5e2-4e9fd39947a3", "comment": "Malware payload", "value": "e639ec3bd808191848ad3283badba921", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751258691, "uuid": "d19b74b6-e6db-4594-90c0-ffbaf0ee7f42", "comment": "Malware payload", "value": "7a012c55b1f7292a826568d94ce0348a8f4c86a180c3ca8a02786f6432f16d25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751258691, "uuid": "b4f7103e-ef45-4c20-a7f6-b1779f4b3ec8", "comment": "Malware payload", "value": "988bde32166ff06ead4740db637219fe0c6a2cc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751258691, "uuid": "659b0648-942f-497d-95fd-12f3c3f81c7f", "comment": "Malware payload", "value": "e5be7526d657bae8bf2b06160ad7aaa7fdc0de1fd47a3e94734236776276ef784d3ca3f33c17ee1c220328904e634692", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751258691, "uuid": "738d0ba1-b123-4f9b-9c41-3154ca26e762", "value": "T1FCE412017F152032C9D21AF0A8B747B4EB914CD650B4D6777749EB222BF36362C8BB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751258691, "uuid": "6217cc6f-4204-4c28-a928-4b62eb1c8f24", "value": "12288:XeBWVNQiXY8aap1qXG2YmzwcyxDKsFM+t9j+9+X:uQQAYLapnLmzwhtLy+t9j+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751258691, "uuid": "06fe7b3b-af2d-4f40-9c50-fd48f6ad6d9c", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751258691, "uuid": "2ac6caf9-8e7a-4a78-8e4d-1eeea887358c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751258691, "uuid": "0305c24c-56fe-4871-966d-eb92ed31d215", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9515a4f3-559e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1751280004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280004, "uuid": "641622f3-55ad-4b55-a21c-6fe2b85935d7", "comment": "Malware payload (RemcosRAT)", "value": "dfaed4537052d422b6f4493bd2992cde", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280004, "uuid": "6bdff668-a2ab-4db8-9c5e-09121458a5e7", "comment": "Malware payload (RemcosRAT)", "value": "7a544c279657f9675f44df497168bbc35f0be56dbf342f5cd23b207186c2827e", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280004, "uuid": "1af1ed03-95f1-4649-88fb-04cd119d34c7", "comment": "Malware payload (RemcosRAT)", "value": "db0b11b663e06b89047b70bdaf76c3301806b554", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280004, "uuid": "3b62c65f-bfb7-40a9-b87d-82885ec753b5", "comment": "Malware payload (RemcosRAT)", "value": "a0c7d77e23a79eb5eb97a762c80252c10bf88fab0ad16059783d61812ddb617011267624c6b3a07a311d491d6fda4ead", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280004, "uuid": "c8a134e9-e996-4af2-a067-41935fc9b6fb", "value": "T12D51EF2516F60218E6B2EB3664B9A6148DB3BC16DD74AE4E015C02490B23A00ED34F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280004, "uuid": "e882b992-129f-48ab-965f-8d2a9c0ec8bd", "value": "48:8WfJhs/qCD4npTX46Wo/A3gm0lOsn1iO+KpKTai6:8y83E1A3ylOsnV+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751280004, "uuid": "bf81c154-6656-405d-ab4b-9df318b5e348", "value": 3137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751280004, "uuid": "f109deef-8cab-42ef-8dca-26dccebad4d4", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280004, "uuid": "a0f1bbe7-2c57-4c81-b661-3565c94bc6b1", "value": "FA25271NAFTAL-KHROUB-29062025165341.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee136d8-556f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751259888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259888, "uuid": "c529955c-d552-4272-8dcb-282e8542a88c", "comment": "Malware payload", "value": "a73f67b39fe463107943cbb9b90f5cd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259888, "uuid": "4e0bb620-06e1-4d4b-a77e-5d5d175d0323", "comment": "Malware payload", "value": "7b329d4ac058679e5e43fc8bb5777ce5d7659b9cf0fb50cf8b47ddfdcb3ae20a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259888, "uuid": "60e7c1e7-0270-49f1-bc5e-12436240ff27", "comment": "Malware payload", "value": "7d480ed99d19fe959e4c95216d667c75770f8e35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259888, "uuid": "7ad16416-bd38-4cb6-9b25-e626718ae525", "comment": "Malware payload", "value": "87c0c7cdb8ca9e389905f2c12315cf981692549d8c9ddec5f9291b377c148f3d3dba4371f0a7b229939b21b5bce0c54c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751259888, "uuid": "69f6c2c1-6dd3-4364-a61b-af27e291af8d", "value": "T1B9C4F1A377204F91C35195B209F389335AF6199706F39982537DEE107F20A68386BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751259888, "uuid": "432024e5-5f83-4620-aed5-bcece57238be", "value": "12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7zk:W7v+mrY2xzf03yvZ/YIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751259888, "uuid": "c8d14c91-b170-42be-9858-211c2650d714", "value": 592688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751259888, "uuid": "7fb87e45-0259-454e-aa67-9368b1095344", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751259888, "uuid": "03baa966-b981-40ab-9da2-dfdc9fa68fd0", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad1d7772-55d0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751301519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301519, "uuid": "d5595f25-7b1f-4f86-a266-2c005fdde300", "comment": "Malware payload (Mirai)", "value": "7d4c53d531ed1a6f10c1a758615c6906", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301519, "uuid": "1f1ff81b-7899-4e51-827b-76d59a1935d0", "comment": "Malware payload (Mirai)", "value": "7b6bba4e96e466269dd67e803f36e9902228e565d19ff96697c9a9591f6f1d45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301519, "uuid": "fd29f6bf-aa1a-478b-a26e-4f015f69c4b0", "comment": "Malware payload (Mirai)", "value": "95118f586eee9146afe9fc4c29b4b1c8ad246289", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301519, "uuid": "dd9b05a9-6042-43e4-a0a2-9056b04edfdf", "comment": "Malware payload (Mirai)", "value": "dc794e0e6237637931ce70cf674ac9cc0c2461197d518f2161ecc7f384da618aeaa304c52eed9acf2c5117be4fdf9e5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301519, "uuid": "d38b2935-4e56-4970-bd41-b66dd07a2986", "value": "T178B3AEDBF7472091CC624BF407C74B9E2E237201DE67E8E76C1E2A3A19790DB5906392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301519, "uuid": "eda4b993-0630-4da6-ba07-91dc7a96ec97", "value": "3072:c9TT861KpnHUKmBr1i57upNHXy/+qgVq:c9E6gpn0vC84Sq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751301519, "uuid": "9b6945ea-128d-4763-8afd-ee1ca800222a", "value": 116256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751301519, "uuid": "0a4ec4d6-bb89-48d5-910e-48133c3414e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301519, "uuid": "a355caa1-8ff7-4364-9342-89884778699c", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "641216ec-559e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751279922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279922, "uuid": "a5561d74-ecfb-49dd-afa8-03b5786b8a4e", "comment": "Malware payload (Mirai)", "value": "5108a8df9bca966fc592d9d5aa393914", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279922, "uuid": "d20dcc3c-0aeb-414c-b23f-0cc651659cac", "comment": "Malware payload (Mirai)", "value": "7b806e8fefc9225da47d965a7cee902a61768db82bfd69a94da97da0abd5d924", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279922, "uuid": "6d05afe0-23e2-44e3-bea6-43c007f44b67", "comment": "Malware payload (Mirai)", "value": "46b80fa3581dc0fb63d62025e387b3ea1ee1eba8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279922, "uuid": "6bdb70a1-ea91-4a37-ac9f-40fb051de2e9", "comment": "Malware payload (Mirai)", "value": "d966a3eb5ee36696820da01ae9c557e9c793daf9db6f91fde6c21abfdfe640ebdad0dc72e0df64a2fba1353162b55077", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279922, "uuid": "dfe04d2e-43cb-4441-8407-05a57b1f1813", "value": "T19B832A85FC819A12C6C5167BFB2E028E372667A8E2DE3207DE156F2233C661B0D7B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279922, "uuid": "8c57ecae-22ff-4f4e-8b8a-e76422207d3d", "value": "1536:kWB3Ty4FBs7qnUOkg9RwsBc4FDUmRwAXjP2aGTavnUd4:kWBjy4mqUe9S4FDUsTznU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751279922, "uuid": "055c1924-c2fc-4a64-a596-51e8953657c3", "value": 87528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751279922, "uuid": "4466a8e2-22c2-4774-8a94-357f31c4cab0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279922, "uuid": "79cb6997-5975-4491-88a1-864b24b802be", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73379b6e-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XWorm)", "timestamp": 1751291973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291973, "uuid": "9ac376a5-c9e7-4269-bdc8-afad7c9514d2", "comment": "Malware payload (XWorm)", "value": "fee251b3953427916b3cddd4fdc6c697", "object_relation": "md5", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291973, "uuid": "85741e7d-a44c-4066-b35d-9246eeb5334d", "comment": "Malware payload (XWorm)", "value": "7b990f3bdad87d5fbc3b192d6133e83bfe129469877593b4e1415fe91c88627d", "object_relation": "sha256", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291973, "uuid": "c5a0cf04-2d0a-43e4-afe8-ef2428f3711b", "comment": "Malware payload (XWorm)", "value": "feeb6babab07516a4606b7a29be14f44f351b25d", "object_relation": "sha1", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291973, "uuid": "d922cae8-5a8d-4f0b-a163-fc602ac856dd", "comment": "Malware payload (XWorm)", "value": "3e9ced8f51d7a3e12ce4ee71bd8641e7b939881e5e4e7ee4192531c55cd62b5985cec6aac399a1fcfa91edb3f72cd3e8", "object_relation": "sha3-384", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291973, "uuid": "c6bd4e4a-5bd6-4a4c-9c9c-ce34049ab4d2", "value": "T16635684D94B15DC26030FE70E941FB96C8EB57850E574A920FE1A4A96206C43FFBF7A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291973, "uuid": "953758ae-bdd5-443f-b0ef-7d14fa33e250", "value": "6144:f4LkY888/BsnoRoRoRAK+9U1Ze2gFoTqh6V+JwTGjY99wIF3CR+yB1dvHHDaMOF8:f4LkaoRoRoRSJwQ4fzyWmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291973, "uuid": "f7739739-1fb4-4a8f-ae9e-3fc2e01b561a", "value": 1155914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291973, "uuid": "47757106-68b3-491a-b614-ee92b57d197c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291973, "uuid": "c3aff573-047e-47fd-b2de-c6cd31f19727", "value": "HSBC_Payment_Advice.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "110089f8-5592-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751274628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751274628, "uuid": "68e798df-a30b-4755-a55c-ed8c7ee93a81", "comment": "Malware payload", "value": "2ae0afaa8c6894686ae65a1b22d75f42", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hashkey", "colour": "#7AE3A0", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751274628, "uuid": "4b62fe5c-cd2b-4661-9373-bfef5a4f8458", "comment": "Malware payload", "value": "7bc1227aa629304dd34fcd2bfae9b3f2e306da393cfe9bba56a89e72dcbe0440", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hashkey", "colour": "#7AE3A0", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751274628, "uuid": "8bbcc06c-aab8-4f5e-bda7-0af4822b9d9e", "comment": "Malware payload", "value": "fe8566b87af4f82d006a6d30e511bc3579a4d81f", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hashkey", "colour": "#7AE3A0", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751274628, "uuid": "ee8d68fe-cb3e-4397-a940-2a768d9fba5e", "comment": "Malware payload", "value": "0ed0ceb0b7e0fa8a0f7f582e1ecdbe7059e292c355c50b2a5f797e8fb55c3271a75a61e247d134d5844a0f96e379c623", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hashkey", "colour": "#7AE3A0", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751274628, "uuid": "8bccad82-43b8-4a00-88c2-549c6f76e789", "value": "T1D5E633CB02673B3BD584B4B04EAF7DE5B09141D2E82699FA6132BDD1C0F96D9C91CB06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751274628, "uuid": "c52212a6-544b-48a9-a076-de07d48accb0", "value": "196608:vYlO4WeS77RYYK3YlO4WeS77RYYKyYlO4WeS77RYYKLYlO4WeS77RYYKKYlO4Weg:kWeSpqMWeSpqzWeSpqIWeSpqLWeSpqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751274628, "uuid": "9b889ebd-e9aa-46ba-aa3b-db0204095753", "value": 14983862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751274628, "uuid": "a2f55304-de09-4d9a-9692-ed3ad6060edf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751274628, "uuid": "cf93a7e8-87b8-4fe7-83ae-67714c8fe54f", "value": "114.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f927607e-55e2-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751309377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309377, "uuid": "0bdd8fee-2bb8-48ad-8d1c-29239e71b43b", "comment": "Malware payload", "value": "2749ed0cea233658e41d5521bd570d87", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309377, "uuid": "5245cc14-75cb-47b4-adfc-3990f37a83bf", "comment": "Malware payload", "value": "7cadd7050df6c6846cc43c6da02661fb6c885e022640291eb09fe84d7921e5f5", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309377, "uuid": "605acd8d-72eb-470a-8f35-b87c6f8acfb8", "comment": "Malware payload", "value": "873f63ddc01119a222ec0345408a27d8fa806368", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309377, "uuid": "5e399c91-9d32-47f2-946d-a62f29de2a68", "comment": "Malware payload", "value": "047fbf003c48389064ce70bdde3ef8c54fc93dbe26851ec6ab37a2faf613dbc5ab2debf4fb53df0f115a355b18f3d025", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309377, "uuid": "f0258cab-0014-42fb-84e0-f64eca3b895d", "value": "T112D5CF8AF705E8AAC0F7D632827506665517CC668A43E3875E59F27C0CB79C09B87ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309377, "uuid": "6be28491-8f37-4236-ae65-d788e8db8104", "value": "49152:kVes9TvbQQq6fabmPITgxsShvaQmU9IL003WMe0Am7kMd7Ej1LI:kDTtzSb2xRvFT9zYWMp7kMlEj1LI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751309377, "uuid": "86b7ddfc-9d41-49cb-a029-17a28fe16fdf", "value": 2868807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751309377, "uuid": "9ad46d73-aac1-40b8-b164-784bdc98982f", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309377, "uuid": "5d38e5ed-01c9-47df-9516-a035ec0acf44", "value": "Android (2).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a650662-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1751292012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292012, "uuid": "fcf364ff-a1f3-49c7-81b7-095d361444ae", "comment": "Malware payload (RemcosRAT)", "value": "71248e7a988f6c33a15217f84126d476", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292012, "uuid": "8a80346b-ce38-4096-a137-fa73a39dbb66", "comment": "Malware payload (RemcosRAT)", "value": "7ccc6e02a9571b7e04dd21f1571e3db4f5af3c61d6fbb17c691014621a4b4eb7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292012, "uuid": "efc83ceb-c395-4f80-b060-f00c7eb849a0", "comment": "Malware payload (RemcosRAT)", "value": "9512b8292a007482b8c9a6effc6a6cb7b1dc0756", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292012, "uuid": "77d00ed4-e1bb-4235-acfa-e0f5ce2de263", "comment": "Malware payload (RemcosRAT)", "value": "db7e0487208ec2879034347c6071ab313954011b6cec98d072dc4dd313b054ff9ab29856b44c939940a3b2639b4f78ba", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292012, "uuid": "36021401-0722-4c0f-80ad-743d79325be1", "value": "T1CE669D8E8D0FF7433092DFE06A88B99AE03B668317116B3074DC5D0AB74DE9A1DDD658", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292012, "uuid": "e0814f7c-3b22-4c83-9f3d-672d067dd1f8", "value": "6144:GfHofoVqiiAeUyZ+TRNYPUJISd3Zy1nYAF8gVXVFRfjvnx3BhIz/VmhCoqEuOhHu:Gf5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751292012, "uuid": "42c965e2-4da9-47c5-9df2-c7f41bec9a32", "value": 6887919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751292012, "uuid": "bd19f81b-7d2a-4e1c-bb51-7ff224f9e514", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292012, "uuid": "3b4ed780-9c4e-40c8-b212-fffb4fbf0475", "value": "Quotation.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f514441-55ff-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751321682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751321682, "uuid": "88c49b69-2677-43f0-9f9f-a370ace98437", "comment": "Malware payload (Mirai)", "value": "0bc3d42e21939547b677b403c4e4c8c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751321682, "uuid": "c85e1a09-6948-4db6-a777-52ce2c92a0d0", "comment": "Malware payload (Mirai)", "value": "7d3669ca2e57d07a637ea41e48ee58cdfbdd306e26d57f3a8668d8909e879f39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751321682, "uuid": "5d859531-d01a-4450-8d55-4a64be4b757d", "comment": "Malware payload (Mirai)", "value": "c1ecfc7aa3299e180552b0ca124325110dec8fdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751321682, "uuid": "a82bf122-7b56-45ec-853c-34a047e7a771", "comment": "Malware payload (Mirai)", "value": "c9d9fc8c317694d47d187909841f4c26a5646e422fc89ae39f3568c65f64dab3d984450a712c65f703fda98b7ec7b3bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751321682, "uuid": "77192b54-cd84-4e3c-a344-59ea32df55cb", "value": "T100F2F126C5566949CBAE47B302DF371A9860F33FE5E1C0A715E4D235E2E9F790C04AC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751321682, "uuid": "8d07eada-0e8b-443d-9e82-e392982df08f", "value": "768:yrSCw/jAO84QeRg/f9xv0do8UwGFMtYXP6kLLQXVX8irnbcuyD7UHQRjI:tTAOtSPvigbP6kLWX8irnouy8HyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751321682, "uuid": "f7ba8c17-8020-48d5-8854-0aef5b61faf1", "value": 36800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751321682, "uuid": "c61e9b64-1c52-4aa4-a3d2-9ea01f681563", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751321682, "uuid": "6a8ff50b-f5dd-4000-beba-26ce4e9bb7d4", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7daf3b3e-55d4-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751303157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303157, "uuid": "213eb61e-7d5c-42b2-a726-98f16ba0d75d", "comment": "Malware payload", "value": "a9f4fd144bf7666565cc9caf07f36d53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303157, "uuid": "2b87f39c-0e37-4cce-bd5f-088b332fe85a", "comment": "Malware payload", "value": "7d94d5df721c95d8357a08e78d1436f4d264a158bb826da6314fdada5be025d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303157, "uuid": "14c322dd-4714-4272-8d4b-7b8d255af95d", "comment": "Malware payload", "value": "43318bfb8cf5911e67759e545231367e9a3a7260", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303157, "uuid": "b6fd1961-a7cb-4565-a3fc-583afceb43be", "comment": "Malware payload", "value": "c918854d8ccec9de3883dd309606951df12281b0945b0aa4f6f40e9c9fe3828b7eafac850634408cb606d655e8f4d1fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751303157, "uuid": "367754a3-01a4-4b5e-8e41-ef6fca49cdea", "value": "T15EB41228EE4E38C1F3D1E3B8DA0A4BB1B05B79D0C166C1B2BA41E25D95EDDDEC5D0212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751303157, "uuid": "ad64006f-4dfe-4666-8af5-320e01e62115", "value": "6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751303157, "uuid": "bf80dad6-19e7-44ba-9e59-a2acfa27495a", "value": 509896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751303157, "uuid": "fbc0651b-321c-4340-a399-565f77ac34ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751303157, "uuid": "0769adaa-9de3-4459-87f2-56750c23a02c", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be1e75cc-5589-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751271053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271053, "uuid": "24f63c85-b345-49c9-8905-ddcec660a232", "comment": "Malware payload", "value": "9af7fc508749f24793ec5042a84d5931", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271053, "uuid": "a3c221cc-39d6-4371-9784-bb22056c58fe", "comment": "Malware payload", "value": "7db6154d0d14a4f944b1eaf11c173dac6b5c4f59c5e21c38e4f87293b9de209f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271053, "uuid": "bf74ef76-a721-4634-9967-8788a3540350", "comment": "Malware payload", "value": "fdd7121b36591eb2945f0f76ac03f7d01aedded5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271053, "uuid": "05fccd80-4cf3-4fcd-ba43-752e681f01e9", "comment": "Malware payload", "value": "132a858d307aa72247181389bd7b09047050e186a99097ae32c6a3112d0e88da32d7610b2081b16c629089aaeab2097f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271053, "uuid": "2d749447-a4aa-4a0e-bcd6-62b7e315c5b1", "value": "T12DB41228EE4E3881F3D1E378DA0A4BB1B05B79D0D166C1B2BA41E25D95EDDDEC5D0212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271053, "uuid": "eb793e74-3e4b-4726-b71f-c297fe54d91f", "value": "6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751271053, "uuid": "707fc761-92ec-45ab-8dc7-791300a5038f", "value": 509896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751271053, "uuid": "078a2d3a-3b9e-4d8c-bc2c-7e3b767f9faa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271053, "uuid": "7cd1602d-12bc-4a20-8846-26e488df0f3e", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2059db4-556e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751259410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259410, "uuid": "1dc8fd59-7c70-432d-8cef-c7c2cc713bc7", "comment": "Malware payload", "value": "348768eaf76bb62f2de82909c7877d0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259410, "uuid": "94931a1d-f3da-4661-b7c9-ffcb87a84adb", "comment": "Malware payload", "value": "7e18860043d01931b15919593ca0a5569bf787f45f5cea84f64931d65a4b3613", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259410, "uuid": "e204d5fa-eeae-496e-ade7-a5107b052fda", "comment": "Malware payload", "value": "63016ac2a4089e867e55615fe7d5985d4b644ad6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259410, "uuid": "96a39d20-3165-45fb-8002-9d388cd4d559", "comment": "Malware payload", "value": "b38a8adbe2a09e2fb26b54a47359de9f477d90ac07df04f026a45aaf172b9781f7629d92f3d9565e0d93a45f9686466a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751259410, "uuid": "b9069fa6-6a60-42d1-8665-c61f8b24ce7a", "value": "T1C9C42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6D742F661EDB1B424A9E66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751259410, "uuid": "b304e58b-8fe3-4a30-a856-fc031b29d64b", "value": "12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751259410, "uuid": "2816fd54-cd2b-4b82-8cdb-447b5eb73cfa", "value": 587764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751259410, "uuid": "6cea6d2e-72c9-476f-86d5-a27fbcc9cfe8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751259410, "uuid": "93c81799-403d-4f07-bb23-d0ef80e330a7", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "385a5b9a-5580-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Heodo)", "timestamp": 1751266963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266963, "uuid": "2f49c2c6-0220-4187-8e91-4a5031511cb3", "comment": "Malware payload (Heodo)", "value": "b0e54ddb1cbe04194b8101e35134b5d1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266963, "uuid": "3fec0948-fd61-48df-99c8-55589d6ed0cb", "comment": "Malware payload (Heodo)", "value": "7e2efc2689f5d93877689c72246a6a632e0f642e7e7f0874920455d7d2ecb612", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266963, "uuid": "2cc0311a-8b15-4601-975e-8415a49b745d", "comment": "Malware payload (Heodo)", "value": "9d241a56877d672a19b9dc0b3574d41486e57df2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266963, "uuid": "4e1c8fe1-e0a0-47a4-9478-51c5f845b742", "comment": "Malware payload (Heodo)", "value": "83c5349e0499c5099e1d18803f9382d0f54807336a8bf6aff606e0391398698099045be4869742d1e99643b5217b8f15", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266963, "uuid": "b47e81f6-588d-44e7-8518-dfca5e6f7754", "value": "T195E30FE16744C469D8AB9679843BDAA77433A34E9C68490D2CD2FF0B7D7238700279DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266963, "uuid": "1ab2de57-8384-4139-9bdf-b285c98bbc01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266963, "uuid": "2129aff5-6381-4341-9ddf-788fb3fc061e", "value": "3072:VsdyZaDypTMh5ZSzIrRuw+mqv9j1MWLQlmsolWM+9TVDjn:VfZamzuDA1+dV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751266963, "uuid": "2fa043e9-3c70-478d-9f1e-a9d3989f49a5", "value": 150664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751266963, "uuid": "4972237f-cd04-4e93-9b9d-b4b8c6c40e5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266963, "uuid": "62d910d6-5690-4a0c-bf97-b14a3fa4788c", "value": "A\u043a\u0442 c\u0432ep\u043a\u0438 \u0432\u0437a\u0438\u043copac\u0447e\u0442o\u0432 \u043fo coc\u0442o\u044f\u043d\u0438\u044e \u043da 24.06.2025 \u0433o\u0434a.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b738dc82-55d5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751303683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303683, "uuid": "f583c7ab-026b-4bc1-b0ef-f0fdcb55100f", "comment": "Malware payload (Mirai)", "value": "08e0dcdfd173654294867869cdc0adfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303683, "uuid": "0da37bfe-4093-4274-9872-1de449a93281", "comment": "Malware payload (Mirai)", "value": "7ea2026a51be7dc8a1c736fcb53caec4521d1243d7e436ec7b5f04449aaf7938", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303683, "uuid": "68a2e32a-a999-49c6-9c2b-460aa15e7d41", "comment": "Malware payload (Mirai)", "value": "9e9a22ab1a3926d81120631acc70b21dad557ca8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303683, "uuid": "9019d699-faf2-46ea-84dc-f130829c6a05", "comment": "Malware payload (Mirai)", "value": "e8f93719a8d09548c404a01307c74ba133aa72b3dc0fe28cf298c4c311ed2d0abbeabfd480a236498fd38f4f35c90600", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751303683, "uuid": "9d1c69cf-c974-488f-892a-d79fe15f9f7c", "value": "T122C32A05B70C0A43D2632EF03A3F6BD193EF9AC121E4F644356FAA8A9172E325585DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751303683, "uuid": "f3fe0e7f-5ba1-485b-ae99-bbc57e10ef0a", "value": "1536:w3iXCI/6uUJniFx/18vTDNANfCfdgWf7MkKvA/IvqlV1jdqaCIkC4/zmz:xZ+ncx+7DoKgK7M6/GC4bmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751303683, "uuid": "102bfd8e-961c-4dc8-861a-f51960b5c854", "value": 128632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751303683, "uuid": "ebac9403-5fc5-42ec-a8b0-f275cdba7c6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751303683, "uuid": "330cbb49-eb9a-437b-a15b-2fbc3a02a51c", "value": "cuteppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3115b3d8-559f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751280266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280266, "uuid": "1b99507d-8f24-4698-a2d8-5859c2e6e322", "comment": "Malware payload", "value": "ead86b396e5e53d55ede493d174605a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280266, "uuid": "f9b84dd7-22f2-4354-ace3-df26a2a1074a", "comment": "Malware payload", "value": "7ee07307d911a86f7b387b3169640e2b0f201c763570e65fb4423008f4cc4a6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280266, "uuid": "1d6aefdd-3ea1-476f-b733-c6941463554c", "comment": "Malware payload", "value": "e275a7c285e590033e430fc18966f5e305008303", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280266, "uuid": "db86b5ca-4f74-43b6-be2d-93efba297fa1", "comment": "Malware payload", "value": "bf7d52845ea2e486f925aaf99d345e2c15dab7bfbd892ebfcd9319af518c9cf5279745de9f9ab3c718bc8421e4fb4ef2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280266, "uuid": "a90b931c-e38f-4efa-8c00-bdb716ca3d02", "value": "T106E4F1037308A756DF4BA83A82CBFD31B7C2799113D096667A80E29F8775726CF0D649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280266, "uuid": "ce1c4886-abd4-4001-8d83-b5a5f057e616", "value": "12288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751280266, "uuid": "ad16b8ef-7053-44c8-bc37-2e7701116cb6", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751280266, "uuid": "03a07948-ba88-44ac-8fa6-2ad3f9aefc70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280266, "uuid": "6e3aa1f0-b21e-43bb-beb4-13183e7fe07a", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa7cf7e3-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751291207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291207, "uuid": "219f1e28-a737-4428-adc5-5b1e48e14166", "comment": "Malware payload (Mirai)", "value": "222dd4fd41f8ab671b60201143f17c7f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291207, "uuid": "6b9de373-af6d-44e7-907c-d0592fdc6827", "comment": "Malware payload (Mirai)", "value": "7f783549f7a0e724b5f0d6042a5b24087e0b1de03f575a4406cf30311964ace3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291207, "uuid": "38900d0f-1f1a-44cf-a963-378c40ede5ee", "comment": "Malware payload (Mirai)", "value": "403e8a5c9e8f3a68f03b91b8a3f951ff06961d2b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291207, "uuid": "80ccf221-720b-4c98-b668-acdee5998346", "comment": "Malware payload (Mirai)", "value": "e686f72960b2d2bf875092c6d3be550d98291210748284af83f8a171e0b4499242b4227fe6970ea26e6f054aa8aac783", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291207, "uuid": "527f8084-a9ca-4731-9d19-f8a03b85205c", "value": "T15E512CCA24A219B93DA79D53717E4AC13282DEEA54C69F1DD8EC7CF440DDE087060AB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291207, "uuid": "73692dc2-5694-4c37-ac91-4a6570bb003f", "value": "24:vXsvmvsRnsrsja9aUis2NQfBsxNoxKeJqTU3NNIt3oeks5Kb86pJoiCekB:vcvmvisgja9aUis8bmqTUwJ5u86PeekB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291207, "uuid": "92db0bd8-8fc4-4569-b2be-7b003ba9bdcb", "value": 2444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291207, "uuid": "b8dc1abb-92d0-4787-b5ba-1e8e9f67955d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291207, "uuid": "0b076bfe-51e6-43ac-8660-4a1223e8f761", "value": "xyxel.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d8f547d-55e3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751309653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309653, "uuid": "ac6f53d4-0cfa-4349-ad05-ef43e866e7e8", "comment": "Malware payload", "value": "52f9e7301f85db663ebb277b743edffb", "object_relation": "md5", "Tag": [ { "name": "ai", "colour": "#8C207A", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309653, "uuid": "5f53af14-95f2-44b8-8d9a-d4f8a9ec99a8", "comment": "Malware payload", "value": "7ff6182372551125a2434591a6760b253f2480bce0198f80809deb98b56a6339", "object_relation": "sha256", "Tag": [ { "name": "ai", "colour": "#8C207A", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309653, "uuid": "b4dca261-7fc5-48fc-b6b9-2d7e4f419df3", "comment": "Malware payload", "value": "74d757716b79eadd10573e9fefd10c9de9c3a9c2", "object_relation": "sha1", "Tag": [ { "name": "ai", "colour": "#8C207A", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309653, "uuid": "ab51ed77-a1a5-40d3-b0bf-ec4e7414d75c", "comment": "Malware payload", "value": "afe5f0873940f8b0a5ab4870b97634d6900058416e5a38a667eac00faa293c4f79f57001bcc2ab86b5a0c0b6db9abba3", "object_relation": "sha3-384", "Tag": [ { "name": "ai", "colour": "#8C207A", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309653, "uuid": "b92430c1-f551-4290-9ec8-18c9f423f493", "value": "T16F750297BB8186A5C8B7A234C425962262379C74DE97D3CB1F10B13C5C73AE54F6ACC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309653, "uuid": "f248d284-2622-408e-95a8-37d6fe88a23c", "value": "24576:DbGXqubugAdWUdi4IlOx/qZ/ubDigsokMK5vmXVns7ofvBxYqk9WxT:DbG6ub1AdWYhqZG6ggjhmF333YJWxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751309653, "uuid": "986ec7e8-ac6e-484c-9e12-10573495eb38", "value": 1665804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751309653, "uuid": "94eaa59f-3ee9-4676-a12d-f66daa6eceee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309653, "uuid": "92328e0f-8e3a-46c8-ad80-050fbe76e7a4", "value": "Luno.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f37529-55e2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MassLogger)", "timestamp": 1751308971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308971, "uuid": "7f4c1ab0-26ff-4095-bc43-3b13ffee6acd", "comment": "Malware payload (MassLogger)", "value": "eb6875efb11a6b7a63b00c59e40a1bf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308971, "uuid": "bf1827e8-51ff-47d0-bef5-dc960f83ca73", "comment": "Malware payload (MassLogger)", "value": "8007c31e19a9fc2f69d1ddaa299b022585e29162810810078d08144d39f11e65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308971, "uuid": "2eed51c8-06a2-4a7d-9331-f347f74da641", "comment": "Malware payload (MassLogger)", "value": "4d9b9665d1126c0ae6ca1b333824c43c0c7abb3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308971, "uuid": "09b2f275-520d-439b-9bef-55078d3b0cd5", "comment": "Malware payload (MassLogger)", "value": "c215871d79f7f254887d9f7bd39b6a738de3eefb4eab4b3a7ba2ce8bb170b4cb795cece30e956caf0b01d24bb8e1c2ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751308971, "uuid": "6fdac395-bb17-4f4e-98e3-7b13dc53f5bb", "value": "T1F135AE027391C062FFAB92334F5AF6115BBC79260127A62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751308971, "uuid": "aa07950c-5e2b-41cc-bdb5-5b4a38a7bf0c", "value": "0b768923437678ce375719e30b21693e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751308971, "uuid": "74b0faa7-d950-4fcd-a6df-0ca591ab2eed", "value": "24576:W5EmXFtKaL4/oFe5T9yyXYfP1ijXdap4rokrR0JO8:WPVt/LZeJbInQRap/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751308971, "uuid": "399a8f41-cb16-4780-acd6-63eb2e0ce617", "value": 1130496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751308971, "uuid": "714a1089-d0d4-4f3b-8f3e-4e48be41cf37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751308971, "uuid": "44ec5748-52c2-4522-8d29-33cb4516cd0e", "value": "SecuriteInfo.com.Script.SNH-gen.21168.29001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ec35da-55f0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751315081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315081, "uuid": "a4430eef-069e-42f5-bf6b-fdef7540d065", "comment": "Malware payload (Mirai)", "value": "0bda7c93798709a567a5def9505e99a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315081, "uuid": "315666ac-9cd8-49ae-bc10-5252aac689cc", "comment": "Malware payload (Mirai)", "value": "8134de3aca617fdc2c47467ff00acb49b1eea271487544d59773364287b48629", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315081, "uuid": "b3903099-94f3-46bb-82b2-3421d47e2a1a", "comment": "Malware payload (Mirai)", "value": "bdee70e4bcf59e2984fcd433d7cecde845e4248e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315081, "uuid": "455eb0f9-b34a-4e33-a97f-7f90379368a3", "comment": "Malware payload (Mirai)", "value": "f353d3c03cde0370b8fb53eae5126a3f604c0532369665a944fc0dadf618232e0036708bc50162a21af67a0bc9598735", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315081, "uuid": "b21702a6-4def-4b98-8519-a71ea90abfdd", "value": "T1C2F33B46EB408A13C4D62779BA9F424633239B54D3EB33069928BFF43F8679E0E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315081, "uuid": "88222bbf-3e17-459b-a132-3de776655297", "value": "3072:Clv5OJN3IaQuP0SiRtKEah4neuZRjAlNM/947mQw3ZEA:Clh6VIaQuP0SijKEaZoRjALM/9CmQw3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751315081, "uuid": "54831ad8-6cf5-4275-853d-d15e3a7d969b", "value": 163253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751315081, "uuid": "4ac689f0-b4e2-4e3f-81c5-cd463a0557e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315081, "uuid": "190e780f-de9d-4766-995b-036a93c5c795", "value": "SecuriteInfo.com.Linux.Siggen.9999.6959.11115", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd917f5-55cf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751300873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300873, "uuid": "4c6bf926-b598-4eb9-a360-bf75a6eac76b", "comment": "Malware payload (Mirai)", "value": "5296b9c567065520c92ea8f55d35d5c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300873, "uuid": "183d2850-1574-4f53-b127-f49f4b808ab4", "comment": "Malware payload (Mirai)", "value": "81547cdd29c2aba5e9ea0c77ce6d6f5cc1673f979f6d1b470eeacb587339ca82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300873, "uuid": "e37c305c-19b9-4c33-a648-36120736268f", "comment": "Malware payload (Mirai)", "value": "c801e3cb37a36115ac3e29e9899def2dc4056b3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300873, "uuid": "7ee383ce-8623-4c06-8237-dccfdc311752", "comment": "Malware payload (Mirai)", "value": "d283565da44decf31a282b2bd983b84ae0b28f0836591aeffe5573ec46782871d22532717609b5d38c85544f483d4e5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300873, "uuid": "3dde2aca-8dac-432c-913e-fe11a8c568a3", "value": "T12A833B45FC919A22C6C5527BFB6E028E371623A8E2EE3207DD25AF2133C751B0D7B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300873, "uuid": "d735d7dc-9a4d-4867-a526-e0646a5c83fe", "value": "1536:Xj39JUKgl+ObXKIyRc7MO4yC3FrQU7RXQzZryBNvG:Xj39JdODQaX4X3FBhiqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751300873, "uuid": "2854ea07-a3d2-415a-b4aa-69b0d2704078", "value": 87624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751300873, "uuid": "3fd91b29-75fa-40a2-a66e-380abea87bf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300873, "uuid": "2812263a-0e39-4706-a452-6b103cf8a5f7", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ceaee6f-5570-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751260126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260126, "uuid": "54d2d558-607a-4ec3-8205-8297dac75e2a", "comment": "Malware payload", "value": "8928fa1bb991b8aee64f3d58cc6cdc68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260126, "uuid": "6cd89ce0-cc6e-41fa-8893-c6031760bdc6", "comment": "Malware payload", "value": "820253b8c28ee28a0c85acf45521a49befef9749692713632b5e2d585679407e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260126, "uuid": "8434684a-e0a0-4fac-96ee-53ab2c920c6a", "comment": "Malware payload", "value": "91c20e8feef69ffa5768642f59c0155ff3393faf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260126, "uuid": "9adadba7-534d-4019-a779-a8a2391262e2", "comment": "Malware payload", "value": "2e2ea2cca7567d60b49f733a7ea06f08750ad527ab600031d0b4361302d5bfbea2b23dc00efba17021a91b17673acf3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751260126, "uuid": "162a3eb7-3426-4423-af73-0391849e04ce", "value": "T1C8A40294E9819B62C2C801BFFF0F45BC77A31F69E1EA71068D16EB1662D745A4F7E400", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751260126, "uuid": "aa8222ef-3a66-44fe-aa9e-0ade202a2c12", "value": "12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751260126, "uuid": "87d26807-f5f0-498e-85a3-8e5c3f10d854", "value": 480792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751260126, "uuid": "387026ea-ed38-4af8-8698-401a7a558203", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751260126, "uuid": "32568466-fccc-4e02-9f66-70be6b06890e", "value": "arm926t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e4f965-55ce-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751300626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300626, "uuid": "9e96d7bb-b081-4664-bcf3-bd858c216657", "comment": "Malware payload", "value": "f19dc915240e9a3c9d7fe3c841205cec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300626, "uuid": "8600d4c3-1349-4533-b4a7-996d585fb897", "comment": "Malware payload", "value": "821d8982df198db855f7aba70508bef3cb5d4cd062ba022747bee5afda6e1eec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300626, "uuid": "531fa841-5d7c-4b17-948d-9c6a13f45c1d", "comment": "Malware payload", "value": "e1672ecea03cae94d5d6cc5deeca738bc140b037", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300626, "uuid": "4ce5dbf1-6d51-4227-a60b-480f19e45f58", "comment": "Malware payload", "value": "7ef446987f2f3d93d3e35aca34edc01a6868c51770726f38a945df88bd29ba4c5ae033ea61891587db4ca49d81f8afc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300626, "uuid": "be71bfa1-fb93-4377-9724-48fa72040f5a", "value": "T18DB401CE9520D295C4B02D33C57BB2F282AB6D3609596E1CDDD8FF6B2CB67450638B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300626, "uuid": "00fd8d81-f3e0-43fd-a5ef-6853e08c0ecc", "value": "12288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751300626, "uuid": "8d0b39e4-ef29-41db-b231-b521180ed163", "value": 502120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751300626, "uuid": "1de1829e-1bab-45ba-8c4e-1997b6d38cb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300626, "uuid": "3e76eac3-e31f-41b6-af7f-7ad4e0d8af79", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e729c7c3-559e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751280141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280141, "uuid": "cfad5083-8128-4f4c-911f-aced5bedb25c", "comment": "Malware payload", "value": "2901397d26e4b023761e34575154717f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280141, "uuid": "5ed63153-bd89-4567-b271-8d185d75bfc1", "comment": "Malware payload", "value": "827a6ad9d4738dc2baf1d93588be02c82b06f1d4c3575f6f0aec5c5f2be3ec76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280141, "uuid": "169031d4-58bc-4393-8355-030cbb8f8e92", "comment": "Malware payload", "value": "aa273a64b8122e54c3887b671d0ebe511d799224", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280141, "uuid": "f7dd5a17-f212-4b3c-91dd-99258f4a42ef", "comment": "Malware payload", "value": "2ab27e30ee3a7ca685e8fa4ab9c8ff7222cd691faa3e174ffa0207c8db24f7a5ede772d0bf8c781c4719a95c6971b16a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280141, "uuid": "46e68b48-7a82-4449-95b9-3428dbc44afc", "value": "T108E412017F152032C9D21AF0A8B747B4EB914CD650B4D6777749EB222BF36362C8BB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280141, "uuid": "586d136c-2dc6-4b0c-80dd-edb02cc2124d", "value": "12288:XeBWVNQiXY8aap1qXG2YmzwcyxDKsFM+t9j+9+X:uQQAYLapnLmzwhtLy+t9j+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751280141, "uuid": "74950134-cbdc-4a1d-be26-75487894618d", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751280141, "uuid": "22440067-9272-475c-89e5-321ddc0acb45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280141, "uuid": "61743948-8682-4e31-ab3e-be0299b63279", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b797c5-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751291232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291232, "uuid": "8d164d9b-1c91-484c-aa11-e66c262d0433", "comment": "Malware payload (Mirai)", "value": "b2bcd16bb060398114d9e9179f4919a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291232, "uuid": "4bc763e0-ab6f-4aeb-870c-6925dbffbf56", "comment": "Malware payload (Mirai)", "value": "8299a8a4a2131fca0d95427b9250b03555f99dcaa516bd02439cc51ed035cf88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291232, "uuid": "99dac4f5-aa63-4540-af48-be2c11ce2870", "comment": "Malware payload (Mirai)", "value": "8076ae48d5b3e1f5d7c1bb9e1f881d48f8713fab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291232, "uuid": "16eea318-989f-4f8a-a8b1-6db40924e98e", "comment": "Malware payload (Mirai)", "value": "b199bf4916cd09833739be81424e13302864564922b4468be0023b848257fdc30a3e3f1235d99992831f094e9b5d5a89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291232, "uuid": "00b74d5f-1235-43c1-aae6-1d56bb5261ee", "value": "T1BA336CC5A683DDF5EC1106712176FB36AAB3E53E1078E987C399D833E802A02E50739D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291232, "uuid": "a48a15e5-88fd-42a0-af24-1fb29e0f762d", "value": "768:06p7o0G4guKbN6H7G/TvrvCLzAYEejvB4y0yz+EemdiX0Kx2HKE:0mnGVugN6H7GrvrvC3Eejpp+xmMXfx2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291232, "uuid": "2590ff11-d5f4-4719-8eea-8140e1b7fddf", "value": 50788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291232, "uuid": "1a304a3f-46ec-4309-8f66-ba9c0e137cf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291232, "uuid": "f07829f4-bdd4-49d8-a824-ca01940c5911", "value": "miraint.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d860188c-55cd-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751300303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300303, "uuid": "220966d0-9b72-4893-a159-28741d4608f3", "comment": "Malware payload (Mirai)", "value": "0a079468c30944b920fc22164142094b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300303, "uuid": "a89862fa-2ce9-4e2e-ab69-92dfecf0ee7f", "comment": "Malware payload (Mirai)", "value": "82b34486b9369ad4c1bfdb9e0a7b60e0e0e96ce7c44145d26d1291a13f145d44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300303, "uuid": "ed326775-02c1-47da-a635-c53816c6cfbe", "comment": "Malware payload (Mirai)", "value": "189c9c0656b6e7f4566350f9854498d0296afcad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300303, "uuid": "b84bff61-c874-4e25-afef-8a05734cba6c", "comment": "Malware payload (Mirai)", "value": "ccab3dbf342707d765c7f7abe78d9b67dabf6cb45ad33028d1e5300b23bb31c1da93b21ee1e13333b188b58e5723700d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300303, "uuid": "2b684afc-279c-4593-b68a-78966bbbda4f", "value": "T191933B46FD828B21D9D512BEFE1E118E33131778E2DE72229D18AF2073CA56B0E7B455", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300303, "uuid": "fd131854-ce3c-4fd8-a27d-b294e5e50107", "value": "1536:e4nLOeUN4145z+xLjDtxbSXuKImnawaN9/5CeDHRi9Fale/c7Svs5wYs:F72i/baZImnawjFale/cKsSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751300303, "uuid": "b7c175ed-2b8f-4c0e-9399-60b56a23fc73", "value": 95812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751300303, "uuid": "fd4bf171-7443-496d-ae72-2b10273e02b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300303, "uuid": "ec320d27-0e74-447c-ad44-e652ad8756ee", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e7f0df-5599-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751277938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277938, "uuid": "8fbb816d-b50e-4ed0-9041-f0f73d71b477", "comment": "Malware payload", "value": "be64a61b3e16ef4ffa669d5455a76ea6", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hooker", "colour": "#B2B707", "exportable": true, "hide_tag": false }, { "name": "Zorex", "colour": "#CD2DC1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277938, "uuid": "f456d045-a520-4096-9be2-5b1005e4e580", "comment": "Malware payload", "value": "837f0c9d7069281230ed067d68e2a79db3323659d4ec7bf7ed7b47ce5e3e2ee7", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hooker", "colour": "#B2B707", "exportable": true, "hide_tag": false }, { "name": "Zorex", "colour": "#CD2DC1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277938, "uuid": "37a717fd-40b0-4c2f-8e0d-68b4ddc58d69", "comment": "Malware payload", "value": "e07f44ed0a137ae6787784686b2f418ea7e4e957", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hooker", "colour": "#B2B707", "exportable": true, "hide_tag": false }, { "name": "Zorex", "colour": "#CD2DC1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277938, "uuid": "1edbc7a1-3dba-43af-8d06-19afef2810ea", "comment": "Malware payload", "value": "f359ac10ac76e80baf0b29ec98c178a880b5dcdb3b66fe5114999aa3cbb1cf837e3727f0373d606a2d24da47153fe9e0", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hooker", "colour": "#B2B707", "exportable": true, "hide_tag": false }, { "name": "Zorex", "colour": "#CD2DC1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277938, "uuid": "66f5ce77-b527-4b7c-97d2-0ccad22110d7", "value": "T113827D47F662ACB2D040D5BD9D6A522CE7BB31373D4D18458EAE9CCDCD9B291063C38A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277938, "uuid": "b0bbfb23-81e2-4d11-a610-1508163fc4ad", "value": "5fe98f942e304a12255fe7ce1e113298", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277938, "uuid": "2468048a-d53d-42b8-96b9-a21173356503", "value": "192:n+s61A/0LiwxqfKD6Vk/gqWhiQ7ST92s2APu4Tk8QjcW5tPxqVZW/OuK9OK:lx0iwxqsRQmT92sPuR8Azr5qPW2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751277938, "uuid": "086a631d-ee85-4e37-a63b-0026f159e028", "value": 18251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751277938, "uuid": "bd2b116d-060a-40c1-a354-4844c9d048a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277938, "uuid": "82cf5f56-e6ee-4b8c-952a-20afae919473", "value": "dll_extracted.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c36e730-559e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751280016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280016, "uuid": "25bc5e33-de9d-465a-acf1-dfb94d283187", "comment": "Malware payload (Mirai)", "value": "9992f8b3412e8f553550ff94d20b3283", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280016, "uuid": "6e2b32cd-c1d3-46e1-a097-50da70f1e570", "comment": "Malware payload (Mirai)", "value": "83d6be2c21b1875029e42430450f9ae32392cfeb57dd5c8e2c7196a822c220b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280016, "uuid": "903d6832-8e98-4a2d-8c95-4ecf3dc35785", "comment": "Malware payload (Mirai)", "value": "53db9f7bcc72dce56220b1242280e239037b4ef9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280016, "uuid": "30f90ffe-b4e6-4f25-98ef-73c350746016", "comment": "Malware payload (Mirai)", "value": "479bd8ec8823b6b6905452315a60df9afb45c6cee26457d427b94824d132c03a14309e113cae91b512b2ec81da5a070c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280016, "uuid": "f0873cac-5931-483f-8419-23bd349aac64", "value": "T19CD31956E7418B13C0D71776B6DF424633239BA493DB73069928BBF43F827AE4E22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280016, "uuid": "bbeeda32-4fec-47c0-a35e-67ca099c3aa2", "value": "3072:+mvTe9bdnM3aaujXNteV4uXhEqR7QnWb6M/93Pdh6:lvOJM3aaujXNtC4ufR7QnW2M/91h6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751280016, "uuid": "2bff1965-8e7d-4dbe-aed9-d5c2d220d9d8", "value": 134958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751280016, "uuid": "2d9c1101-efed-43b7-9b6b-4008ac4a6c0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280016, "uuid": "7a38a319-8627-4ad6-a64f-a2244be63825", "value": "cutearm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a99bffb5-5609-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751325994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751325994, "uuid": "56a626bd-6a67-4be6-8105-de130f0450d0", "comment": "Malware payload (Mirai)", "value": "38b1acedb267346e686de406fa5695a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751325994, "uuid": "e1ecb806-e989-4eb1-8b80-0c35e83c510c", "comment": "Malware payload (Mirai)", "value": "84b1c143d97233f0ce32804662e450c8e73447cd3b12da8544fc6e5beb16117d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751325994, "uuid": "da2787b7-cf6d-49dc-83f6-7644d2052e5c", "comment": "Malware payload (Mirai)", "value": "bc82df36cb74c382811c4d5bbebdf8221713ef88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751325994, "uuid": "9c371064-34a5-4fdd-ae1f-e61fcc5efb06", "comment": "Malware payload (Mirai)", "value": "1800e16e51b76da082c5b862c4c4a4af0602b83b1aa2f0454fce954b0467ceb5f4b7bd345b0bf60abd6a922ff5dad967", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751325994, "uuid": "21d630d4-7ba8-4afa-9a79-7fb7f4db5d82", "value": "T167330885B8C1CA16C6D463BBFA2E418D372563E8E1DF32039D216F11778A82F0EA7655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751325994, "uuid": "894acb7f-5a5c-459d-9ea3-3bf76bca1a82", "value": "768:pJFwMZ45XLU0zRxRYMv7N+7RbkHBXpmo+DdScePut5n/NP3B1XlfzR:lwi4VRYIY7RA1p6dScuut5nBB/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751325994, "uuid": "c114ded0-4797-448c-aad4-67496ce631bc", "value": 52692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751325994, "uuid": "50698049-9e1c-4bb1-bdfd-60a4d1f16ead", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751325994, "uuid": "2497d4ab-d6c1-452b-99b0-24b3c96b5f82", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af70f3d2-55d0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751301523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301523, "uuid": "eb8f5c62-fed0-498d-b03f-4896982bddcd", "comment": "Malware payload", "value": "cea5b01288598cbb5752c74078dc3bf2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301523, "uuid": "9d9da976-f334-4c12-b9b9-75443b6ef6b2", "comment": "Malware payload", "value": "856e9cb5636752694313199f4c80a7a0577a50420e2bd7b3f6ee2252ab08345e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301523, "uuid": "b4fc85b2-397c-464a-835a-9560bd53c071", "comment": "Malware payload", "value": "e4031872fc82f48a4692ff9c9d42bc32cacd74c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301523, "uuid": "ea98e796-3c04-404a-9124-2febaa784a83", "comment": "Malware payload", "value": "06672e797b48142a5994c8eebe3669c8b483ec5442ce3e770f06efac23f31f0992017c3856316fc33c82b6487c2751f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301523, "uuid": "4ef25e81-5ce3-4852-8100-8060cacc004c", "value": "T1970302E1DE547DC5E47FAE70214445C3F359878FF65BAC4A710A1A03A7BACB0F4AA890", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301523, "uuid": "bac64a89-64a0-4e46-b5ad-977a7e672c26", "value": "768:GFjL80E7mJLa/2opH784koe8NyoeHNfIay044uVcqgw09cI:B0E7cmLyr8Nyo6l944u+qgw09f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751301523, "uuid": "2cdd25ed-c274-4ab2-b592-af9a11dabbeb", "value": 39056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751301523, "uuid": "882cace6-b29f-4b01-877e-a9a12c46aa5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301523, "uuid": "2d86d868-866d-4e62-82ca-d0f85e3f48ec", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f79bcac-55d1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751301711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301711, "uuid": "09a689b1-968b-429e-8005-0d3cb46d9ded", "comment": "Malware payload (Mirai)", "value": "c028fdae18c1e2e91b0ba501e60c0ac6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301711, "uuid": "30c0300c-dc02-4257-be40-df3b7809aa75", "comment": "Malware payload (Mirai)", "value": "858ac66c2df8bc22074efffe1e278e4af1f8a50421aa6b3549cb8fb58479d53e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301711, "uuid": "646671ff-87df-48a8-947d-9201f9167bdd", "comment": "Malware payload (Mirai)", "value": "f025732a124d5666c1c4dc560ea0bb6d9b978f8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301711, "uuid": "03cd1c17-ca20-43bc-8358-9bc9cecac93c", "comment": "Malware payload (Mirai)", "value": "725252ed22772d8dedc313b5062660e71bd4910ea8bd9db16287bec1f9230c93af2745cb222c19d52f99adca16c3d199", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301711, "uuid": "06444deb-f493-4743-a0ca-19e9e37723d9", "value": "T16C836C21F9791A3BC4E4947722F34336F1F6478A24ACCA0E7D710E8DAF25650364B6B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301711, "uuid": "3648f39a-6648-437d-b96b-cc47d11fee76", "value": "1536:mvfkvLW+9caoPrXIHuWkyujd9qtCEuNs5iW/0FdbtAQtyyV:xaqHglE4dNci4JQtyyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751301711, "uuid": "7daf1992-8235-4527-954a-1838c1d06b18", "value": 88456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751301711, "uuid": "546b5789-8129-41f1-b5dc-c33da28954da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301711, "uuid": "539a0ef6-fc26-4d5b-85a6-098a6120dc96", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1c2db9-560c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751327391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751327391, "uuid": "2467e1e9-4ebe-4542-b63b-6845e78d28ce", "comment": "Malware payload", "value": "0920b9c39d7ff9c2768c25ba15bbd036", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751327391, "uuid": "7336f08a-f2d3-4834-a4ad-51858f1dc38e", "comment": "Malware payload", "value": "859ebe4dd412bb60cad8bcb0b16ac53568c16b33b12cb7d5fba3ac098f1b276a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751327391, "uuid": "7543903a-8c51-46f5-a200-bfdac326c7f8", "comment": "Malware payload", "value": "65b4bc0a1ebebd95ad48002aaf11116ae2040781", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751327391, "uuid": "e055d8f1-4a10-4d82-8ab0-9e6d3e87dc73", "comment": "Malware payload", "value": "aec0c46c00f911373ad21f0d0a82f80fd61baa69be24928e1c983e94a6e61b4dff695407a8bc17bdfe6f40bcf085de41", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751327391, "uuid": "c791ce6c-ac50-4ded-9ee2-c2bd6a112ea3", "value": "T18FE2E0D7B5C8C490C3A2482A579CA5402F3A7CA43DB1664B57FD1746634AE3DCEA0CEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751327391, "uuid": "108ab53c-767d-4311-ae30-3c385d50264f", "value": "768:zYQkWEiXbYhgZ4IK8fxa0G+MWYNqLNYZX9xVMSJ5ez7:lj5XbVZYkzaX9xVHez7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751327391, "uuid": "5c95339d-39bd-409a-ba83-458f30c90f70", "value": 33602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751327391, "uuid": "15eec32d-3eac-4814-9da5-9c46409fffb6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751327391, "uuid": "7031e476-1758-4511-8dfc-48bb831441ee", "value": "38br93gdnh.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a17ad920-558e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751273153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273153, "uuid": "5ba4c0e3-4fe5-4a58-8e05-b94a41b16273", "comment": "Malware payload", "value": "bd8741e74ced9a0886d3235408685f8e", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273153, "uuid": "09bc7b3c-9ed0-4bea-b203-b9c05f0e19f6", "comment": "Malware payload", "value": "860c5d4f86ac6e01ed4c40380271eff151c91b0b4d18a526a7d41bcc0dc4f04a", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273153, "uuid": "bace843a-e558-417c-a3ac-ccf0523d02a8", "comment": "Malware payload", "value": "5e80f445f3330d5efc6f9683ac0404a4fb834025", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273153, "uuid": "7c033642-087c-4b5c-b5d4-ab7031e11fae", "comment": "Malware payload", "value": "3c04dd772b764bc2ccf8f3e00f2c286ca8e156812ee3156a5d5ef393b35684acf21cd498a45d1ea5c150b2a577400149", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273153, "uuid": "9fcaa9ec-67cc-48ac-9938-856cff7117ac", "value": "T19AC623216F906C9A471DD73A712BBEFEDA502ECB458845DFF300B892D0CA732D666931", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273153, "uuid": "9b13c275-af6e-442b-bb13-f33f522ef26c", "value": "49152:EaRQJ4wTYEjaHclDligMxC5Tx+/1jF1voEjtMlMJuG8jUgMCW0bI/PbpoNxJvft0:vR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751273153, "uuid": "83a9cee7-81dd-454e-8c44-8bcdea1919d7", "value": 12049598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751273153, "uuid": "68a8aea8-719b-455d-b8b6-ef41aa6c5af5", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273153, "uuid": "2eb646da-38a1-40dd-b66c-072842dc0094", "value": "yzXT0U.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4032c4-55df-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751307854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307854, "uuid": "9ad63dd3-3a54-4a1d-8a7f-c250309c3188", "comment": "Malware payload", "value": "360e4230c36d7effc8831a4432fcedcc", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307854, "uuid": "6e2af4f1-2c66-4c69-9f25-ec1598561c01", "comment": "Malware payload", "value": "872144436643ddba621a34f5953ab6e1a405937c1c844626d890790cb144bc9d", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307854, "uuid": "a676bc24-668a-4b3f-8577-dc636fab2e76", "comment": "Malware payload", "value": "ec0535ff590f3c978ab77e564a2666577375edbb", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307854, "uuid": "9e5a80e3-d294-4843-b88f-1c99bf674332", "comment": "Malware payload", "value": "784745740da2f50df4269ad6c308aa79924b9cd6afcba31b2fdc7954de9375eef6ee3d289e4165fba5888c063a868a54", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307854, "uuid": "7fc88be2-b28c-48a5-a13d-9685a53a7420", "value": "T17716232ADACEF027E97FF336D134DE478819006D5508F62E3A62D54C49EFE809746B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307854, "uuid": "ae7872f0-63fc-4363-8701-1453b24bf632", "value": "98304:Fyrxf92fSop2X1OeRt1gewc4tfzdxyMnulJS4679L+p+:IxgKop2XvHgegzjyFlT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751307854, "uuid": "f452df73-46d1-4736-8b9e-4cce2c406ab4", "value": 4087076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751307854, "uuid": "398d6153-71d0-49c3-9da8-bcd46275511d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307854, "uuid": "2cddad32-a5af-4886-9a7d-a6ee7cc18417", "value": "1 (1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244e8f4d-558b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751271654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271654, "uuid": "a2cbef06-b68b-483b-8b9b-b6e6124e6be9", "comment": "Malware payload (Mirai)", "value": "a057503a028cce5e6e6afb4312e64d7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271654, "uuid": "2641939e-d4f5-42d1-aa5b-5dcc0e13b0fd", "comment": "Malware payload (Mirai)", "value": "87312616b27d12f563434ec0479cff90e0f46abf820fbf75edf5cc29b648efcf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271654, "uuid": "67adc7ae-ef77-4fb4-b798-a06e27091d87", "comment": "Malware payload (Mirai)", "value": "a16fb413d1eb08c54f7f09053a57c3707ccb8ba6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271654, "uuid": "fc4ef4fb-cee6-4963-b835-8ea55ca649ef", "comment": "Malware payload (Mirai)", "value": "a99b8c222958c8f4687a79d6b28cb33c94fdd646321859fd4c6868df87cccd0aeb01ea08824994bab9e02a93c1962450", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271654, "uuid": "e418bc47-9837-4741-a1c9-08240a95d1a3", "value": "T154E3D71A9F510FBBDCAFDE3702A90A4239CCA51722A43B763674D528F54F50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271654, "uuid": "27ebf61f-4606-4e79-a498-673bc6785fc5", "value": "1536:qHtK+LnZV6WOpFslqW9Sbn0JUtnMEwNLCXlERWGB9EL9uM5WVaU4IbhTiV8s2Lqn:Kt6pKa2VVfzKWVaOhTcLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751271654, "uuid": "dd3d6884-2ad5-404f-8475-283456f389e9", "value": 156788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751271654, "uuid": "02acba20-a74a-4abc-b32e-5a4293609508", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271654, "uuid": "7006bfd3-bee1-4189-bd0e-c64cde29dcb6", "value": "cutempsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "717f57ed-5591-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751274361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751274361, "uuid": "ae31b2bf-fc7d-427e-b892-9967c11c0b63", "comment": "Malware payload", "value": "6a24f6306186b043f3914d8091065a70", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "TMCS", "colour": "#060ED3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751274361, "uuid": "fe51dcfc-d7b9-4af0-8dfc-de6fc52adf64", "comment": "Malware payload", "value": "87c707ba2bb4529811a4ecf125f069bf7bd64e27da8fc5c512524cdd40656419", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "TMCS", "colour": "#060ED3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751274361, "uuid": "a831ea39-1703-4e44-9a96-30b4275e4e10", "comment": "Malware payload", "value": "cb81d2f3288cdaabbdba3aad7df4fc8c209c002c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "TMCS", "colour": "#060ED3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751274361, "uuid": "9a6c43dc-2551-4d8f-bbea-83a1ecbbbcc4", "comment": "Malware payload", "value": "e7671a14a11865b0b521ff739f9a675e4e2ef097aa2418bedf83d053b37d0f0df5257d0c140a9b050cce7c4df0115694", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "TMCS", "colour": "#060ED3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751274361, "uuid": "bcc1418f-94ec-4a38-8ac2-bec7e7196183", "value": "T1C4C533BEC1B1143AC38B98B0D8C066657121DEB6C99F9B5A506FD7238D058E0FA63F47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751274361, "uuid": "9ec5e6fe-c270-4807-9c4d-89b7c2205a34", "value": "49152:j24K6YsJahiK31Ra/OTqMzTNMDX7EkVcEUe53F7sH8A0n2FgBpilhLKWCEWr:XYs4iKbp3UAAdUwwcZ2FgBpijWWFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751274361, "uuid": "f0115731-0d84-4731-a124-0b3cae734d52", "value": 2576784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751274361, "uuid": "e42a5390-89bd-4b08-8c56-6d23ed18c649", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751274361, "uuid": "7d89dd22-fc6b-4c35-b4a2-19c30f280282", "value": "apk.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5371b01-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751291225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291225, "uuid": "c3a0bba4-187c-4907-a500-e5eefee3e095", "comment": "Malware payload (Mirai)", "value": "775240f4a192510a84169ef8e83e46ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291225, "uuid": "4eeddb39-ed8d-41bf-a8b9-a6861e761f9d", "comment": "Malware payload (Mirai)", "value": "87ccbb26b4d833d6929aa6bfd9ff878968bc9d37cc840ebdfb185130bc7b068b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291225, "uuid": "1803b17e-9e0b-42df-a387-7f5a1d63596d", "comment": "Malware payload (Mirai)", "value": "58c09996d0b0c80416cf54d89e98269d9e273e3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291225, "uuid": "ba98f92a-7539-4fd0-8d78-2558dad784c2", "comment": "Malware payload (Mirai)", "value": "17afc6995315306ca1494da6f58fded3cee0464f9bbbdb80544af2bb4d79e2c63ac53c3413612d976a7095281b15add5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291225, "uuid": "d270a88d-971e-4caf-a3b0-5a706878d129", "value": "T140431885BC829A13CAD423B6FA6E518D372623A8D1EE3217DD116F1177CAC2F0D7B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291225, "uuid": "2127f4ac-1e4a-41d9-bdb2-cbb832ffcfc9", "value": "768:6IiVX9UzFw84Tu25KCT4TasKeAt2SI4F/loX89cx05NQi/5fIJ+JEI:RiVXuzFwLT+aHB2SlNE+hu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291225, "uuid": "8d92ede9-3bf0-4fa0-b547-0013ab31966a", "value": 55204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291225, "uuid": "5b1f83f9-a77e-43b4-9f13-6640c8ae8ef5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291225, "uuid": "b1612c50-7305-4de9-85b3-f423c1a935ad", "value": "miraint.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f10999a9-558e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1751273286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273286, "uuid": "cac0307b-809c-4938-87ca-26728fd438db", "comment": "Malware payload (AsyncRAT)", "value": "61792dfa753b584b0b7f8b0fd22076ab", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273286, "uuid": "f5dc391d-5377-44bd-ac23-9e97e8780369", "comment": "Malware payload (AsyncRAT)", "value": "88170c9fa79e032ba011d0c8b8106e480bcb37985833a84cfe4263c778e421b6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273286, "uuid": "b594836e-555a-4413-adbc-d8a8c2dfcc85", "comment": "Malware payload (AsyncRAT)", "value": "db230d045a7eb7f09cb5df8ce00dd54c2be1e520", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273286, "uuid": "9efe3439-c58d-450c-a751-8f0978db3e92", "comment": "Malware payload (AsyncRAT)", "value": "ebf7c06346a1d159b521c012b77d5ec3804fd7349e5aca75e35b5208fd8a2612036f6711e2680d7ca90bb1e66c37661a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273286, "uuid": "1fa455bc-5db1-4b8b-a51d-d19346e95bdf", "value": "T186B402017A2ADD13C4AB06F81C61C2B483BD4DDDA911E7C75FD6AEEB70E1B521A82743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273286, "uuid": "a9f65caa-c668-420a-80a6-a1baa5189fea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273286, "uuid": "99cf18bb-4d19-47b4-92b4-65b530aa7708", "value": "12288:G5/RoLD653sF5OuC/ZePmTXWz96I9UhVizLDDjbnFA:mRoLOBu2ZePmg4I9U+zLDDjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751273286, "uuid": "cc59519e-d531-4de4-a87c-af42a6145845", "value": 500736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751273286, "uuid": "d20abe48-c928-49f0-9797-79a64514de4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273286, "uuid": "1b22b0a0-3cbd-4521-8ef2-7cb8c943276a", "value": "INV087656789009.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d47d9207-5606-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751324778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324778, "uuid": "41ee7807-7af6-47e0-8d3b-be07fc4d2911", "comment": "Malware payload (Mirai)", "value": "4d49eaa684e6bd690a88bb344f151bf7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324778, "uuid": "54dd1a59-9ec4-4640-9e78-d3ecac2db65a", "comment": "Malware payload (Mirai)", "value": "88889cb256e140c93e82e49ee80db5df0765d44e47bcb62da7e375d07f711378", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324778, "uuid": "5e5cf610-7910-4eac-a0dd-e8199b609928", "comment": "Malware payload (Mirai)", "value": "aa6db05ef0f283029c2779383fec90515b41c809", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324778, "uuid": "ef84a0c6-4fd6-47ca-93a0-ec246bd534c7", "comment": "Malware payload (Mirai)", "value": "b3343948d8a667b1516a4ab39ec21082b675ba45e0cc9e47240f3762352b324b839e1364b1752537cb9e103d2353c601", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324778, "uuid": "b45d4c3b-cc20-4776-b046-f0c8b9f91983", "value": "T18883294AFD819B21D5D512BEFA1E118E33131778E3DE72229D18AF2173CA52B0E7B815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324778, "uuid": "29ce1256-5482-46c3-92c6-0ee649fbdbee", "value": "1536:YD4n4543Jbm5A6UDNmPuONJ+cS9mmaAX4d/XGDFiHsYuW5NYh:YP5csPR2D9mmaAEsYuWPS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751324778, "uuid": "94e2ebdb-5f47-403d-b9cb-be46eae77776", "value": 87620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751324778, "uuid": "b46bc580-8a7f-422a-8aea-90a87da36635", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324778, "uuid": "8716508b-6c92-4ffd-b407-fd1ea0efb07f", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f9ade1-5571-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751260487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260487, "uuid": "c4ecdc3b-7dc9-438e-af10-14fb8dac1648", "comment": "Malware payload (Mirai)", "value": "ad85cb1f029cfecaf4adf61d60c811c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260487, "uuid": "aa095756-6f5a-44fa-9899-1aa9d847c722", "comment": "Malware payload (Mirai)", "value": "88b3f8cd3d7d1c3e40094abd3faa05b74dfab30cf8d547876d7871aa408ca99a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260487, "uuid": "1534b57c-e27d-4d1e-81be-d7537a416a56", "comment": "Malware payload (Mirai)", "value": "e60bf8c0102f9b7e43ad0449a45354d23a56cc9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260487, "uuid": "37a803c2-1eba-404c-91b9-46017a22b29d", "comment": "Malware payload (Mirai)", "value": "fe5ee68114a521532bc3bd23e817757f2a4ef28dce44d108fbcce717dd749da954bd85453da4ff64b8a3ab108814f21a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751260487, "uuid": "30925177-8ce9-408c-91bf-8388c5579ca0", "value": "T19FA3F96AF9C19912C6D22677FA1E938D7B271368D3EF72074E255F20279792B0E7B010", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751260487, "uuid": "446cada4-bd00-430c-a956-1893466ada80", "value": "3072:88oRqwxjxSKl6lyxl/Gl4lql7BlUlelSFlXlel4lglUlKlBclmTl0l9l7loNlflk:88oRqwx9Z8Ux9GSQ5BuM0FREmG2YPcMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751260487, "uuid": "0441cebd-6ed2-4000-bca4-ff05b1d55493", "value": 101440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751260487, "uuid": "74bc01fd-3ab2-4ba9-b140-f97d623b312d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751260487, "uuid": "ac3793e7-efe5-4d43-85f9-89a927ba8657", "value": "rondo.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7007c027-55e8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751311724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751311724, "uuid": "19a3e8f3-7e62-493c-8d08-f541a869746a", "comment": "Malware payload", "value": "9cc9b946ab5f330d7c80b538b06ffc23", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751311724, "uuid": "17d68803-1ad6-4d4f-b8b7-10d4d5c717bd", "comment": "Malware payload", "value": "899e510fa49b262220af000cbb6f2544dbce7abed05b4197954acfb530ab1c01", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751311724, "uuid": "edf89b28-bb50-48dc-bfff-bc63bc6614b0", "comment": "Malware payload", "value": "ab437be46b3e51cc3803e6c32accab4a8869c8db", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751311724, "uuid": "db0f103e-39b1-4f9d-bb08-cf91bc28d9a5", "comment": "Malware payload", "value": "2e29630603f8211d9d0e89db514050eee33210f316c3f91a79470ad3fdf0f3631e9a204c7436c0820d34cf6ef705b51e", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751311724, "uuid": "9e103eb8-115c-4119-b53a-d3f283b74e01", "value": "T1EFD633FC6CE4A28DE125AA36C7B640F57A741EE9275CF1617C2783B0AFC875006A056F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751311724, "uuid": "46fc2ce7-eab7-4da1-997d-d7d44e01772f", "value": "393216:FmYvmeBTG6F+ffr69r1mkMU3WLDmY0ENeAPOo:DIUhMU3AX84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751311724, "uuid": "b32e7351-1166-487f-8986-963b5b1abcec", "value": 13349617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751311724, "uuid": "0b95ac26-a401-4541-bb5b-e92d26078688", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751311724, "uuid": "345bd6ff-dd75-4e23-93da-3d2f6e4966b2", "value": "ICICI.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250bac46-558b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751271655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271655, "uuid": "4c128c3d-d17e-4808-b6a5-a62bf6abbfc2", "comment": "Malware payload (Mirai)", "value": "81bac2bcdf98b4eb770e44fe52173385", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271655, "uuid": "902e4f42-4377-49a9-9b65-997730e61326", "comment": "Malware payload (Mirai)", "value": "8a3fdaf4a2ac23ea0c5e4985dbc7a8b054c647e462669505ed3cb2b053623028", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271655, "uuid": "31f02fed-2ff2-4e63-94d0-e2c3626b7b32", "comment": "Malware payload (Mirai)", "value": "3d508b02ad77d3b0bc84e3742e792fe8a8797ae1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271655, "uuid": "5c89398e-93d0-4611-bcb7-398c68ec0e07", "comment": "Malware payload (Mirai)", "value": "1f54299ffe515de14e1719f342781ceee1c6977e183946704e565a8bdfcfcdf06f5c2825708b9b7382fdfd75477d32e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271655, "uuid": "831df283-59a8-4c78-b87d-fe4775539364", "value": "T19DB31A45FC509B13C5C651B7FB4E438D7B2A17A8D2EE320399256F60379B86B0E3B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271655, "uuid": "bd960eb4-9d6c-4654-a03b-6a4b1bddbc5b", "value": "1536:GfGBRaraXFzqo9Qa4M2YPjbJ4VFZdTmycS61CqxkLSvOphXpl/bwywuVvSkLjYAF:GfGf0+4M5B4ZdZcS6AVuvODQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751271655, "uuid": "3195447c-f1b4-4067-a9cd-645b3e88ef0e", "value": 113068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751271655, "uuid": "50e3422c-1d73-495a-89df-a842839d7f84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271655, "uuid": "d487b86f-d4bf-43e3-8d60-abd336add3b6", "value": "cutearm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b12621f-55ce-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751300442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300442, "uuid": "245452ea-58c0-4806-a2d7-e665e4dfdfb9", "comment": "Malware payload (Mirai)", "value": "235f1cc160e9c39396f7627032df6a1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300442, "uuid": "9254559d-ee4d-442b-b749-7582072ab94a", "comment": "Malware payload (Mirai)", "value": "8a5139d6dc5ffb22c4142d8c7699e99574cd9360537a0aaa73e87828fe8bc567", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300442, "uuid": "362f16a6-4c82-43b8-84db-d64b0995e4f3", "comment": "Malware payload (Mirai)", "value": "2eb88d44dc5db9a0e4c752eb04e827387a46d496", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300442, "uuid": "de0c101e-ac43-4b51-9734-5d5b707c7eac", "comment": "Malware payload (Mirai)", "value": "4ce87414c5242606466ed7463cc8f948c8eb728b067a888f696f4138bee4da885e69a369de5549f41065e8bc3d51183d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300442, "uuid": "90acbcb2-b4ac-4f39-aa10-a410cfc916e2", "value": "T14773AE63CCA52D94C25885F471A0DE3A2323A841698B1FF356A7CB7AD047EDCF50A3B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300442, "uuid": "9cf2c460-05b5-47dd-a6f5-07bcc6e86625", "value": "1536:6A/f7SR5+qWnucpIFEXKphmic4knC0F8LHNS:6AH7ospnucpIFEapO4knpktS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751300442, "uuid": "e7eb1e15-4205-4a8d-8939-96c20f823ae6", "value": 75864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751300442, "uuid": "398efb90-5cb8-433b-8419-eb8428176748", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300442, "uuid": "f4865731-a107-4b3a-8191-5978c22a3a03", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ee4ec8-5601-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751322582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322582, "uuid": "811961f1-c513-493d-9162-d0426ecbab81", "comment": "Malware payload", "value": "ac0e722131a4979c5ddf86e0dc22f8a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322582, "uuid": "2ec71fe3-8c94-4c9c-b8fd-00bcbe8004e3", "comment": "Malware payload", "value": "8a77f5a9361482940c3089fe4b5ef54a6094bc81b31b3eca5fb0e01a13f51647", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322582, "uuid": "664f4d19-4974-46ce-8cfa-6baa5265cc1f", "comment": "Malware payload", "value": "1f9e8667db6d617b36489894668368283b454d1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322582, "uuid": "5d177021-2c9f-463d-8181-01ec3ec1f146", "comment": "Malware payload", "value": "769bb6c93f74766577f70dfffa41ca53e49168cc3d612372f3f4ae2eb29cfff7cd6a6495bbf97baacd78ebe69e537af7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322582, "uuid": "b8641cd0-4811-41fa-bfe0-092eec94372e", "value": "T143C4F1A377204F91C35195B209F389335AF6199706F39982537DEE107F20A68386BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322582, "uuid": "828c4f5b-8f09-42ef-aedb-65fc2b5b2089", "value": "12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7zo:W7v+mrY2xzf03yvZ/YII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751322582, "uuid": "e386c825-0550-4ddc-afdc-313fab557819", "value": 592688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751322582, "uuid": "22e9a7d3-dd55-4f4f-b80d-24edad088317", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322582, "uuid": "44a1e3cc-a4d7-4299-a694-43b50deff030", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfec1e8e-55ce-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1751300745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300745, "uuid": "4b169baa-cab2-4796-b653-319789a67454", "comment": "Malware payload (AsyncRAT)", "value": "1eb3740a5235e22d82ccbf6519a141ea", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300745, "uuid": "f5bbeb73-1b0a-4d22-ae07-f66275d0d757", "comment": "Malware payload (AsyncRAT)", "value": "8b2cc228b4a72f956d83e49583f0b4c80a1b3963c13a9ed942f545e08d5f3ac5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300745, "uuid": "62e68d04-00cd-43ee-9177-92d6494c6b6b", "comment": "Malware payload (AsyncRAT)", "value": "7145651858d52d5e12e0e63037f4e4858f3290aa", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300745, "uuid": "ee338aaf-17a0-48c7-81a4-6ef8befe5dfa", "comment": "Malware payload (AsyncRAT)", "value": "88a344904957256a5314f0e4a43762a43d4abe5390d0c14c862766612d9c3cfda4b4dbec890ec0332c8952ef3abe0ff3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300745, "uuid": "61ed2fd2-2207-461c-aa09-96ecbc9a2c25", "value": "T14225AE0273D1D062FFAB91334F5AF6115ABC79260123A62F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300745, "uuid": "23a1ddcf-2039-4f9c-b158-a34fe03f5e5c", "value": "0b768923437678ce375719e30b21693e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300745, "uuid": "9dcd948c-883b-409f-9284-e7c82ebb178f", "value": "24576:a5EmXFtKaL4/oFe5T9yyXYfP1ijXdaQhxsKqv:aPVt/LZeJbInQRaQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751300745, "uuid": "4c82cd36-1c0f-4c00-9a7a-acf654eb51ab", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751300745, "uuid": "f20d8d93-feec-4459-a15c-157594618827", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300745, "uuid": "1b0138e7-9bc2-49c1-a4da-1e9b1460dda9", "value": "Factura0987623H.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf478913-55e2-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751309307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309307, "uuid": "b4b45f19-5f02-4575-b8d1-ee849df89765", "comment": "Malware payload", "value": "b0ec1d07222d056eb06bde715caf9058", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "Mall", "colour": "#56A77A", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309307, "uuid": "dddf582d-068a-44ff-b2e3-4cb28504fb37", "comment": "Malware payload", "value": "8bac14cdbb9d3574b9cbeb07e2aedbcf3d18a1ab602cbd942216c8ee99c87951", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "Mall", "colour": "#56A77A", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309307, "uuid": "d5a8a595-dd4a-4d5c-9286-add950975bf4", "comment": "Malware payload", "value": "036a61ab481eebe58d57d73a72c1e930e3779358", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "Mall", "colour": "#56A77A", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309307, "uuid": "4703177d-9db2-404f-88b4-a16f1353e66b", "comment": "Malware payload", "value": "5ea7495dc097d4e831f822251af8ba3f9205fde369f7f6be8b851b6b3dcfa89c4087f164b68a7edd7568a9048f5b2165", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "Mall", "colour": "#56A77A", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309307, "uuid": "103c1a5b-d232-4a1f-986f-75f158a0b44d", "value": "T12457339BE70BEA6AF0A79633D325079B2A168DC54603E7571E45B12C1DF6FC00B49F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309307, "uuid": "4aa7ddd2-e664-4b72-bd8d-5811f3f28d31", "value": "786432:fWFPCN7F3uXaWdSwkAaBsRt7dqKjOVX56Eqb7iNtKLrhqVb:+FCiKwbpRNM2E2FLYVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751309307, "uuid": "f2e7f6ee-73a0-481e-b604-d625325129c1", "value": 27657834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751309307, "uuid": "cc695f9c-ceae-429a-8a09-6bd9ed5c73b2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309307, "uuid": "ff85750b-09eb-4168-bcd8-ee6b29bf911f", "value": "vtrhkFMvpcCHH3Pfua.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad0bc87-559b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751278510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278510, "uuid": "43a2c1e4-f6a8-4bee-be24-bb25a5ec68c3", "comment": "Malware payload (Mirai)", "value": "94e53ff0490f4f157673ea6a71f13377", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278510, "uuid": "f40c362b-6f0e-479e-bdfc-3ef40bb71787", "comment": "Malware payload (Mirai)", "value": "8c993c0a6e39acf6b6f0bcbd0fcc2258511bbc503a00c1a1e1f0eaf835052d6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278510, "uuid": "19d2cbc8-5781-4388-bb9a-fe4a559175d1", "comment": "Malware payload (Mirai)", "value": "3a77f30a7b8997536d322885d38ab114d01e1920", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278510, "uuid": "eb70d42c-ae2a-4047-ad81-86e1b1df7337", "comment": "Malware payload (Mirai)", "value": "db6078c3f5d7b7e378ffdeac21d9142c86545d4bd42a5266bfa0ffb8e327b64c7c3cc70803af610cc627a23ed6233330", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278510, "uuid": "3b5a0a6f-87dc-4c52-a12f-93878a5bab02", "value": "T19D03E18289E196A8D49D00B81EEBB6085028F04FA6458BF35D77A53739C7B1C7F2C7D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278510, "uuid": "07434d49-13b1-49b6-9837-71741acf5aea", "value": "768:yYNMjfC36o3Hd3eUtr7V1H8US/SIgDwy7qDitqmrBnbcuyD7UHQRjc7:ypDC3jZVB1cd2wy7QaBnouy8HyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751278510, "uuid": "5a56c050-fbbe-4ee4-b9fc-d1a656812d6e", "value": 39448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751278510, "uuid": "170ba4c1-e16a-42ca-a8d6-e95e9b83e1f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278510, "uuid": "9fa1c127-0cc3-4d0a-81b8-423a5f908b82", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cdb5dfc-55ab-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751285520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751285520, "uuid": "cf58665d-5ecc-459d-813c-a78428954486", "comment": "Malware payload", "value": "6a064be946471293d460b93966f7fa8d", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751285520, "uuid": "c14b8bbb-0b08-412b-b94c-0c2ad3f8ef36", "comment": "Malware payload", "value": "8cddc3609d98579496a823b47261ea071a2159a374ce695fe26dad2fc8a1cab0", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751285520, "uuid": "f156cbe7-18c8-4b9a-b6fd-8eea6b08121c", "comment": "Malware payload", "value": "31a821b35d4fe209eb28e13216c432fead46e53d", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751285520, "uuid": "e7f09931-2a2a-4eed-9620-62f940fdb0f5", "comment": "Malware payload", "value": "a822da056fe1da6f139968ca879941406779e63cb78023fcbd1c81cbca0453a3aa013730ef4e6e3b9adc638b56ff1bb7", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751285520, "uuid": "bb21e282-d1f2-44ec-8231-3f6996b9de63", "value": "T15394BF668FEFEC29D1469C7849E2354580F8CC1819264693FB5C78B9CF31BD97A0D3A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751285520, "uuid": "ef345e14-6a67-49c2-8952-3accd5b2e071", "value": "6144:aglPVtCVrWuqn8G4zcLbkohLCZeXlynOTH5tTy:Vb0Er4zEHx6OTHvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751285520, "uuid": "b0385ba3-969a-4f44-aff4-53a558fbf254", "value": 432128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751285520, "uuid": "98f248c7-96c8-4e36-a23e-bb4377d1b4d3", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751285520, "uuid": "6a40db79-56a4-4251-94c5-f21b89e73d73", "value": "Document1.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adde2afb-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751291212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291212, "uuid": "562bf114-e333-4602-89b9-e28d5c1ef905", "comment": "Malware payload (Mirai)", "value": "da1321c56fc6e08d7de8e69967de9e3b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291212, "uuid": "b26bf00f-c1f1-461c-a390-ae053ec49504", "comment": "Malware payload (Mirai)", "value": "8d53bc08e80f6f27cef4a5d9b35b82d962184e04517d0fba00622a821c51033a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291212, "uuid": "d18b9665-d4a8-4042-b922-91816a64a102", "comment": "Malware payload (Mirai)", "value": "29f24222429396cc4c7dafae828320c1fc08b65b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291212, "uuid": "c962053f-8466-4fa2-bbb7-77e1080ad25c", "comment": "Malware payload (Mirai)", "value": "24d9c5a769bd033a8febae1206d8f9c0094f7f981c3fe9d42488a078e674b5585bfb4501600a47da226e0be7f1195ea8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291212, "uuid": "c89862fe-bc50-4d65-ab40-73253bae7774", "value": "T164513A8A14A229B82EA79D53317E4AC17291DEDA40C66F6DD8DC78F940DDF087060AB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291212, "uuid": "43faf83e-2e06-4ae9-bf04-0193a855b781", "value": "48:vtvmvDsdja9aUvs9blDTDu4J5vj68vtLw:vtXdmUz9JDTDF5vj68vtLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291212, "uuid": "19c71026-7982-4cc9-a578-88c73b349b49", "value": 2460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291212, "uuid": "43f75bb0-f18a-4b4d-8b34-5f5f3035b075", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291212, "uuid": "5b9cb037-cde0-47b2-8ead-77599499c5f3", "value": "huawei.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e00eb012-55c7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Turla)", "timestamp": 1751297739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751297739, "uuid": "95e9b6d3-ec32-4b84-8380-cf4ed66d43be", "comment": "Malware payload (Turla)", "value": "3f6094edd7cad01c0f12decf36dcce95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751297739, "uuid": "8daeca14-6a53-45df-812d-3be1484c8fb7", "comment": "Malware payload (Turla)", "value": "8d5be7da9525bdd7e925fe9e5fb988e5e7c0db4d37cb8a6fa6469f08b8ee0bc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751297739, "uuid": "f5194a8d-cbb9-42b0-9cbe-b360d3f92a4d", "comment": "Malware payload (Turla)", "value": "38214d6ec480bb173cf126a1522d0497d93073b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751297739, "uuid": "1a2db2c9-c301-40c8-a9f1-545e7fb3389f", "comment": "Malware payload (Turla)", "value": "0595c897598693313520a9c8b0deaeaaddcf62a6c663742010ee9b4f2576a46baf0b775b5d42ddc6ded8ec06576e1362", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751297739, "uuid": "6b99af80-a554-456d-9ea3-6ca8c27ee4b2", "value": "T167D3128D537E5E16E5E57B7A882E7DC48A8970230BC844DBB25C418778E2F8D1CF1983", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751297739, "uuid": "2ebb9b79-027b-4f68-a833-52a1c4ec1233", "value": "97dba8dc79796d146b2a2df94c3cb0c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751297739, "uuid": "820804a8-bd69-4da4-acdf-0cc62ac0c44f", "value": "3072:EpH51Nyl3uywcTFaAz0nwP+Jgr4vxFUG0bwj+tXpQV:OZel3uywvAzXP+i4vxFJ+NQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751297739, "uuid": "fc9cc8cf-64ec-4e3f-87a7-223ef9c88f33", "value": 142336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751297739, "uuid": "050ca68a-6bc8-4b5d-be4d-3f597c0eed81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751297739, "uuid": "a75cdbeb-b91e-400f-abe2-129127a304b5", "value": "mal_mal", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c8f1baa-5600-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751321865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751321865, "uuid": "5c1f4645-8eb6-47ca-beef-d50e76fa82b3", "comment": "Malware payload (Mirai)", "value": "5c8f42c0724b180eb36b5a6644cd0067", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751321865, "uuid": "93c94061-3bcb-46a8-b05c-5d59101e9778", "comment": "Malware payload (Mirai)", "value": "8dc58254285315938bb0ad962b7aed3b5dd76fcf659c0a8e27091a27b5e6b211", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751321865, "uuid": "7051d036-ad58-43ac-9880-c27d39e50333", "comment": "Malware payload (Mirai)", "value": "f956f48e0f43dbf35693a473410bdf0b5f77716b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751321865, "uuid": "79d8bdda-4b18-4873-af36-3ef148059071", "comment": "Malware payload (Mirai)", "value": "47db1c8af8e50d866ade2ec1fcbdf247e33b736c776f892b1249405cbf90cb473a3dd112d6193193225e9e5d8086eb52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751321865, "uuid": "25cb38d4-5b6d-422f-a0eb-9b6ec3162d2d", "value": "T1B9834BCAB401DD7DF84FDA7B4463090AB530E3521A835F3A636BFD63AD321A44917E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751321865, "uuid": "01c91328-00ee-4997-96b5-dc7f616df8fd", "value": "1536:LqyLb3T7StIDXQ1+oZ9cgTiKwWeIkLDtA1h1lY8ZlDcQUFImuQZhbzu2knvskG:LDoGXRCc9O+xA1h1lhYKmdZtGs3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751321865, "uuid": "99926f5b-f26e-4010-8755-6f8d603c0a6c", "value": 83120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751321865, "uuid": "d7725bfc-b4ca-4ebe-9f05-8862f7384e80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751321865, "uuid": "183a6be6-a9cd-4481-a756-54588e6c1235", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d7788a0-55b2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1751288393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751288393, "uuid": "a15e4e6f-dcd4-4c99-bc50-421972140c17", "comment": "Malware payload (AsyncRAT)", "value": "ee4a28f13637b0f90a1865366fae40ae", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751288393, "uuid": "a89eb3ec-ac0d-408a-8a05-e248e66d0922", "comment": "Malware payload (AsyncRAT)", "value": "8e36d4f98a882487bedbedf73cbb010f793c7bb529d133a58673a14850198f9f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751288393, "uuid": "515349ca-19ae-4ea2-8663-d9ad634160e2", "comment": "Malware payload (AsyncRAT)", "value": "ab5cd40ef781545f856c17e99a56f75eb313ac72", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751288393, "uuid": "3445cab9-6394-4975-8d7d-a7e6d4ad9737", "comment": "Malware payload (AsyncRAT)", "value": "1e7ff29bc75ba19b0a8252abc1ed6e86efe867d645132dc0cf29039dca233bdb2054318e1e765ec54d7cffc3b66cef27", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751288393, "uuid": "266bd73f-7d27-407b-ac44-7fcc395b934f", "value": "T140E3E05837E5FA7BC3BC0636B05206D52B70E1253717F70BD988696A1EA23DE2D6C1C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751288393, "uuid": "71035d0e-15fd-4fdf-84da-d12a8346a7d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751288393, "uuid": "2fad91fe-ff1c-4013-b711-681cc16d2e98", "value": "3072:aQSkxWigJ7HcGU+6py9QzsMUKM8/TvzcI8ZuX1Kc:aKWigFHcX+ay6zsej/TvY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751288393, "uuid": "3e85ccf6-d36f-4b4e-bf13-4e8cbdeaeccf", "value": 153088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751288393, "uuid": "c44eff1a-0a67-4764-8773-8912983dfac4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751288393, "uuid": "d95cbd70-b23d-4be1-b416-c75614c2e25d", "value": "SDGSD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e84f16ee-5605-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751324382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324382, "uuid": "4cbcdd2e-5980-4a0b-ae5a-1f265f3b173a", "comment": "Malware payload (Mirai)", "value": "e80b7ccf4fd9ff2829d9a1ab734028a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324382, "uuid": "a52124cb-245e-47ff-ac60-d0436f9f7e53", "comment": "Malware payload (Mirai)", "value": "8e7fd27b6063510eade26f8ceffbf89b4656913fbc2f7fac69d5191c9df473c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324382, "uuid": "a06ec5a3-712e-46f9-9762-65536b9775b5", "comment": "Malware payload (Mirai)", "value": "fb77eb84c995aad47c3d149ae9c4e75e804c8a81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324382, "uuid": "c6a506cc-080e-4561-aa3d-30d79d478b5f", "comment": "Malware payload (Mirai)", "value": "996cb77ed2192cfdaed1666ffda2ef97859efab75d0a389b1c69109cd751a9a7122def841ae6691af3aa0887bdb04b9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324382, "uuid": "e3a98d91-211e-4f35-a34a-a6eb0a22d1ff", "value": "T14303F13D095009AEEB70907929E9CF001D89EF79E5CB9C09245AF796FA867503C6BED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324382, "uuid": "3a796384-2b60-4945-9400-27cc834d33b3", "value": "768:zV2jFMgp2Bbw9TA+2HBw0wekxvLaCX5yA65j1BfXCOMJgGlzDpbuR1J2f:z8bpos9JMkxvXJL65j1VsVJuAf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751324382, "uuid": "230db423-ded8-4560-a624-c36c86f3501c", "value": 38412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751324382, "uuid": "10eb5a40-62d4-47a6-a69a-469a1faa3274", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324382, "uuid": "437e0877-af9e-43f4-94b0-1c3e694d4c69", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa11f86-556d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751259048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259048, "uuid": "13fcd8a8-a31c-4a92-8ac1-0cfcbff735b6", "comment": "Malware payload", "value": "cec76ad4860b434c8ce2d9f4f8f79e18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259048, "uuid": "6ed58b4e-7b4b-4193-8ca0-f07430d3a0c7", "comment": "Malware payload", "value": "8ec5b50c39d54ba7940a71e9e940ead1e29494f234a7c21f6b8b22ed0c091cda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259048, "uuid": "cdc5ede2-0807-4d82-a44a-87fbc61f8a47", "comment": "Malware payload", "value": "6753fedcec20ac0539a601e074f55383fbabc187", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259048, "uuid": "3b17d4b1-c826-4293-bb97-8f70713dc16a", "comment": "Malware payload", "value": "f3311bb642391c056a0b6bfbaf8d6f8343a29b5e03db0c808c9496a5e8d6c20f30204bd86592091fd39a04e7c8cdbcc6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751259048, "uuid": "b0ae026d-43d9-400d-8fff-9792744392a2", "value": "T1CCB41228EE4E3881F3D1E3B8DA0A4BB1B05B7DD0D166C1B2BA41E25D95EDDDEC5D0212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751259048, "uuid": "93979ffe-4de3-4cf5-9d1b-600d78657515", "value": "6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751259048, "uuid": "375edaa6-1a05-42b8-9d45-1316bca09777", "value": 509896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751259048, "uuid": "67de1b44-38e0-4b14-ada2-5a68e6c881ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751259048, "uuid": "9c01005d-6d46-4a4a-ae49-b59856123edc", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037a275c-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1751291785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291785, "uuid": "aeef9175-c155-4024-88b5-ec4056d75f6c", "comment": "Malware payload (SnakeKeylogger)", "value": "96d140acf45b52075791691af146cf0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291785, "uuid": "ec0c9451-04ed-4d66-87c4-71734e5f4874", "comment": "Malware payload (SnakeKeylogger)", "value": "8eeb560106eb1977dafe5b9cdd621e4e4b76efc05bcd01d67d4d0cfd34591912", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291785, "uuid": "fdf2d330-3bc2-4398-b83e-26c771bcca68", "comment": "Malware payload (SnakeKeylogger)", "value": "af416e8995f538b6837fd5f24817a493094a1844", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291785, "uuid": "3bf7edd0-e78c-41e7-a2a5-0eba2445a074", "comment": "Malware payload (SnakeKeylogger)", "value": "1655ea4214a60dd8d2bc9318f52fa6e75b14ea96d5dd143a8fd30724cbe576a21de62d2a143aa07c2e330225f41b7d8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291785, "uuid": "9f7d7bfc-db84-4ea1-b6f4-b48d583ea864", "value": "T153C41246342AE863D4BA0AF90E52D17463B94EDE7911D3C3AFD26DEF30E57512A007A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291785, "uuid": "5c38fbc9-e7a2-4644-acfe-ca66199df476", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291785, "uuid": "8106d180-6754-4e81-bce1-1c0dd2a83d5e", "value": "12288:kbwiVLqa5KvHwPGa07xoxSwdDfW4LomvLbjb:TilqaWwuuXdDuzmjbjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291785, "uuid": "51e83b89-cf2e-4e31-81cb-daeb7db0d50a", "value": 571904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291785, "uuid": "a5adca09-357e-4977-8a81-a057f4b350f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291785, "uuid": "7a5eaa34-79ba-463e-bc0b-2ad9f88414b3", "value": "dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab677cf-55e3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DCRat)", "timestamp": 1751309407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309407, "uuid": "2572ee51-d1d7-48d6-ae45-3c0976184b83", "comment": "Malware payload (DCRat)", "value": "a5bfe315a405a766848f24e17201dc2e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309407, "uuid": "f036e836-7189-4f3e-b869-10ae2fb5ab1e", "comment": "Malware payload (DCRat)", "value": "8f007c143c969158f00b6d71d656abaf7843ca93a99b97b8728677d92e3b3d5d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309407, "uuid": "4c3d6d3a-cfb6-4790-a15d-06592a8dfa4e", "comment": "Malware payload (DCRat)", "value": "daadfc1a18f063e2e5cb966b829399e7f960b917", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309407, "uuid": "cf6258f5-bf44-4738-b941-c298f7d286ce", "comment": "Malware payload (DCRat)", "value": "52a3bdd0b33f6672bd1a7b1a7b778b67dd67fee381f30030f907f63e1f47cd964b493dfcf350b449db4752a657565cd8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309407, "uuid": "6a6c3a28-1a50-4013-a023-b8147a2a8f2e", "value": "T15B4549017E46CA11F4191233C2EF858847B1995166E6F72B7DBE376DA5223A33C0E9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309407, "uuid": "db774010-e0b7-46b6-906a-97966ac02cde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309407, "uuid": "1c749690-956e-4ce4-a3c6-8b80f3e0dac6", "value": "24576:F6eZu+91hUVHZ2s7htm18lb2bM+Rfgpnhkn:Fk+PEHrllhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751309407, "uuid": "cb652677-37ac-49fd-a4a8-5e0994035a0d", "value": 1186304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751309407, "uuid": "1c59305f-3c01-4181-afda-ae198400824f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309407, "uuid": "2bfd5694-0d68-4a06-af75-160c98897af4", "value": "A5BFE315A405A766848F24E17201DC2E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b48863-559a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751278389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278389, "uuid": "74aa3c6e-3cd4-4a4a-b276-b6fabb779f2a", "comment": "Malware payload (Mirai)", "value": "1579ab3e5e562e60e584aba0e5d00ecf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278389, "uuid": "4711bb9c-0338-4f9c-9655-0b29b251e8a6", "comment": "Malware payload (Mirai)", "value": "8f56c46013d66fd63e96eabea5c37ef266d0a9dcd523fe566d6247f14a818826", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278389, "uuid": "0725f7a9-cde0-4496-8bf0-a0c7bfe1aa5d", "comment": "Malware payload (Mirai)", "value": "7673d2512c12a425d7cf05aae31cd09376e6a144", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278389, "uuid": "7c3a1d38-cc39-41ed-bf92-dfc7105c6ce0", "comment": "Malware payload (Mirai)", "value": "40a32be70cc7b34b9c0fcb05a027eeda8cda49141eccfa028b72192a04e337b4c42f7090ae5a953e3707efb1de5fd0c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278389, "uuid": "8f186a67-5ee3-4ca9-b174-fb4386fb5d32", "value": "T140B349B3DC256E68C515D1B0B0A58FB96B63999082475FBE1A73C2744083D8EFA067FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278389, "uuid": "0c4d0a61-40c3-40a7-8781-b10eb8b392fc", "value": "1536:fIYidkzDXX4lRCNNK0Rq259K+wm8KfDW9D8REmALYo1RkeWtw:fIYidIXX4/gU0VK+wSLWAfA/1ieiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751278389, "uuid": "c6252c1f-f043-4d4c-adb4-b8396915094e", "value": 109380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751278389, "uuid": "bea23694-3ce6-486c-99dd-ddbcbbad496d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278389, "uuid": "ba155c31-56c1-44c8-a29f-35df42d10380", "value": "cutesh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90682de2-5594-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751275701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751275701, "uuid": "1b575213-0814-422a-99bb-32e7645c9d2d", "comment": "Malware payload", "value": "714a5d93544347a5846a9127fdb570ae", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751275701, "uuid": "bc4dffbe-1d22-4681-9e57-ea2094b8ae2b", "comment": "Malware payload", "value": "8f6976a96d53689278dd7af8245c4fad3ca6363f6b896bd1c05239262a40736e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751275701, "uuid": "3384a38b-42cf-4f8c-82c7-521afd56b458", "comment": "Malware payload", "value": "e9e88b5dcf4a4827a72da3aa433b910ec33491b6", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751275701, "uuid": "51bfeda7-27f5-48b3-af55-994d630de2cf", "comment": "Malware payload", "value": "60f37b6d769a18067ea06ef3df6bfd9e50cf29a8e78e32a18cd423a8050196738a034e4cec35f6aad28f1dd9c98f1b81", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751275701, "uuid": "b8adc689-5805-4d83-8be1-80145fa67231", "value": "T15CE5DF8AFB0598AEC5E7A63247750226411BCC569A43D6975B51F23C0DB7EC08B8BFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751275701, "uuid": "baad6291-658d-43d5-9dcb-05293066b65b", "value": "49152:vvQz1QMhINT2UMhINHdxfxi1XlIg51YKBT4tIIYlAa7/A3qpI2AUFI50AT7kfDzL:nQz1QMhI1LMhIBfxiV6g51Yxtpw2qyrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751275701, "uuid": "af339c18-80fb-4c63-9b61-ace5d6c739e0", "value": 3106417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751275701, "uuid": "dd491c71-42df-46e3-97b0-27c0056b23b2", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751275701, "uuid": "b087f8fa-93a8-4ce1-a9cd-b6ca1b0c6c5b", "value": "jxjr.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb1369b5-55b7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751290912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290912, "uuid": "241be0d9-6bf6-4134-84e2-3f57ab9e1f2f", "comment": "Malware payload (Mirai)", "value": "b3b6d79545b138bb7af5ae113442b19b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290912, "uuid": "e4cf5f10-27c0-4d54-b87f-cbb47ccbef2d", "comment": "Malware payload (Mirai)", "value": "90b7c3277d256301f030d1df12ee4e95202575943fd73610b32e1d79ee94d6ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290912, "uuid": "368c4478-e8f5-4c94-ac51-ae242dd8428b", "comment": "Malware payload (Mirai)", "value": "7a18eefc500b5ee9dfe6a61b354aa55828075ee9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290912, "uuid": "9a9f6ca7-482c-457a-ba65-5fbe84f0f22d", "comment": "Malware payload (Mirai)", "value": "f2882a87a4da253153d6b98ebc02ea7cbef0f045d626b322535d0cec089422eca940c018849007217278429cafaf161f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290912, "uuid": "3fa853db-0936-4727-9307-1b528f40c749", "value": "T11F434A02725C0A47E1521EF4393F1BF083BEE9A120E8F989254FDA1A4675E33554BF9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290912, "uuid": "9a427229-4468-41e2-b7e1-a33b3edaba91", "value": "1536:XX8o4FxlChlUHLjn/sGZA/WKu+8IKTLjQ:8ou1j/sGh+BKTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751290912, "uuid": "88eb7302-ae38-447b-8f53-e7aa50732060", "value": 59872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751290912, "uuid": "52df79ad-83d4-40de-b9c3-523bddfac9c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290912, "uuid": "4d0d5db6-351c-4db2-94da-e5286828da3a", "value": "mirai.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80384b11-55b7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1751290706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290706, "uuid": "78284ffe-8c9e-43e2-bf18-9886b70c693d", "comment": "Malware payload (LummaStealer)", "value": "d0c5c8a24239a6721adcfbb1b693b0ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290706, "uuid": "41336235-9e04-48ba-8136-efb4825d2f69", "comment": "Malware payload (LummaStealer)", "value": "91b4bb86d211697661e4c5f87559531fcf238ef1476cd6979152e41d5e221de0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290706, "uuid": "83258108-1306-40d9-bb0d-3c3dc995a262", "comment": "Malware payload (LummaStealer)", "value": "fa21a2f8f743a878b38b7a29a291ea8f91086e94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290706, "uuid": "964e646e-a3a3-4de6-8b9a-8d3f88e22db9", "comment": "Malware payload (LummaStealer)", "value": "7c9e97e011bdfee468ea16eea4a403c50a4d3c17bf2a44762d85e68b95370b2798bf3b9ce2d9384caad9a7d2ccc96a38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290706, "uuid": "760d6f52-4c0c-4c89-b4cb-0ba6a5a6a1bd", "value": "T14B9533D25C05AA20E49FD476C6F78674267075B631C5E3287CEA97D90B13AFA5FCA008", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290706, "uuid": "c9f2adc2-2b45-4bf4-9445-e188e0cf2538", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290706, "uuid": "ee4ad140-1365-47b4-8355-2ec9d70eceb9", "value": "49152:FhMdb1Z7jVhmxqedTsZ8JKSaoTusqHNgGnDjq1/:FhMdprhQdzJKdoTOHN/Djq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751290706, "uuid": "dc01ce35-5ed9-4574-bbfc-1b1cb9cfe535", "value": 1874944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751290706, "uuid": "07b3cf20-6fef-46c3-bf1f-35438498ddd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290706, "uuid": "90300a8b-8c3a-41e3-aa4c-5b1147236f01", "value": "d0c5c8a24239a6721adcfbb1b693b0ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baeada36-55c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751298106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751298106, "uuid": "36393595-2ebe-431d-9dc3-3805af21e7d5", "comment": "Malware payload (Mirai)", "value": "2681250a50d924d5cd3cdd0a6e55ffb5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751298106, "uuid": "5671a4ab-2c81-4ad8-9dab-943a7fd9887e", "comment": "Malware payload (Mirai)", "value": "91e00fc87168c9d1ca27ce8a87625015f480011d8f41d5e8e996ba341ff6cd7c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751298106, "uuid": "f7ebc89b-0675-49e2-8540-70a44f771a64", "comment": "Malware payload (Mirai)", "value": "9799f025ad384d6e5dfcdb3edfe1b5f119ea6145", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751298106, "uuid": "b7b1f624-f578-40dc-a43f-8a127612ef6b", "comment": "Malware payload (Mirai)", "value": "a44943313becd36bef2b160e32acd432ae321daeed9be828a304566fc4056f4f8b9577955c6f486ef9336ee793f951de", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751298106, "uuid": "1ef946b6-4878-4d56-9516-99e2daa24556", "value": "T197211DBF07115027C01DDED230694610828A8283B86C4BB97BDE4CB76E84EC6EC49E5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751298106, "uuid": "55fe6e73-bccd-4ff1-ab22-95631e2928d7", "value": "24:O+N+e+GNI6s+vKB+gN+L+f8+Qu+Y+QR+j+m3C+oxn:d5KN+5uwUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751298106, "uuid": "91b53797-e136-4b63-84fe-48617eb83c83", "value": 1160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751298106, "uuid": "70abadf0-0b4b-4b3d-ac37-0bb766b4edd9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751298106, "uuid": "33cbcc53-173e-4300-a93c-a0826b976ecd", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b48c98-558b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751271662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271662, "uuid": "3b868ec2-8ce0-412c-bff0-b4887f7258cc", "comment": "Malware payload", "value": "e576e0f989aff3fcaef7afd81cb85e0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271662, "uuid": "f27e5f70-6c28-4424-ab93-93909a32dece", "comment": "Malware payload", "value": "91e874c79692d50401ecd9f74638701bc36c82df6d9f6a6abee65e94f1e2db88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271662, "uuid": "b29a8549-5f96-4641-819e-2f655dd0f12a", "comment": "Malware payload", "value": "bd70248c6c76532d2d48c1d72988e2d4340e062f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271662, "uuid": "a797befc-5084-4f8d-9d30-44d298d8bf38", "comment": "Malware payload", "value": "1ba7d4853130939b3adddc3e99d6b4ad80d87d4e4a8d29bb09e6a42195a483163664a2822c2503ad821ce477bd5f4692", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271662, "uuid": "dbd12f78-961a-404d-932b-66cc1f618df1", "value": "T18EC33A06731C0D47D1633EF43A3F27E1D3DFAA8121E4E640255FAA8A91B1E325586DDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271662, "uuid": "03d4a895-9c1c-4dc0-8bdb-6b245766cbd7", "value": "1536:H5PO8Kr1SPkZsRxymOp0NaabW54ypx5vRBLvAKRiJZEff4qAUZuqJ:ZH1RxycNrMpx1RGKe4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751271662, "uuid": "8175f374-fd67-4dc1-b76d-df64c2a7c81a", "value": 121376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751271662, "uuid": "848c9c52-ef7d-4157-8a2d-0428c5be61cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271662, "uuid": "d052266a-234e-4d15-886a-e065b9d1f8fe", "value": "cuteppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0702a23-559b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751278842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278842, "uuid": "138de99f-b7b5-4d85-b309-66ed9be678b9", "comment": "Malware payload", "value": "22d97f0e3f7edf4f895b8ec92b319dce", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "SWAPVERSE", "colour": "#75FF7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278842, "uuid": "d2592a42-5d87-40e9-92f6-ca2e67f18aee", "comment": "Malware payload", "value": "922e86ebcc11bc288a027314fa1ac183a72a4b83fabf2bfb2a6e205157a407c3", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "SWAPVERSE", "colour": "#75FF7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278842, "uuid": "c0127a20-11b4-44c4-bc1b-accc22ea7e9a", "comment": "Malware payload", "value": "9aba96bf637918e2399091140540acd8ca307ea5", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "SWAPVERSE", "colour": "#75FF7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278842, "uuid": "0dfc55bb-718c-4f72-a616-9bd91fb28424", "comment": "Malware payload", "value": "344edb8914244a6f57bca36bd1eb1a9b2b17a5694ef2ec48dc59d1f55472506cd9f0089de09e44f99bd2fdaae10e7220", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "SWAPVERSE", "colour": "#75FF7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278842, "uuid": "99ec6930-fac7-4010-aa93-5d81faa0bc31", "value": "T186773316EB0AED65E8E35633A3A701672A174EC46583E6472EC6F1281DF79C04E4EFC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278842, "uuid": "37ad397c-c04e-4f90-8a52-8d4f31dd7689", "value": "786432:pSS/BO2hqmxUmhGQ/FK92q2+CZuYyAR9/JWLaWdSwkAfA1iNtKLrhc:pSS5N8mGmhGQNjN+CZ7N/JDwbfALL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751278842, "uuid": "f622f247-6292-4781-9575-d90f0e010efb", "value": 34232949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751278842, "uuid": "dee07712-2505-489f-8674-bfb082da35a5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278842, "uuid": "9142cb0f-8d8c-4816-828b-c186a140c96e", "value": "swapverse.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef245913-558f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XWorm)", "timestamp": 1751273712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273712, "uuid": "d6ca886e-be3c-4457-b2f0-56f56627724a", "comment": "Malware payload (XWorm)", "value": "6f431aab06e6f946e53a844554efb06f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273712, "uuid": "ce8e54a9-ef89-4b11-83d6-3f4ea989cd30", "comment": "Malware payload (XWorm)", "value": "923fea9a2f9273db1b2bacd6d07db3070f963caf501951a4db14d1b719388ace", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273712, "uuid": "c4c996fb-e2b6-46c6-837f-bb024047480f", "comment": "Malware payload (XWorm)", "value": "135633fd4accd4572a090bda356fafe6d64ec6c0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273712, "uuid": "c1c0d3c1-676b-40f6-9d21-b6f801622897", "comment": "Malware payload (XWorm)", "value": "ccb8cac12e212b0e0d23e613ccaf853f4f0f4b6ee5718c76dfeaa7cb077f21642b52194469ed3c1e125100003d94ef16", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273712, "uuid": "e70dfdd9-4a4a-45d7-aa09-0c825b9603ba", "value": "T19603C948F451E16043D355B4121EA509FEDCAA3B0CB4F0F5F1DCC9D239A0E229AA2B7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273712, "uuid": "31bbedcd-615d-4e5a-a075-3809a707c1ec", "value": "384:94Cp/DC3q2/kVNVXvDJQZ9f6RUJ2Dmtkuxf2Fa23yzLEacHbs+TC0ym00TY8FfVi:94O/4q2/kVNV/WzQ5sVsY8VUN522Ke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751273712, "uuid": "d3dffd9b-8f88-44f5-a5c0-94ad6461c02d", "value": 38316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751273712, "uuid": "5fdbeb31-4980-4fbc-b046-41525d49ee08", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273712, "uuid": "ae3f1626-49a2-48d5-a440-fbf65ed8e45f", "value": "ProjectXDocumentsXXDrawings,XSpecifications,XBOQX.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30723e36-55d0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AurotunStealer)", "timestamp": 1751301310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301310, "uuid": "d30a77c0-ba03-4fff-9481-dab1759c9040", "comment": "Malware payload (AurotunStealer)", "value": "ce65831bda3f16b3fced3bf207bf718a", "object_relation": "md5", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301310, "uuid": "f0526fab-7cdc-40e0-a8af-d140dfa093a2", "comment": "Malware payload (AurotunStealer)", "value": "925bd273b5ad8eb206a1601453407f6c1d3c2a83fe589af93180064ee9a0e08c", "object_relation": "sha256", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301310, "uuid": "f83685e8-4e21-4ba1-ad44-d283f782cbf2", "comment": "Malware payload (AurotunStealer)", "value": "89ad5f5c2c3a13292342dc7ee5f87db4cce3b07e", "object_relation": "sha1", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301310, "uuid": "f4ec27fe-27a1-4390-8e39-4b9a292e33e7", "comment": "Malware payload (AurotunStealer)", "value": "b6870cefd8ae2d16463716f1c10557e2c6e2c4b15595a17e81a21b99234c2de14c9a29339203255deaec9247571da6d3", "object_relation": "sha3-384", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301310, "uuid": "5b76145f-55b4-4f60-8f5c-251027204f9f", "value": "T1AA47AD5EF6A04792C426F538C97B5F09F7B278211760DBDF0220416A9E273D1AA77BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301310, "uuid": "a273c586-ca78-4c04-8e9e-1937cd99cb90", "value": "62674c7112b03d0506916e5862cf6e8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301310, "uuid": "df5dece2-60c5-43bc-a8f3-5861c8802513", "value": "196608:S3k3b7xJxtHESFlDhN3AYp7/4Zhh32DKw6XzTW5iwCyMXQLdO2LGmSj6M2:Xb1Vk0Dh+5L32DKw6XzTMCyqQgOU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751301310, "uuid": "09bfa2ba-a8c5-42e8-94d0-f26917395670", "value": 26286080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751301310, "uuid": "5cc48e7c-6209-426d-8d56-cd284d8363ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301310, "uuid": "ebc8545f-d60e-45d0-906d-cff4eaaa29f8", "value": "ce65831bda3f16b3fced3bf207bf718a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29b1cea-5600-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751322225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322225, "uuid": "73a4d6c3-48e5-44dd-9385-e23d377bdd4d", "comment": "Malware payload (Mirai)", "value": "81bd2873f2002241bbd0122f183522bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322225, "uuid": "12bce508-afb9-4915-af38-dcf462cbc5b2", "comment": "Malware payload (Mirai)", "value": "9297a237856533dc1b614cd67f73ca3b3bee19772b725ba00b3b83dd61056fbc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322225, "uuid": "86303d9e-1b57-46ef-92c1-7e739d6f7b93", "comment": "Malware payload (Mirai)", "value": "89792f013f7cf0b78e56ea435af6e538ab299e75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322225, "uuid": "b349d843-9d63-449c-82ea-693b82ea5a8d", "comment": "Malware payload (Mirai)", "value": "30829d78a910a545b279be50cbbb1ba8149cd98dd1a9b79bf6092fbdbc17affcb2a343889bd9f247b18d76fbcb2657cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322225, "uuid": "fd1508ac-0736-4762-b74b-cefc2d746ce0", "value": "T16E63A51E6E219FBCF76C873947B78E309658339626E1C584D19CE9015FB024E642FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322225, "uuid": "f1ae07d4-541b-45d8-a170-14d3820f94d5", "value": "1536:z6Cz5mL6zdNT1M/lw1Y/ofH7eIFE93RcRxmqvTmV/7cf8nJkW4:14LWdR1Ge1Y/oI7c2SmjJ74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751322225, "uuid": "3252aebc-9e1a-4d8a-824b-d1a0d3876554", "value": 67808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751322225, "uuid": "bd6855dc-42cc-4951-9efc-a20ba8d09988", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322225, "uuid": "dc6d913a-e33f-404d-bdf4-75da0f3cc640", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d9c151-556a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751257618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257618, "uuid": "8fc44f6d-60e6-4dac-a823-e270022ef977", "comment": "Malware payload (Mirai)", "value": "8cc612ed33f83dfdb7b36ba295bb351b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257618, "uuid": "0a78efdb-2f3a-4d9b-b2a1-ead9d11a67e8", "comment": "Malware payload (Mirai)", "value": "92a79801513ef6941ab613b53691339d35bda1a353414009bc9a4a75d4e34b66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257618, "uuid": "ff07c131-ab21-4133-ba3a-0e6e48581877", "comment": "Malware payload (Mirai)", "value": "6ee5b1208b8d990150ec4d86d1b1c64829899822", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257618, "uuid": "ffd88c68-c951-4426-bf8e-f80b6a5730e1", "comment": "Malware payload (Mirai)", "value": "05c715bb667d9eedfb203b0afbd98466897869f8cb93410146df1b94c5838b492bc2c173fdfa28f62afc263d145eefe7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257618, "uuid": "8d481d10-6208-4877-ab85-101a98cd0ae6", "value": "T151E33A07B8C0C4FDC4DAC1784BAEB536D971F0DD1238B29B27D4AA262E5DE305E6DA14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257618, "uuid": "1deabbd2-47fb-4623-b2a2-6fb0e7cd7c5b", "value": "3072:cKyYSpm8YxNKhEQOVU+WAVRP5VGgcfc2B9FWs2BY:cKyNY5JlzyGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751257618, "uuid": "87cb9742-1466-438c-840b-a3af2318835b", "value": 152072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751257618, "uuid": "8d184b25-cc4d-4f6b-a8be-e217fad06d0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257618, "uuid": "397031ae-73bf-4549-b6b4-fb91446d4f12", "value": "neon.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed67198-55b9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751291590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291590, "uuid": "f4aa5cf7-281a-489f-8304-bdd503942e82", "comment": "Malware payload", "value": "8300b9f4463d823e518f27fd44fdad6b", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291590, "uuid": "09123f67-292e-47e0-bb1a-c33561402507", "comment": "Malware payload", "value": "93aa9ac7029156421ef160fa0baf3059d059f2319226d920597103bcd60394a1", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291590, "uuid": "388f02f2-92be-4e5c-8053-b812ce19fb4d", "comment": "Malware payload", "value": "21ec5bf39890cc69734b3bd2d7b70b15aebd903f", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291590, "uuid": "167fc793-8637-4ac0-9058-6fdb91008da1", "comment": "Malware payload", "value": "235a4022d7268a2e3d58e818235bc8ca64b477488434d6c56d7fdc5015b345f21352ba00afa65a7aacc82f530306ae23", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291590, "uuid": "ee75a2c7-bb9a-4757-b1b9-3cd59a0eba3f", "value": "T154557241D2C4CE1BD6E08B3A1E7946A27371FC9467627B1346247625F9BA2B43DC0EB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291590, "uuid": "31a76a9c-4619-43fa-82b5-c72070e1e92a", "value": "12288:USVKc7AS/KnK5KvkzYMD6+3avkzYMBsfxqcWuL0xmwKT4GHiavxA:y6BDX3fBBneATHEZxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291590, "uuid": "d311d2ce-e5ba-43d6-b2d0-c4392aafe4bd", "value": 1392640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291590, "uuid": "2669f368-663e-4146-a467-39fa39712e1e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291590, "uuid": "12087e03-b1ee-4e75-a9da-102797dd5d53", "value": "PO#78698329.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a867df84-55a2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751281754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281754, "uuid": "7bd05972-f19d-4d20-aacd-a72bd8f50e7d", "comment": "Malware payload (Mirai)", "value": "a03e9558ff1140c65960da43acd58f44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281754, "uuid": "1659c188-e7a0-48ae-afa3-2afe073dd070", "comment": "Malware payload (Mirai)", "value": "943c58c5acaeea285827b7584b22a1fceb0d8a2fa0fb183673e655dadc965604", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281754, "uuid": "3769074b-9c30-499e-beec-717cd37b520e", "comment": "Malware payload (Mirai)", "value": "cb2cbd07352ed49c3b4dd9e747e8967fb65f74b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281754, "uuid": "01519c1c-62a5-4aad-8c91-b946daa0aac8", "comment": "Malware payload (Mirai)", "value": "10f838bb61a2d3fd95f347945d2c2e4aff84d84819560b45c50b19a5bc03863dda81fa460ee3576fedf2901da5174b2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281754, "uuid": "85f3272d-f5dd-4a94-98a8-8129a66459d2", "value": "T187644B07D4745EB2C000EE7129FB65301B1AA5560A4F2A96A97D9BB0574F8DFB00FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281754, "uuid": "ca25785a-2022-40bd-b47b-d527b5c3b758", "value": "6144:SIdEoKKDQTsuFk2Fjo30C4Jmqh/EoN5w+twifIFvh5SibUmUGR6E6twHq7ug0lc:SholcLFk2FU3018o/EY5w+twNJ5SibUB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751281754, "uuid": "b315e638-5aac-4376-8843-537a4560396e", "value": 334032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751281754, "uuid": "af18614e-543c-4563-8658-a9e52382e1f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281754, "uuid": "fc785464-0285-4b5a-92d8-e6c742290f21", "value": "s-h.4-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae98560-559a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751278269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278269, "uuid": "50be31d5-a98b-4ab6-ad93-69505a4144e2", "comment": "Malware payload (Mirai)", "value": "f40c5f63858e4b45fed7fa046428851b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278269, "uuid": "b7bd2a33-6d5f-4a6d-9fb1-0963f6a344f2", "comment": "Malware payload (Mirai)", "value": "94ab062beeb8d4d2b9fa4bf01780d938bc249d28bbd8bc9608597e9367651fbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278269, "uuid": "c701c28e-ff93-4d1f-821e-6f364e407c82", "comment": "Malware payload (Mirai)", "value": "2209059f1ed61be49e78aa3bd92f069c3afd6b7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278269, "uuid": "dbc426b8-e0a4-4b5f-a1f5-8cb6831c4f35", "comment": "Malware payload (Mirai)", "value": "c110d78e532d4c847b812b4dddb4929f7d785271cf9ec9c282935ed54d49ae621feec92bee985bfe02af2da88d4421a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278269, "uuid": "9d95abc7-342e-4dc2-9c56-69d35e481d5e", "value": "T1DE03F26B64A6DB6FBA3F123048AD2D4F0846B982FFAD54915548338B60727CDBF30949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278269, "uuid": "1f0e1013-348d-460b-a283-40ee840e64aa", "value": "768:j7zYyP2YfA4/foig1jW2pfQ3HSCel10hcOJddeeK0ljFuik+9Jx93YFkgVs4nbcC:7IYfAGTUjTNXCg10iAahgEKz9o9Vnour", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751278269, "uuid": "5bfb6298-5353-4386-a715-842dc6bb8563", "value": 40024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751278269, "uuid": "d5ba317f-ed0a-43f9-ad34-dc28b8181abb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278269, "uuid": "9e4e9237-f6f0-468f-ae69-3e243f76d11a", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d7ad34-55d1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751301750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301750, "uuid": "5dc03355-bfb8-47f2-b9ef-41521720b73d", "comment": "Malware payload (Mirai)", "value": "56712d26ee14dbc732b6f7a11cf6ebcb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301750, "uuid": "4b41b187-7d18-488b-817f-de5e3b8b353c", "comment": "Malware payload (Mirai)", "value": "956cf3bd1fb6d33a96150eaf73c73ff7fb6b6cdd98bcfd19705acd866d62a387", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301750, "uuid": "36f55fe9-c272-4af4-8450-8235738afe86", "comment": "Malware payload (Mirai)", "value": "3c357545e0d611fa2bd855e5a8780ef67667573f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301750, "uuid": "7eb1be9f-cb66-4cd8-8b4c-207a2a51c956", "comment": "Malware payload (Mirai)", "value": "84679dfab491784be21b203f0432e22391022beb8ade88c0dd6133c8a363a53d6002a7f7cce5247e74141fcd562d4e13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301750, "uuid": "62765611-310e-4fcc-92ff-6d964b4fab21", "value": "T108045C46EB418B13C0D62779BA9F414633239B64D3EB33069928AFF43F8679E0E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301750, "uuid": "8610e347-515d-49fa-be78-d6587bf6085a", "value": "3072:HoQwjGKsC76a/b8ZeWP7ybyIDV66URT7Qj/QuM/9vScRTmvwxLuY:HoQl7q6a/b8ZeWTybxVfUN7Qj/lM/9XJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751301750, "uuid": "c96ed3e8-1447-45a6-aff2-b2a9133c0126", "value": 173231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751301750, "uuid": "85b099ed-f62a-45ee-9c60-8d12fbb42575", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301750, "uuid": "818f1e4a-cd8a-4139-8cfa-7ebf9530b605", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca336b01-55d0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751301568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301568, "uuid": "22adbd6b-f790-4a2c-abec-b94f19e45526", "comment": "Malware payload (Mirai)", "value": "2a6cac378ca71b0e76128bbfb517ad92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301568, "uuid": "0d745936-af02-42d2-9148-a7d929667ee7", "comment": "Malware payload (Mirai)", "value": "95e163c750a496c45b9d8c371128a1f7209f604fb203e4bb82807d177829a05b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301568, "uuid": "e656f7c0-e2a1-4357-af37-6f49d121c3de", "comment": "Malware payload (Mirai)", "value": "45519dd620b6cdb470e6e0807de201c12530f84d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301568, "uuid": "82ff327e-a65d-498b-8122-99676de46780", "comment": "Malware payload (Mirai)", "value": "c58bc43ed1e5de50de4aa1bf23c5e5a1aa322b921a0782a5db6badd2fc1263671aef01a5a1b8451af3833ec36383440e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301568, "uuid": "0d5b3449-af89-41fb-a509-1a1e55975f12", "value": "T1EAB3F709AF610FFBE86FCC370AE9074529CC552A22A93F397574D818F64B24B16E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301568, "uuid": "ebf989f7-4353-4e09-bd20-414ed793dd37", "value": "3072:6h35dg/SdTNIh40kg145KDxVWDB6l1CT:cKSdTNq4O14YVVWDB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751301568, "uuid": "efa35ca2-f1c3-4993-8a30-50e272a0c199", "value": 113972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751301568, "uuid": "ee534312-c00d-4e99-9594-bffa7322de4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301568, "uuid": "bb3008a2-8f1a-4072-9407-6d788cc97f2b", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d2fc42c-5601-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751322403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322403, "uuid": "1e0fc501-5844-4a62-8bc3-8d20192aa33b", "comment": "Malware payload (Mirai)", "value": "3953dd579a01a467bb20905853d2475b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322403, "uuid": "7970b401-367d-43f8-8319-b51d1cc02595", "comment": "Malware payload (Mirai)", "value": "961bcf2aa2876fc36f133d1d89add507acd934af4b257edca39f9a2356fe6a3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322403, "uuid": "2dd0b4c6-a14e-44d5-9231-14dd0102c42f", "comment": "Malware payload (Mirai)", "value": "a6069b437149ec0da57826c4cf6bf0d004b302a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322403, "uuid": "df4f2a70-9c38-4016-a6d5-bd0be9d1d86f", "comment": "Malware payload (Mirai)", "value": "3efb8f6fefa03e9be26dc591dd9ee19818b66eca18492dc68a72db4a6e51525bb63a2a2bfe921503b943334f5bbfa7c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322403, "uuid": "9848ea89-9e08-4410-885d-45795f11293a", "value": "T1B9239DB3C42EAE90D25542B8A5354E781723E506C2673EFA4F59C26E4003EACF62D3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322403, "uuid": "ab4be6a6-ed84-4269-9b87-5e672f5195b2", "value": "768:Ta6kwt/xVjHjeBU1Fp5ge2Ltcn9srJnynNkBCwQoJWYUvCAj:Ta6kwt/XIGr5gNw9sqkBv/J6vCAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751322403, "uuid": "47d431ad-ece2-4ea0-abc9-a1ceb2d159e6", "value": 47556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751322403, "uuid": "2e6367c3-0437-4150-a8ce-59a191a938f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322403, "uuid": "6c4b375a-95e3-4929-a5ba-0f3a4a389a47", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab88b47a-55d0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751301516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301516, "uuid": "dceaa1db-3a65-4737-af2b-1d2329008664", "comment": "Malware payload", "value": "ff046527a64ca1af29673c40dc802095", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301516, "uuid": "2a23d280-9e22-422f-b873-6046f4bb2544", "comment": "Malware payload", "value": "968ecb4c99e77e3a955a22cef2673aea827d550030a8bd3adbba1922e7586767", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301516, "uuid": "d4a3675f-47d6-4b77-a527-2982104f931b", "comment": "Malware payload", "value": "a22c809acac281c02e0fb5b747624c7c72f64598", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301516, "uuid": "355330f9-d83f-4e0f-887a-fd4e848da431", "comment": "Malware payload", "value": "6b5a96852a9abf3236c9864ce56c92806bdfb9d877d5e25078350c6f2e253b11dc1426ddc3423c9279962da7af0213ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301516, "uuid": "95485aed-b16b-45af-b079-85a9551b313b", "value": "T1EBC42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6D742F661EDB1B42469E66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301516, "uuid": "55e058e9-ce9f-4f9f-80b2-01f79812b570", "value": "12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751301516, "uuid": "0ccd4434-81f1-4d99-a221-77d7cdf25625", "value": 587764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751301516, "uuid": "88d71bc5-6034-4dca-9846-f9c52dcf9a55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301516, "uuid": "737a1d4e-741f-494c-b03f-588539a720e1", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "625ae418-559b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751278630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278630, "uuid": "635c38eb-4fe4-43b1-9956-0efd85dfc97d", "comment": "Malware payload (Mirai)", "value": "f148d1b2b7e53d74b098394e6d9fe9ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278630, "uuid": "6740debf-798d-48ce-9a4b-444d74176ed7", "comment": "Malware payload (Mirai)", "value": "96a6df3504ddb9ee47de1ff9f38c9111023b67e9a9ff18aff16e05cf8b9063d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278630, "uuid": "12c14764-954a-4b3f-8978-886d1ced6252", "comment": "Malware payload (Mirai)", "value": "37134eeec4d390806eaf5e2401e93187f427ebb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278630, "uuid": "e7be11c9-b152-4d9a-ae58-49cc772b91c6", "comment": "Malware payload (Mirai)", "value": "007c47d6a872448964643c58e87e26fdd940016545d364e26345fdeb8c7b957ad4df611e29da68b7ada82c728d98543c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278630, "uuid": "fe58e252-e2f6-4438-a5a1-44d11426b0ab", "value": "T136B2CFA863560861CD604C36C7BEB7F3237B0B38A8E631E82799545CA5B105E577E1A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278630, "uuid": "add7d332-04f7-4213-bde8-fa33f1dc188c", "value": "384:/nPOPKN+QZfw6cEj90bq1ZYmkWb2wweTcuTrK/iwl7Y1zdK/XY14OhymdGUop5hM:/POPKwQZITC90bSZYvW6wwh6rMZe1zQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751278630, "uuid": "5134a301-fda1-466e-9bc3-a0e104cdc340", "value": 23444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751278630, "uuid": "c849720e-c182-4ae6-b0f0-77f24fa9987b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278630, "uuid": "05448094-26f4-4796-b6f0-dcd39c236457", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d38f09-559f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751280267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280267, "uuid": "75436109-51f4-436f-9b00-a69bd0296a2c", "comment": "Malware payload (Mirai)", "value": "b7a36019198052954f4b61ae0654c7e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280267, "uuid": "e7b3418d-167e-498f-affd-6fd41ee29d9e", "comment": "Malware payload (Mirai)", "value": "96a7163c60755067b6e12a68c325f6eb09fb75e2745bbe1dbc72d1cdb66e25a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280267, "uuid": "22837055-84cc-47b5-aa26-9a666ebdd9e1", "comment": "Malware payload (Mirai)", "value": "55c44b428645ed03d71e8ffa37aa8c4dd8d6bcbe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280267, "uuid": "9c61c445-77d8-4375-9693-b49e65b53dd8", "comment": "Malware payload (Mirai)", "value": "1da919188cc542dc24c350de2b3caeccc98057a85931e510a2c640ae19a81bfb0d8f427b48184062f30e6cee852f5e7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280267, "uuid": "70991309-613c-4df9-a0bc-78c1323ba0ad", "value": "T1EF544913AB40C5B3E1430AF212AB5B201133E77B5A6BA547F7597CB09E185C5722AFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280267, "uuid": "862b061b-0c45-4fa3-88f3-4c5b1f6e067f", "value": "6144:lKps8lBotAN6ZuQU9S0DcuF3UgvcdQn5wGtwifIpmB6cDFSeZjgKGSNnMawCq79a:lss8lBFN6MQU9SScuOI5wGtwhmBjBSeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751280267, "uuid": "549c3c2c-281c-4869-a66a-266ce704f5df", "value": 299918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751280267, "uuid": "46262aca-81c4-40ee-ac72-f2bd20b468ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280267, "uuid": "38b2c53e-40ba-4286-8c6f-5ceb5fbc3023", "value": "i-5.8-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fa72f84-55b3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (NetSupport)", "timestamp": 1751288960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751288960, "uuid": "a940a5db-c3de-4e4c-86a0-e5441785f5da", "comment": "Malware payload (NetSupport)", "value": "290c26b1579fd3e48d60181a2d22a287", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751288960, "uuid": "1a7e098d-8ffa-4b93-9288-0d2e23c4223b", "comment": "Malware payload (NetSupport)", "value": "973836529b57815903444dd5d4b764e8730986b1bd87179552f249062ee26128", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751288960, "uuid": "ca3f1229-4026-4937-9e84-37cccc1b9113", "comment": "Malware payload (NetSupport)", "value": "e4c91a7f161783c68cf67250206047f23bd25a29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751288960, "uuid": "0617d043-6707-4273-857f-24b364464ace", "comment": "Malware payload (NetSupport)", "value": "2be77b4c508fe4884471a182ef6a5b5261447626bcc9d35b2b7645d67ca17a1fdaaf176dc7a5c00e174e0f06d4d33c59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751288960, "uuid": "217b3cab-0720-4055-8a30-d129f8092e6c", "value": "T14EF2D603A254A4A5D8944B30F493D2F2AD35FE01EF94468731E97DAF3F6B7A11B2114E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751288960, "uuid": "ce616df7-6ee8-4b75-ad44-95f21efab3bb", "value": "78ed70ebeb178ed1bae5921d2ed514bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751288960, "uuid": "7693438e-109c-4d9b-b67c-541c788d0e67", "value": "192:7SVVGg84ZVe9LQTsZ98A2QakMnCaJN8TvyowJL/8Qpkqs1I1jw+ebCfaFLrWn:7yIwamdkjy8bYJLu1SmbCShrWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751288960, "uuid": "d5ef3da5-03cd-4e87-9407-0110070ff8c0", "value": 34288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751288960, "uuid": "ab30c2e6-0f76-4897-aa87-d6427e20b289", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751288960, "uuid": "6bddc7f9-cdb0-43d4-a0c6-4255df80faaf", "value": "client32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea3c5f9-55ff-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751321681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751321681, "uuid": "8982f733-4d53-40ef-818c-910337086f24", "comment": "Malware payload (Mirai)", "value": "257027aac421dd24847e120f23ca64ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751321681, "uuid": "ec48bf0b-74b8-44a9-beaa-cfe0bcdaadf1", "comment": "Malware payload (Mirai)", "value": "974e2787d3f14be23413338484f9d1b2c23424209abf7bfa54138918ea661b05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751321681, "uuid": "48ef50f2-69cb-4cba-bd0b-7b5f9dfd65fd", "comment": "Malware payload (Mirai)", "value": "b5dcc70d9d72824f6c03a99f62d33c55bff553e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751321681, "uuid": "0e8acb86-0659-4619-ab0c-068127d639f9", "comment": "Malware payload (Mirai)", "value": "9ed54a63706872759e10cc5e346c2482002a721e035dfd482f95746e0309aaf9567dd3a9eb8a11add1545e080b75af7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751321681, "uuid": "52003cbb-3050-4f6a-b267-1135e53c38e8", "value": "T16F3329D6F405AD3CF95AEB7E84260A0BB230779545830B3763BEFD935D322A45D22D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751321681, "uuid": "5eff868d-ab17-4d16-a482-6caf354222ce", "value": "768:V6ePqfRt+mWH1ERV/AiqBM301VXBI7uuQoNxtaBwCr3NE8VOVi6:86qKms4KiqBiYIiuQItaB1r3O8ss6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751321681, "uuid": "a82588a8-9155-4015-aca5-060f23487465", "value": 52844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751321681, "uuid": "b44e6ffe-4b1a-4b02-86f3-222302976203", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751321681, "uuid": "8180cd78-0df9-4810-b8c7-851ca349b1bf", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11e3d4d0-55c5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751296534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751296534, "uuid": "7bc20446-5191-4609-8ff1-7a8dfc71a073", "comment": "Malware payload (Mirai)", "value": "9d0e26294b30e7e3d05ba302ebb0224e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751296534, "uuid": "1e1f30f1-cfd4-4629-bfe1-7473bcc569a0", "comment": "Malware payload (Mirai)", "value": "978e60b691d1629f6d31a1e8fee4db9c81bee88ed5c1fe30aaf275b2797b7330", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751296534, "uuid": "c568b7fd-1671-4ab0-ad66-3c8e1a1c03c9", "comment": "Malware payload (Mirai)", "value": "c3fc56727ea30f7a194ed0b8c0a2a2154f95babc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751296534, "uuid": "d4704dcd-0c26-4af1-9836-956d6ffb23de", "comment": "Malware payload (Mirai)", "value": "4855f1d96c5b6ad896ea97afe5a625fcea3d9ed5eada2b535d088d096fd3b85820107083909c5ec9a898083de21416a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751296534, "uuid": "9e80337c-0b31-40cf-ad2e-65917d7bfb43", "value": "T179B3E84E6F219F7CFBA8C63447B38B25965923D237E1D685D1ACD6001E7024E642FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751296534, "uuid": "57f04bcf-f022-446e-9ee8-c29b9b07af6c", "value": "1536:QMcexRXRB8huBmCElgZ1oszQOxJIsXL7sOkT0bes5L3zr/q49FkreH97vlr6G:SeThVgCEmIsXXsOkT4X3zr/q0FkKlrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751296534, "uuid": "a3492d11-2cb1-461e-a8ff-ad2e00d0bef2", "value": 109764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751296534, "uuid": "313dcf1c-55a8-4ec4-a775-83e5ca67d218", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751296534, "uuid": "953987fe-cafb-483d-b298-d05ddcf561c0", "value": "SecuriteInfo.com.Linux.Siggen.9999.12856.32416", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fbf363c-560d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1751327669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751327669, "uuid": "6562931d-b91a-449b-ba28-f1c61793c423", "comment": "Malware payload (Formbook)", "value": "e511cf19750eaf94e295fba52e3a57d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751327669, "uuid": "2d30b8d4-f6d8-451d-aa1c-e1c8f128b81f", "comment": "Malware payload (Formbook)", "value": "97f4f0e2a55bb2b533b09fee965737fb376e6259365c676d14af04ac8b38e823", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751327669, "uuid": "a388d8c9-b7b0-4f0e-90c4-8c44ed9bbe5c", "comment": "Malware payload (Formbook)", "value": "4274ab698d6b18ea1979b77e49cf86ed0ffa26f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751327669, "uuid": "0cadbdc0-1a6a-47ca-aa3b-9b9543a4385d", "comment": "Malware payload (Formbook)", "value": "bfc3dfce4d61e280e82e1fc7045c23b988207829aa891e48367f6e78d1e877c7234b668c1ddd541cbec7d7b2f85b557e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751327669, "uuid": "0d0842dd-483a-4494-a09d-9c90681a153e", "value": "T11F45CF1363DE8364C3B25273BA65B701BEBF782506B5F56B2FD8093DE820121525EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751327669, "uuid": "d2d70d18-c33e-42fb-9e87-807b7817de62", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751327669, "uuid": "214d0604-2f82-48e2-b212-540679a4cc91", "value": "24576:1tb20pkaCqT5TBWgNQ7a3wNMxiFHyjIHJiBIOWH6A:mVg5tQ7a3wNMxKy2MIOg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751327669, "uuid": "4525a3d6-b70c-42ac-888e-ba1c40ffc433", "value": 1211392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751327669, "uuid": "ba4c9044-63d7-4a44-9b52-3619bb85f7c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751327669, "uuid": "749c2f33-b747-4313-a130-afdca46dfae7", "value": "Swift_TT_USD17,500_Reciept.pdf (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "079d0ceb-554b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751244118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244118, "uuid": "32fc82e5-c73e-4533-ac74-80951eba85c0", "comment": "Malware payload (Mirai)", "value": "04a236a014449e85aea218773278eb8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244118, "uuid": "307c57ff-e173-4df6-af01-29cae8ac22f1", "comment": "Malware payload (Mirai)", "value": "9870ccd5d8355d5efeaeec0180b1e3fa9cb8f1d8993a2e52ccad1e04d903e272", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244118, "uuid": "ef900177-0293-4683-b7eb-f40aff60ee7f", "comment": "Malware payload (Mirai)", "value": "131784243a53326845c7eebda96e517fcb008059", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244118, "uuid": "789dfbd4-6ffc-4aa0-b661-eace80e9659f", "comment": "Malware payload (Mirai)", "value": "26cc9dbc562de2dd9ae57ab97e933694ad1c0ef90ef5d90bc0aad0b2f1c5555f600320ed72fb93b4af453ff9d3060ac3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244118, "uuid": "7f5dcd4b-e852-453e-9188-a4b2ceab2eef", "value": "T1B663FA96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244118, "uuid": "d5c7b79b-dd14-46f5-8143-3c844a89ca32", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlgr57uscvIGiojd70k7h:VqVMkWV8PPD9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751244118, "uuid": "748926af-a469-45b0-93b4-d1bd61e6c069", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751244118, "uuid": "3dabe32a-a606-4f19-be56-41a18d5a3f6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244118, "uuid": "cd11ad4a-6ccb-46fb-81ba-cdc4e2fc6a11", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "768df407-556a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751257619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257619, "uuid": "2d4a0b46-b2bd-40e3-a8e7-18b5a5ca891f", "comment": "Malware payload (Mirai)", "value": "ae0952282ef7202474b29cd8d8e2f44a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257619, "uuid": "2acd4ef5-1147-4caa-ab3e-daac041f20c6", "comment": "Malware payload (Mirai)", "value": "9892aa1cedc01466f2f5a606155e3589661350a2795f84593667ed2996415a76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257619, "uuid": "f706cfbe-f6cc-44ab-9b0f-26e8635b7fee", "comment": "Malware payload (Mirai)", "value": "1ac3e3f1895efd8e1b600ca014c40ebcbe90ddbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257619, "uuid": "0f7eb174-048e-40d7-9950-53136888bf90", "comment": "Malware payload (Mirai)", "value": "52948c1023b824a9981f0c2896f45da6569fbef974894053a9d1c85b0b98b7ff377162d24fc2be233e37aac63b882d84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257619, "uuid": "192a668c-6181-4f76-9ce3-b1e3ef1d76d6", "value": "T172F33B56FA418A13C0D61779FADF424633229B94D3D773069928AFF43F8279E0E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257619, "uuid": "4f730158-ad65-4f37-813c-e17412c496bc", "value": "3072:eEUUrv7g5alBCUS2c9O6N+d2v+1qc4CTjURM/9mL:eCvU5alBCUS2ck602WActTjKM/9mL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751257619, "uuid": "453b3ceb-6642-4517-a09f-7a9164dfbefe", "value": 162114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751257619, "uuid": "d404c0ba-e15c-4976-891f-fd18a018d499", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257619, "uuid": "367e444b-365b-406f-b1e8-8a75b16b293b", "value": "neon.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2c48f4b-556e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751259411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259411, "uuid": "d7945ef4-cf1f-4667-bab9-f13dc841f83a", "comment": "Malware payload", "value": "7aa5484d5820b8579d67c2011f64f1c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259411, "uuid": "f8845f52-f95f-4787-bc6f-422c72483a22", "comment": "Malware payload", "value": "989a5a2b409d5ab6e3947dc6d5d8e793edc225fd12f7da9d0f738d38f7251e43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259411, "uuid": "c3bb91a3-6929-46bb-a499-1d2f9eec29a7", "comment": "Malware payload", "value": "94e34d6686f464808b9fc491c0ef415f70ca98e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259411, "uuid": "18f41828-70af-4e71-b242-ec45522b4be8", "comment": "Malware payload", "value": "370d324aae6017bad180ccfe5cd5a51bd937ff8773f1bdd5567d471746ba4e903e24bdc88b0b6387fbf1fa8552b06e6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751259411, "uuid": "70fd8bb9-798f-494b-a7f4-408ddc54b53e", "value": "T143A41294E9819B62C2C801BFFF0F45BC77A31F69E1EA71068D16EB1662D745A4F7E800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751259411, "uuid": "1b790c98-0115-4207-9781-934f5a4e0940", "value": "12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751259411, "uuid": "60891209-71f4-4673-a592-514f0bcc25ed", "value": 480792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751259411, "uuid": "c3823049-a0d6-430c-aa7b-3fbec84222e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751259411, "uuid": "f81ebe3c-7857-4980-a38e-9630f94cd548", "value": "arm926t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0409e371-55b3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751288780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751288780, "uuid": "1de314e8-50b1-464e-9e19-58899cb36285", "comment": "Malware payload (Mirai)", "value": "43abda07608dc3889bba3a850ff596f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751288780, "uuid": "41f8dec5-9d0d-4d3a-9d9c-5c63745e6819", "comment": "Malware payload (Mirai)", "value": "98e69d51c5df1dedb633038b66868cf8587032410ab299639b77a69878bbff7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751288780, "uuid": "c6c25aa7-a0c9-4ad3-85c3-ca47a87b0a91", "comment": "Malware payload (Mirai)", "value": "48740f26bc43f32d01a854729d85d9abbd29ac90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751288780, "uuid": "41316c9a-d4e8-478d-8cc2-c5b7377a4869", "comment": "Malware payload (Mirai)", "value": "21ddd4fbbde270a1f8220329a5752cf98066f108f11e7e1fa7be2b0c626efa041016e581852dc670bbf01ad545411ee4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751288780, "uuid": "31bf5541-162c-4e05-a754-7a28786dd19f", "value": "T147B3AEDBF74720D1DC6286F407C74B9E2E632211DE5BE8E76C1E2A3A193A0DB5907391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751288780, "uuid": "bcfe0846-a6e6-419f-8bd4-ed4537e3812b", "value": "3072:uVEuC63I28v/vPZZBf5fq9Bo8CV/uYCgaq:uq/cIlX3ZZ/kg2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751288780, "uuid": "a3c3b65a-bf00-493b-9cf7-89da6ff327dd", "value": 116256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751288780, "uuid": "ebea222e-982f-472a-88b5-0257793f96c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751288780, "uuid": "ef079274-e6ac-45a8-bbc4-5168ff9d4a34", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea6238b-55d2-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751302246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302246, "uuid": "11f97fbf-125c-43c1-84be-e40919284ebc", "comment": "Malware payload", "value": "15b2197749e56323ed51070258f57517", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302246, "uuid": "ab2c065e-2027-4532-a402-790657358517", "comment": "Malware payload", "value": "994b2a2ff2e0e7f566abface821285ff547be04ede630183888aa6b8cedfe2af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302246, "uuid": "7c52e708-8b7a-47ff-b462-6ff6183fe9e4", "comment": "Malware payload", "value": "ecb062f8699743a3dffb6052b5e65d90477269ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302246, "uuid": "de627b47-30ff-4d37-bf2b-155cd4793b29", "comment": "Malware payload", "value": "423716d7d05417331612675019c5600d2026dd8666159b9cf616e730f43e25e1f7d12b006b2064341e09ad8497d51572", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751302246, "uuid": "21122f82-a930-46ed-8efb-a8169e6b8e0a", "value": "T131E412017F152032C9D21AF0A8B747B4EB914CD650B4D6777749EB222BF36362C8BB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751302246, "uuid": "90b50c6d-59bc-4feb-ae7a-3e785ddb34fb", "value": "12288:XeBWVNQiXY8aap1qXG2YmzwcyxDKsFM+t9j+9+X:uQQAYLapnLmzwhtLy+t9j+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751302246, "uuid": "9d7ea501-c4b0-45e0-82b8-19626f6d2ba9", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751302246, "uuid": "c399e961-8887-46e0-b04b-b9473541791b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751302246, "uuid": "2063025d-1b7e-4091-8d4e-487ead9ccf1f", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "168ad8ae-55de-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751307279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307279, "uuid": "5b9a8097-d5a1-41d0-b419-e53655eb653d", "comment": "Malware payload (Mirai)", "value": "b5ac7e755539d153024b35cc54a8a552", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307279, "uuid": "a5ab8241-bfe9-414e-906b-51661430e313", "comment": "Malware payload (Mirai)", "value": "994d3872166fd7b39d2c05628c86417140f456637e811f9235792c5b667947dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307279, "uuid": "14da5b07-5f14-4006-9d6a-29b2e301c860", "comment": "Malware payload (Mirai)", "value": "8656fec62645fe339fa51b8be278c9b52520684e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307279, "uuid": "74749218-577a-4610-8e0f-bb7dd2611e2b", "comment": "Malware payload (Mirai)", "value": "f834330d4a3793f7f76ba4086940284f27c51d662d0d7528287d0b0ef44fb0b2cdbfbd95ac7b97b19aad8e78eb28b4c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307279, "uuid": "0d6c98be-40d2-41e8-af82-dbcf836b87b9", "value": "T1DDF3AA1E6E228F7EF669873047F74E25976823D623E1D644E1ACC1146F2029E641FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307279, "uuid": "38ec1307-09e8-4c21-ba0d-aca0bffcc801", "value": "3072:MCsjdGqsGRLFHY9KDibnaNoJ5RGS2kbs1:MCsjQqsOoy6aovRTw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751307279, "uuid": "f5012a5a-71d8-497b-8889-e69203a59128", "value": 169644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751307279, "uuid": "3fc14660-b012-478a-bf0e-5510480d1821", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307279, "uuid": "11af0b6e-c28e-4345-8b37-f7d20e25a4af", "value": "cutemips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e87bd5-55cd-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751300265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300265, "uuid": "856331c8-70a8-4a17-95ec-48b21371aaf2", "comment": "Malware payload (Mirai)", "value": "422161c276cdf653d0b400ed17ef2ae6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300265, "uuid": "33047771-decb-4352-b222-3a37c102386d", "comment": "Malware payload (Mirai)", "value": "997e5bda037814e18527e2d744c92d25fcec712798254158bbd74fe50182d6d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300265, "uuid": "30d61e09-9b9a-464f-a477-aca42d8a7d9c", "comment": "Malware payload (Mirai)", "value": "5f5107fb09b6b75e45656663e6c49ea19fd4141e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300265, "uuid": "65cfd511-bfa0-4e2e-959d-be726fd53e92", "comment": "Malware payload (Mirai)", "value": "6579c93da1ebdec19d2d409740d6387369fa78904b1a3136910e58e1776cb38ea96867e8fe8ad24305a485ad3c3ecc5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300265, "uuid": "3ec849a7-63f6-4b7e-bdfa-d5abe29fe49e", "value": "T13204975E6E128F7DF668873447B78E25976833DA27E1D640E2ACC1101E6029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300265, "uuid": "3ddbe1bc-2a62-460e-9fea-360c4d36c1c3", "value": "3072:jKSy+fNpqgwfjW0IXoC2ncBKE+27EWssZiMpv13GQdA:jKSy+fNpqgwbW02oCkLu8sjp93GWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751300265, "uuid": "4fc18fda-ac29-4384-97e0-e5c61d025499", "value": 182136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751300265, "uuid": "d58407f7-e0b4-4759-88d2-fb9b6167a005", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300265, "uuid": "f5c8d478-6d5f-4e3c-9e19-8c537c3dfaac", "value": "cutemips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec027d6-55d2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1751302273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302273, "uuid": "31f30450-10f9-4aa1-a18b-5f8cf851d5b7", "comment": "Malware payload (RemcosRAT)", "value": "3baf9ad525f5caa5d07dcb14c563abb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302273, "uuid": "6e2dd051-c5f3-4cd6-baca-1b848dbfe90d", "comment": "Malware payload (RemcosRAT)", "value": "99816cd2de501f26cb3227491cf3bf407fba47ed12f8b925a993d7c822b031ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302273, "uuid": "0826efbd-da45-48ed-af6e-4a24340d2812", "comment": "Malware payload (RemcosRAT)", "value": "5a626e2c3df90014ff37764bfe2e5a51cad205b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302273, "uuid": "699b8e1f-b9bc-4370-bb8b-93558f7ef49e", "comment": "Malware payload (RemcosRAT)", "value": "611b22d1a68d2de89833fda1673419d720429e7db3bffac8364346fa6290c1ec34e95ef84647ef7e84ed786f0708a33f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751302273, "uuid": "947afaee-ea0a-44c5-8421-6de86dad98bb", "value": "T14C151326B61AE403E46A1BF90E51D17483794DCEE921E3978FD97CEB30E27112B81B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751302273, "uuid": "ea08ae05-a628-416e-b3eb-35ea3f76b5b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751302273, "uuid": "979e9a25-d0d7-4e41-9b1b-dea62f5ecb4e", "value": "24576:XPjuby9UtLFY8x1yBn35mbbWgynqAR0445WtjbK2:XPKby9UtLi8Y3fyVWtb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751302273, "uuid": "64d42094-f6f7-4c1c-81d2-c4242f845bc8", "value": 945152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751302273, "uuid": "f173539f-59d7-483b-bccb-867bd70f8864", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751302273, "uuid": "ee0a027c-98c7-4022-a06a-7d2d17e7fe79", "value": "Shipping-Document -Pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f11286d2-55a3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751282306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751282306, "uuid": "01e9a432-47fa-4a52-b167-6956720dec78", "comment": "Malware payload", "value": "ae2ef6a050d9e19e80a95dc40fa98840", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751282306, "uuid": "57077726-dd7f-4542-b4b6-fb4886bb3c82", "comment": "Malware payload", "value": "9a126ed1ec605af1c5fa60ec44a1a02916e4ddadd1c6096da7bf46c390e2eea1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751282306, "uuid": "79de0ae1-75c8-4301-9005-a0bd7ab71591", "comment": "Malware payload", "value": "7be8cf3bfd3c69e42585677a0c1409d9b1d85d6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751282306, "uuid": "2bd25e63-19c6-40f6-b13d-7e6737e59dcd", "comment": "Malware payload", "value": "b1da371d8389b4770cb2e71fecaf7a12f216283009ba9b027fbab6a77e83fc277cce1411ea3ba18403b9c59c3bb81e11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751282306, "uuid": "2d13d6b8-501f-49be-856d-e3d399ee15c3", "value": "T1C7C4F1A377204F91C35195B209F389335AF6199706F39982537DEE107F20A6C386BFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751282306, "uuid": "87c90eac-d3c6-4f15-8dee-291de8c7ef85", "value": "12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7zO:W7v+mrY2xzf03yvZ/YIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751282306, "uuid": "04feef8c-3ab7-40df-a9b7-e83a7d2f5ebd", "value": 592688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751282306, "uuid": "e978fd7d-ecee-4700-b759-f2705e37228d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751282306, "uuid": "86afd85d-dcc6-487b-a80b-b63cb05ffbff", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aad2aef-55c2-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751295421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751295421, "uuid": "8dca31f6-3cd1-4919-a80c-860382ded175", "comment": "Malware payload", "value": "cb986191a26ffea6999c976ea8425d28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751295421, "uuid": "21c40eff-8a46-4a3c-803b-8dcfd225aebf", "comment": "Malware payload", "value": "9a8633c059717c43a451660a24a240840f73e53c58f3d70ce9006a96e5fd4d6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751295421, "uuid": "b4b26a7f-e7d0-458d-b014-745baab510a1", "comment": "Malware payload", "value": "d40541c1b91d956721f92ab234367edcd3c5b65d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751295421, "uuid": "7586461a-b849-4ba5-9cfb-8128bd5deb57", "comment": "Malware payload", "value": "141c83c23d523616f550347cad1bc0692cf1a72236b8e13811e2d9632734ad85dedffebf01e142fff6006eaa9c9e7b81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751295421, "uuid": "76bc5a69-a515-4cea-80ac-e6b37d997664", "value": "T185F54A87FC9265A7D0AAF33189629592BA607C487F3123D32A50FF2C2E72BD06D75714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751295421, "uuid": "9f592280-df2a-4ffc-ab3f-81eb4bbde274", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751295421, "uuid": "088124a2-41b1-4a36-9f5e-2bc59765cded", "value": "49152:y6sAEfJKIN65kq4xowkz/VJ23RiZbTbME2h5E:y5EbnIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751295421, "uuid": "0cfac418-f9ca-48e3-8c88-288c09d3e733", "value": 3336704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751295421, "uuid": "d989a7fb-f93f-4bb9-bad4-d2279ba698ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751295421, "uuid": "694c8502-3057-4f9c-828a-a5c2bbfd3413", "value": "Trash.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "975ba208-55ce-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751300623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300623, "uuid": "cee7b50f-b28e-470e-a391-a0b459f6a4bd", "comment": "Malware payload", "value": "6997c410637d66d65ee58fbf6f03d28d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300623, "uuid": "442454d4-64c6-4ee2-be24-65e3056ea22e", "comment": "Malware payload", "value": "9b5e06356b67c363f1d3126968dc5a0de169407cda7227603ab6ac495a1b3c27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300623, "uuid": "a6875d70-290f-4f58-b02e-a25113c97da8", "comment": "Malware payload", "value": "2406a96c4bfb87d29f8bafd8f37ab37c56b25db0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300623, "uuid": "fe0194ad-8184-4d4b-b754-1c416b11ae3b", "comment": "Malware payload", "value": "b1f8ee7de825a52718743c64eb782143f7cdc00c14ec8cda90d1a100eca1e8f8d0d2f66c7b9dff7b60a30ac7fa2aaa5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300623, "uuid": "e9518a87-2db5-43c9-a6ef-d76fdcd8f0e0", "value": "T1C6E412017F152032C9D21AF0A8B747B4EB914CD650B4D6777749EB222BF36362C8BB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300623, "uuid": "b3339432-0f00-46d7-bec8-625fd0e48464", "value": "12288:XeBWVNQiXY8aap1qXG2YmzwcyxDKsFM+t9j+9+X:uQQAYLapnLmzwhtLy+t9j+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751300623, "uuid": "d7604ac4-edf3-4e25-889b-4ee5510e4416", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751300623, "uuid": "ded45686-3e1a-4761-85ae-663c447c473c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300623, "uuid": "68e43547-5323-4283-a368-3579df262534", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a681d3-55dd-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751306872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306872, "uuid": "47169aee-aed0-4072-a310-e30cb6adcda6", "comment": "Malware payload", "value": "8186c6d94b97062bd0272a2e9280a8af", "object_relation": "md5", "Tag": [ { "name": "ai", "colour": "#8C207A", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Shopping Mall", "colour": "#B4F31F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306872, "uuid": "9ec45599-5ea6-4018-8d31-16692fcab98e", "comment": "Malware payload", "value": "9b93951c9ace3818aa1fdd593d7c7be2a23a1fd5647dc1906f6ab57b90d76493", "object_relation": "sha256", "Tag": [ { "name": "ai", "colour": "#8C207A", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Shopping Mall", "colour": "#B4F31F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306872, "uuid": "ed20ee96-5b8e-40c1-adf5-d8eee6eeaf75", "comment": "Malware payload", "value": "4249b7a9e288f75dd228b197b191a10f2ed7a101", "object_relation": "sha1", "Tag": [ { "name": "ai", "colour": "#8C207A", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Shopping Mall", "colour": "#B4F31F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306872, "uuid": "ae8f8f8e-183e-4c15-96a8-8111128a89d0", "comment": "Malware payload", "value": "b15ebf39d3751e5988358b466feae9856b5ecb1c52c09243bfcc5a4adfc69b7e8a46ff5132f8aaf3ea6130701b8e913e", "object_relation": "sha3-384", "Tag": [ { "name": "ai", "colour": "#8C207A", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Shopping Mall", "colour": "#B4F31F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306872, "uuid": "51f5dd50-240c-433e-9a3c-c74694f004bc", "value": "T1C1C5C09AFB09D86AD0E7D632867647265517CC668B43D2834E29F53C0CB7DC09B86ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306872, "uuid": "b573a00d-a731-46ad-a54d-68675b0c0894", "value": "49152:rK/mw3FVvaBcQ140lvwu5bZoeLEgLpX4AXr0Ag7k6oEjc0R:bw3bwsib+eLEWj87kxEjc0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751306872, "uuid": "842fab6b-b41e-471c-9812-96d5a345ec2c", "value": 2729522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751306872, "uuid": "1a181997-3e5a-463f-8063-405b37d92cb2", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306872, "uuid": "f3668864-1557-436b-8353-3d38594c75a7", "value": "swt.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355e3a82-55d3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751302607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302607, "uuid": "533726f9-578c-4f19-a435-e94fc6fea033", "comment": "Malware payload", "value": "7eca7ac83b45425d55501bc4e00e12d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302607, "uuid": "7cd257ab-6f86-4997-8a66-3e7908fae7ee", "comment": "Malware payload", "value": "9b97d79f112092ef8ed13dd5fc4c553e0769f8c4857bc6ccb349a76f191f1e39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302607, "uuid": "76e1b756-e7e6-4a7e-9835-686ba37110d2", "comment": "Malware payload", "value": "64a120c6fa5aaa828e6610dc69541ed697f51b26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302607, "uuid": "1c7887f5-27c7-46c0-8363-90929b282682", "comment": "Malware payload", "value": "2b5983d91654b62705ad8dfeaa4744b36f687f14c076d12c7bf93f408b2d06e6c755659a9f09f92724a5beacbb4962de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751302607, "uuid": "d528eb55-1307-48d8-ab4e-1e0a5fae9c0f", "value": "T1F5B402118F881F87C5AFCD750A2E167311AEDD9F46CAA43E807CDD48B6A6D0D6783C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751302607, "uuid": "c3612987-13e6-4053-b433-f37e25547479", "value": "12288:7A84JF9Qc8GgZxTM6m1U3snB6NnVuqnAtSyBpywBdlEykR6LkV6N0L8AXwtZJHZz:/M6m1U3rVuqAtSySwY1gEIZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751302607, "uuid": "33777b86-d528-4912-9e05-da57c3522b50", "value": 509272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751302607, "uuid": "b0ec16b5-f7fb-4277-801d-fc6097f1ef2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751302607, "uuid": "3894fcd5-5533-4b0f-9584-1e570f81e8ff", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da13d98-55d5-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751303506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303506, "uuid": "9665b711-3295-4e6a-a7a9-36dd5f64f242", "comment": "Malware payload", "value": "ff4f813d36ee70b11d9ae767a61a3c5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303506, "uuid": "1b1147ed-6e07-4bc4-b238-0250b30b7b92", "comment": "Malware payload", "value": "9ca0d511c7c8b3b5b2b84992192ce1eec53e7821439f9ca7a7d9191507cc4032", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303506, "uuid": "cf85ec74-59eb-41da-ac18-4acbbdd20a04", "comment": "Malware payload", "value": "89a2ae9ba5672d7908f3076b5a628f716efa384d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303506, "uuid": "6b2a9d7a-c85a-4cf2-b6c2-9e5cd060f0a0", "comment": "Malware payload", "value": "cd0582b607fb7a6a9ce54f7063e91a769304ce84dad98cff0ceb95e171258aa3ba241a0ac156072305871d05762a9e04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751303506, "uuid": "6920bb6a-d24f-41b1-9cb6-db36018e2029", "value": "T178B402018F881F87C5AFCD750A2E167311AEDD9F46CA653E807CDD48B6A6D0D6783C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751303506, "uuid": "2eed0a8d-bef3-4aff-a30e-5eccd56674b8", "value": "12288:7A84JF9Qc8GgZxTM6m1U3snB6NnVuqnAtSyBpywBdlEykR6LkV6N0L8AXwtZJHZz:/M6m1U3rVuqAtSySwY1gEIZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751303506, "uuid": "2f5923ac-02b2-499d-84a0-2d9f49eb3dc7", "value": 509272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751303506, "uuid": "41c56305-8584-4fe5-ad20-1f87e7afccb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751303506, "uuid": "c0de64a2-5765-4c42-b7bc-82b02cc5d974", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2667c42c-5607-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751324915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324915, "uuid": "263082b7-914f-47ef-831c-383cf4bc162e", "comment": "Malware payload", "value": "813fa2248a352ae774c5f3bef8d8c1b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324915, "uuid": "c971b7d8-c2de-4674-b757-1aadf5900f3a", "comment": "Malware payload", "value": "9fe40869adc8c29864a722f81cb1aecfb5b28b7163145dea64ec6c09ffe6e74d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324915, "uuid": "1a93de64-0a06-4d46-9162-ff53f8dc3999", "comment": "Malware payload", "value": "f19349815b107611be22b477ec2a1d1fbfbc23a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324915, "uuid": "4300952b-289e-46aa-a45e-509608c7c8ed", "comment": "Malware payload", "value": "b36d5ac7b220ca283f72d3deaa5937da69f481e3d35128b3e0d709e6875e12b4843c93edf963954b13ad92ad07ee5f99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324915, "uuid": "bf56fc6c-f857-4fe0-b686-2ac6578967a2", "value": "T127E412017F152032C9D21AF0A8B747B4EB914CD650B4D6777749EB222BF36362C8BB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324915, "uuid": "7b6eccae-5dd0-476f-928c-9cf2cc2849af", "value": "12288:XeBWVNQiXY8aap1qXG2YmzwcyxDKsFM+t9j+9+X:uQQAYLapnLmzwhtLy+t9j+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751324915, "uuid": "bcba9300-7869-4c1b-815e-df8cc44ad2e0", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751324915, "uuid": "e0aed88e-8332-4453-8e0c-465f1af6934b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324915, "uuid": "e3a40b56-ac21-44bd-8b25-2fbee0ace3e5", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ac0c4e4-55cd-11f0-8bd0-42010a9c0005", "comment": "Malware payload (GuLoader)", "timestamp": 1751300039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300039, "uuid": "5293e128-cfa8-4aa1-a084-19beec61a158", "comment": "Malware payload (GuLoader)", "value": "d20da57cffb5bf3434a153f4506b5275", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300039, "uuid": "a15a0c91-6447-4094-bcbf-1f76d3fa8772", "comment": "Malware payload (GuLoader)", "value": "a1f0b37870fac33401d6e0d55d405fcb1b36bd36d999be484bdf7126ba1355a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300039, "uuid": "147104f4-65c5-42a9-8a32-77fd7025e31b", "comment": "Malware payload (GuLoader)", "value": "61585ace0bc963731bd152203552783c7cc9a473", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300039, "uuid": "04651ebd-bb64-4b5e-9ca5-81d7d0efabeb", "comment": "Malware payload (GuLoader)", "value": "2dfd6f7790e0010edd53a9261e3c75deeb24b1a5e7ae9fd7f95f78f7033f4072f7cfbbe3970af4d35d7903b87a573a0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300039, "uuid": "a7a85f50-750b-4cc0-b98d-2bd62b1eba52", "value": "T137350243BE30D5F0E92B47B529B719661BA57D3EC02D6202ADE4B11E5BF36230127D8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300039, "uuid": "85255e7d-727a-427c-baf8-4038d5f08433", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300039, "uuid": "74fd844b-d2cf-41cb-9563-a0735f6bb965", "value": "24576:Ktsj746lTuzapA3cpivF22qDjpF4j79s1d:KtwzZ5pROF22Ijpqu1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751300039, "uuid": "7327d9b4-edec-4fed-ad49-2bd8e7a435cb", "value": 1102483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751300039, "uuid": "b8fc2ba0-93aa-4bed-8ee7-ec1f7019dfa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300039, "uuid": "e91c8c86-7c45-4635-be6f-bd281e879c96", "value": "comprobante de pago_0199210023bbva_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5427e13e-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751291062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291062, "uuid": "324a772c-8977-4365-a278-9906e8ad0ee5", "comment": "Malware payload (Mirai)", "value": "a9f4786b677f50666f9dee7acce8989e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291062, "uuid": "950df182-5005-40b2-b4c9-93e42cdee0a0", "comment": "Malware payload (Mirai)", "value": "a21d11b5df65ddcb39b54c08df3442e1139c1f988334d64739a87ae7ca2f23cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291062, "uuid": "08864c78-89eb-40b0-8f57-623e3df80d79", "comment": "Malware payload (Mirai)", "value": "497f823cf7f8aebe37588781e95f3d4f8dc00f0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291062, "uuid": "54b5a89e-29aa-4746-89ef-c76c89a74c85", "comment": "Malware payload (Mirai)", "value": "0dc28c82863b588eef7db1c77094a94f5c23abf98e2b1a896335ac12ba3b6515832c403645617a957cde87132ed692ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291062, "uuid": "04e04a2b-ca7a-469c-bbd8-102b064039d7", "value": "T1E9439E63C828ADC4D6984275BD298D781B33D10252673EF3AB9A89568043FECF50B3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291062, "uuid": "d0a69fde-aa61-44a7-bb0c-8259e219e963", "value": "768:fCcLGtHS5YFdFsvwtdZcIrN8T6hwNO/qDOoS4HJyehAYiFcRg9a1bL2icoyBlCg8:fCcLG1mKsvwtd8uhw8/f4iatGlCg4N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291062, "uuid": "3e6a16be-cb66-4e1b-a94b-5d2c24535ca6", "value": 56632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291062, "uuid": "82defc5c-69f0-416a-94f0-587b2f994945", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291062, "uuid": "0a9dec2f-e3cc-49ae-8837-8d4dc592a6be", "value": "mirai.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a935d8-55a2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751281753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281753, "uuid": "eae48bd5-1358-450c-a6e1-4e6842ac840b", "comment": "Malware payload (Mirai)", "value": "086d680ae7e928980d4425cb78939328", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281753, "uuid": "5dc3a748-2a92-40d6-84d4-bc812747bf4d", "comment": "Malware payload (Mirai)", "value": "a2255b96ffebe6f6b85dd31ea30f1cc51094ca6d3cc7b0f852c17d13ac29d23d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281753, "uuid": "b1ceb07e-3b49-4880-b658-b738ef6e71b3", "comment": "Malware payload (Mirai)", "value": "a40df81b0a4bf5a0b72c116efb9c5463091dcc58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281753, "uuid": "7dae5400-39da-4d4d-8e8b-69176c5d7424", "comment": "Malware payload (Mirai)", "value": "e5eac8455459ef633c512f078f7afb8a58658ca6cb0fc394ecffd75fcb8267e585b02cdf19a84ffe35de7e50bcd6a3df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281753, "uuid": "132fc05f-a3bf-48b6-b40f-571349c21e87", "value": "T143743947AB1C0643E0970DF1297F73F087DEE67114E621C2B92EEA8057B3A761226F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281753, "uuid": "969aa43f-fc05-47ed-aaef-312caada0762", "value": "6144:yw62uKgKBFOvaoJxK/JedmdUCHF5w+twifIOjVtEauaSojUmLGR92Tnwgq7ngslY:jqKgKBBosCUF5w+twCVtEahSojUmLGRS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751281753, "uuid": "0a6a32f7-727d-456b-b1fb-41b3530ac070", "value": 352626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751281753, "uuid": "46b44250-1894-4b50-a2fc-b1a68d269a31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281753, "uuid": "8b1ee9a3-1c43-4442-b80c-887c773bb7fd", "value": "p-p.c-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ec257f-55a2-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751281752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281752, "uuid": "afdd0d53-fbdd-4ecc-a17e-25971a11ef63", "comment": "Malware payload", "value": "c81784f7350cd07a15c3c4a6c7485ece", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281752, "uuid": "fe1ebc86-0ae3-4440-823a-c33e2b53b964", "comment": "Malware payload", "value": "a23b3c3598506abbe406e272e91696be8bc993e730b832d160af272aba4a4312", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281752, "uuid": "4ad31928-8206-4ebe-b042-a1912bddd476", "comment": "Malware payload", "value": "985b82dc3b975d5ce377ee94fdbabed44a1e8adc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281752, "uuid": "069c1f6c-2d9b-4672-8b54-b54d4fe16ac0", "comment": "Malware payload", "value": "22d3057566428611a7b143bc3fdbab77b0dc321efe0b0a291e07ec8428c44564139bba61588894a18ba0d9840374dd5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281752, "uuid": "ca9e81ac-fb81-439a-8e9e-a66c6ff6d534", "value": "T193B41228EE4E38C1F3D1E3B8DA0A4BB1B05B79D0D166C1B2BA41E25D95EDDDEC5D0212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281752, "uuid": "c41b63bb-4bd6-4329-8aa3-af39d59c8a79", "value": "6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751281752, "uuid": "5384e649-f673-4d48-8a83-9d5d48f6447b", "value": 509896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751281752, "uuid": "4242995b-97f5-4ab9-8394-2cb468bc062b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281752, "uuid": "e9f63d62-57f3-4dd9-b344-8bab1758fd20", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "309eea0a-559e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1751279835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279835, "uuid": "52b90cf6-717a-46eb-a2fa-c52fb64609ba", "comment": "Malware payload (AgentTesla)", "value": "e9e0ed428cd28b27dc0afa29e2989176", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279835, "uuid": "e4fff052-d8b7-43fc-8427-b0903829e6c3", "comment": "Malware payload (AgentTesla)", "value": "a339a8c445223c097c2e5a49387bcad5f07596cdae7570d67a2b8451f5131f07", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279835, "uuid": "5070aaa1-281d-44f0-a356-769f0c4d868a", "comment": "Malware payload (AgentTesla)", "value": "21513e406bef088159bf75c8ffebd3c9355b2f19", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279835, "uuid": "651c97f3-666d-42a9-a1b3-483041216582", "comment": "Malware payload (AgentTesla)", "value": "502c602302e1384fa8308aeb956cc4210368043a88a480c43a3b19ad9d126c65596cc3a6677ceed62e9e1130f0091f7b", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279835, "uuid": "8473f806-d317-4d71-8fe9-eaaf52fbaa09", "value": "T12B1412C53191BEFFB1A8E1EEA744E1706F4E38CA10B50761CA676806D60EBDC05F96C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279835, "uuid": "4bf26e46-9dbd-4f2c-99ab-47a2863af234", "value": "3072:j8QNlChXwpQcEFGhcYMbhAjqBuDEoP7zFr8rx6tZms0y7wso9KTWBkr0GpgceMhu:YoChgpQFYcV1AjkuwoP7zJZmsPUl9gWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751279835, "uuid": "2d96a8d7-1f4b-4b93-94e6-011ee11f01c1", "value": 192548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751279835, "uuid": "da1cd1c4-9505-4e08-ac0d-adbd3011a302", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279835, "uuid": "0d93971d-1fd0-4d6f-93c8-3004d46cc771", "value": "FORECAST_PO 4534213017_4534213019 (2).7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59028f58-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751243825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243825, "uuid": "b8b1e458-ea04-4e81-9b62-7fbf189d7407", "comment": "Malware payload (Mirai)", "value": "09eb6704e30d897f4a4284330df70fec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243825, "uuid": "030ef1c4-4292-4c35-9403-7f6de37a2313", "comment": "Malware payload (Mirai)", "value": "a33a5795b9de6d0c3dd87427110f7a3d348dfe1812bed4da6a5b13d6bc9d92b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243825, "uuid": "a7be47f1-cbaa-4832-9b8f-bf606edcc390", "comment": "Malware payload (Mirai)", "value": "f513a4e1c28225afbe7fa9b97090540679cfbc4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243825, "uuid": "a5a7ac89-43ba-471f-a4b7-a5417f020cf3", "comment": "Malware payload (Mirai)", "value": "b11b84b1b86f5a5e8996d1f3e573168244d8023a1bdb861df110b1b0fb766577073762374f169f1d8a875a0659dc78cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243825, "uuid": "3355f424-9942-4671-abbd-e1bc61f07e71", "value": "T163A2D029E345AEF4DFAF9DA452C1C3C2B6F547C72786C8F240EEAF016506042BB88C49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243825, "uuid": "ed3661f4-e379-415b-a720-5b2ab71957cc", "value": "384:m/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5P5KM4uVcqgw05VxJA:mRxsSVsMD6xiJJE5zRWNTR4uVcqgw09a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243825, "uuid": "949e75d4-38fb-4d42-a535-3cecd79401d9", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243825, "uuid": "02e51f74-bdcc-459e-9c0b-a4944d77d5ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243825, "uuid": "5eba90ef-cd40-4138-b519-ad34e8f45c65", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b23b139e-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751291220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291220, "uuid": "b7f7628d-980c-4ca2-8219-8694d61849d6", "comment": "Malware payload (Mirai)", "value": "5f70c309d95bf74dd2cedd273a5499e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291220, "uuid": "3d2abe23-5d6c-4d31-ab52-4e8ca186792c", "comment": "Malware payload (Mirai)", "value": "a3b81126b1e4599d3615b114d59e22f8ace4bd09bf0e4675a434d7a7bd4ad16f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291220, "uuid": "c3105a73-8865-4924-bbe6-94966ff156c9", "comment": "Malware payload (Mirai)", "value": "f9c5e18bdcd927fd598321480e40183a3e3c9805", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291220, "uuid": "05482941-4ee5-48d4-823f-c4a3ebbe4e7d", "comment": "Malware payload (Mirai)", "value": "573f40e54734beda7f703cad37f5a24996757302b1264a50dc6feeceb55187bf40561002d1922516fc428f0352ce041c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291220, "uuid": "8a739fc1-41ce-441f-9fdf-598e3252fdaa", "value": "T123B38C9BFB0B5190C8658AF04BC74BED3E2332119F27C8E76C0E693D49B55DB4A067A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291220, "uuid": "11d81dda-18ca-45b1-8721-85aa4245d41c", "value": "1536:2I1/PyH90U3DYBj060FyPMuoj3kkra/21TxKBgR/LWy:2I1iH9vDYx07F81ojdO/21TxKBgRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291220, "uuid": "2a4ed522-3f71-45c7-b796-9966c3d6430a", "value": 107628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291220, "uuid": "a78904ce-47ff-442a-a342-5b146899e9f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291220, "uuid": "335fddb3-753e-4175-8764-257e73fe3e0b", "value": "miraint.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3459537a-55fe-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1751321073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751321073, "uuid": "f0267aff-0258-4d16-823d-5b32de182e60", "comment": "Malware payload (Formbook)", "value": "7eaacd85edc4ebbecdd0d1db6930812e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751321073, "uuid": "6e50db48-8cd1-4981-8e2f-411aafc5b710", "comment": "Malware payload (Formbook)", "value": "a418768b09c08393f81956454075056f42e965a5badca40ad2c0c61f1410bbfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751321073, "uuid": "06dad9d9-3250-4368-8897-5ef749182d5b", "comment": "Malware payload (Formbook)", "value": "adacf0694fb0514c801aaefdf89102283320c00b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751321073, "uuid": "7ef95459-0efe-4f22-aa13-d19c8a591470", "comment": "Malware payload (Formbook)", "value": "1ed3ff0e188fa5fc5d1bfba6e5dce2a7f14e4d50d0a31a363075eef7e22281c1619bf0e1c0b671361c82ffa9a0e05296", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751321073, "uuid": "707d3247-9771-429c-aae2-07dac4d60a21", "value": "T164F4135A3A69D813C8AB0BF00E22D2B413F95DDDA412E3938ED53EEF75E1B1119417A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751321073, "uuid": "a198a977-f3e5-4108-a54c-5039bfb47a91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751321073, "uuid": "d072b152-19f8-4493-b3a0-f8104f2e0622", "value": "12288:n+7lCkJL7mR/ofriQGi8Jzr5pK93FhsOpaKQF6tPb0tPzrhxY+qPBorEwSNenVT/:slCZbQoX8X5aV6tPb0tfhxY+QDgT/ijb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751321073, "uuid": "1a9b06eb-1cf4-4d83-86ac-bbf2ca195c03", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751321073, "uuid": "f48cb38b-6405-490d-b89f-da5c3b54e121", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751321073, "uuid": "9315720f-c80e-4b7a-bd99-32d98da7858f", "value": "Import Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a28ae3-5568-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751256651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751256651, "uuid": "4a4c1eb7-d2f5-46c3-8a49-b84e7bf7be76", "comment": "Malware payload (Mirai)", "value": "32ae4422cc32827f06e1cb8d3e47d556", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751256651, "uuid": "862379ca-2149-49bc-ae3a-9482c5d3ac35", "comment": "Malware payload (Mirai)", "value": "a47012567e4ef274f837186c0cb1bdc9df87529d16b0932521da38bd7dc4e76a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751256651, "uuid": "30404ff6-48f7-41ca-82fb-e5781836eb1e", "comment": "Malware payload (Mirai)", "value": "95d32b50d7210544aae8f54dea6fc7e2127aa041", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751256651, "uuid": "db278c66-41d0-4b8a-97a7-615abfc680ec", "comment": "Malware payload (Mirai)", "value": "4709fe56ad56f9e97acadf97c402d5ccec62ce3f5aeea078020a43b52a3bf4d2d793f325ff5d29c2480862ebd360cee8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751256651, "uuid": "31937898-b8f3-4405-92ad-68055411765d", "value": "T13BE32984F8518F27C5D612BBFB5E428D3B2A17A8D3EE720399256F31378686B0D3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751256651, "uuid": "fb2cc507-1bb3-4957-a033-33cb43e977a1", "value": "1536:D+24Ec3E/QteDeCpt1icXIVLQV2mpB4V1n3O7BZlyFQ3HecLbrlSEwywPNhdOp8q:D+24EWE//y8/iBQV34L3O1Zlp+yys3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751256651, "uuid": "03e2b23d-a344-412c-a0f3-f77e33e2566d", "value": 146944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751256651, "uuid": "1c79628c-3457-43f9-8fc0-72c90615cc0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751256651, "uuid": "6eb4666e-314c-4093-bfea-7d7eab055fdf", "value": "neon.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f14a14-556e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751259287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259287, "uuid": "36f5cc12-5ef0-47f8-b098-b2cb0e741da4", "comment": "Malware payload", "value": "651861c29eb52fad910bd816c7c9e22a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259287, "uuid": "621a3b85-a968-40c2-93b3-a7797c0fe9ef", "comment": "Malware payload", "value": "a4888212cce14ea90ce45162d05f8a4ec3c9944ebfdca13689fdf0785b434786", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259287, "uuid": "457cfaf7-0129-44b6-b097-c95ffb3fddd1", "comment": "Malware payload", "value": "2f8e06c1e68d5dc6c7e57535ce055d9aea45b149", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259287, "uuid": "f0dd9871-a07b-4c55-a936-4e09b3b1ae09", "comment": "Malware payload", "value": "504152fbfbcf3d5e37c43fee62e140b0caafce5a50d313109ed063e19d7a5f9a42fd8fa2277cf69760965b4d8f26ebfe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751259287, "uuid": "64108d93-8126-4994-b29c-a0b4b3587af2", "value": "T1E9E4F1037308A756DF4BA83A82CBFD31B7C2799113D096667A80E29F8775726CF0D649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751259287, "uuid": "504ffb22-cc8d-41e8-be73-d9addc3d3ed8", "value": "12288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751259287, "uuid": "d60353a2-4762-4cdc-a8c1-2f10b2f897bf", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751259287, "uuid": "0151fa94-f1c5-45ae-9f0c-b05e919f500d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751259287, "uuid": "b60e9022-05ff-4716-b5ce-12df1701d1a9", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e25630d-5580-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1751266973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266973, "uuid": "6f64e8ae-39be-48b9-82e6-4f0dc9bcc3b6", "comment": "Malware payload (Formbook)", "value": "949578bf75b51ff113912cfab48a7c33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266973, "uuid": "88b77d95-f66f-4c69-91c6-918700e84632", "comment": "Malware payload (Formbook)", "value": "a4d6f16f387d6dabef8b21409f48221e848ce27b222018761e0757e42b50e4ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266973, "uuid": "11337132-7bad-4de7-a30a-97533f014c1e", "comment": "Malware payload (Formbook)", "value": "ca6327fef48dfe042df9906fa8f5254da5b93404", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266973, "uuid": "57b51fdc-11ef-4f74-a2a6-66efabc7f556", "comment": "Malware payload (Formbook)", "value": "047899ab4008cb9403b6f96f8e9f902d883c8f583bb30c2676f1cd4b0086696edf74fb749a841090e83ee4c29f1b28d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266973, "uuid": "c4d71bf0-c0ed-4125-ad12-747db423edec", "value": "T1250623059EF98947D5BB27B5D8B7BB20ADB0F8DAB2A1E70F444494F90C02709BE50376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266973, "uuid": "2ca2c51b-9fe3-419d-a44c-fe45b095f65b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266973, "uuid": "6406154d-d938-4b5e-bb32-f9e1f0d3d2fa", "value": "49152:5lis442dNFQG3ThQqZVSZvT9rMwooJDvhxR5oV7rzMjVsQKSA+Wr:KsncmG3lQqsT9rMw5HxR5o+VsOAbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751266973, "uuid": "287c42d6-1b2b-445d-8df0-0af2abe184ac", "value": 3710976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751266973, "uuid": "3219808d-24e6-4ff4-88d3-cd0b254f20bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266973, "uuid": "d6e0ed3d-ead5-4744-b457-8bce8858843b", "value": "FT23194060101821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "238e7d0f-558b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751271653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271653, "uuid": "e38f3555-0d6a-40f5-b07b-80a80906ed57", "comment": "Malware payload (Mirai)", "value": "81a3013c8bbc73f75e40120cdf10d1a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271653, "uuid": "3f16678c-6d07-4a38-b073-8cd434052d49", "comment": "Malware payload (Mirai)", "value": "a4f73ce8e7637e1724e9da6024dc1245027fa5d07d72467764dd9a48a6897c5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271653, "uuid": "bacf68fa-ae9d-4b68-89b4-f66ee2671e52", "comment": "Malware payload (Mirai)", "value": "113a1bbebb41a74b785c04daa584b681173618a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271653, "uuid": "a935d596-7703-47c6-8549-5080c99380c0", "comment": "Malware payload (Mirai)", "value": "9b88cf7f7a47cd9ff35cabb13899358c9cacebddd3d0676e3aa6c44b6c233106a8cf9e9a31d470d89890202f293b9a40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271653, "uuid": "c77aa572-5c41-4628-a192-f8fb309c7289", "value": "T1BCC31A56DB808B13C0D61B75BBDF421533239B6497AB23069928BFF43F827AD4E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271653, "uuid": "476f5c0d-59b1-4bf6-b7fa-064a5971a3ea", "value": "3072:SJtV9Q0rlaJw2mQFmgfy17gaFiK1mzM/9sq/2X:ydDrlaJw2mQFjfOhFiK1SM/9squX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751271653, "uuid": "64f34b05-0f66-40c2-8767-ef688ef6f808", "value": 127887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751271653, "uuid": "888ac28f-f0d6-496b-b218-5c55543e7c85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271653, "uuid": "b9219609-09af-4314-b03c-c994e10a3914", "value": "cutearm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a1dd24e-558b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751271664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271664, "uuid": "7cdca893-1016-4278-bed0-9d34df0b452a", "comment": "Malware payload (Mirai)", "value": "de5ad15d597abde4739b5d8e00697c75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271664, "uuid": "0db294d2-3ea4-437d-b2ad-a3f41b048a0c", "comment": "Malware payload (Mirai)", "value": "a5a287977196d0e0b965a1e8bb26b6325691931fd57371f2e7b00a04d33ce309", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271664, "uuid": "a5afc5da-5c4c-405a-81ad-1d41d12bdf8b", "comment": "Malware payload (Mirai)", "value": "410be752cb3b06f851f700cbb382bcab3cc90bd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271664, "uuid": "bed3efe4-905a-4294-9d95-2f4518511f1f", "comment": "Malware payload (Mirai)", "value": "ef4b946cdb5672ed0f832aefd7e65317800ac6ce3027e0e23ce313d4ffe070db4611454ec64b318b474409171785414e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271664, "uuid": "5a257802-d8bf-4750-b975-743b78cc84a7", "value": "T170735ACDB683D0F6F96701B2903BE7768B33E13A501ADA52C31D9932DC62951972B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271664, "uuid": "38b503b7-8d57-4d5a-afb2-9afe4ecc6bf8", "value": "1536:FdQP3k8v0OsrTg6ThacuRirMHHvK4lDgRSschSG:FdQP3k8v0OsrTgkEpErKvKV4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751271664, "uuid": "4c0bdd2e-4416-4b27-b66b-9770a50d274a", "value": 75748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751271664, "uuid": "7989f357-0dcf-4c52-9d3e-b83c4f46a78c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271664, "uuid": "e8b79e77-c29d-4907-be3d-64af88473897", "value": "cutex86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "848dc346-55d1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751301880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301880, "uuid": "d5d60d3b-9069-4662-b8ca-f5189b8a9467", "comment": "Malware payload (Mirai)", "value": "271f3228fd22aedce864aaf0bc64109d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301880, "uuid": "e140df81-3bab-406f-87f7-589333790e44", "comment": "Malware payload (Mirai)", "value": "a6880d908d5fa479ce234db7beed1598d5c8e9304696d3af7dc8cfee07a55e7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301880, "uuid": "e09c7af0-93f5-4cf1-8763-435b4f636c61", "comment": "Malware payload (Mirai)", "value": "b0ff40495a708b1c41dde642cb6b5808819e4e66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301880, "uuid": "098758db-23d9-47de-9aa3-1085d4cbf98c", "comment": "Malware payload (Mirai)", "value": "3387a6a9435b442a1d3df4a011860d84b0b43897fa650269f00850f2b52690dc79f0dbeef26c373ac2fb2203d5e53ca0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301880, "uuid": "6049b349-1cdc-4ca1-bb47-1ee81a83f118", "value": "T1FBD33A17B4C180FEC4DAC1B44BAEF53BDD73B0A81238B16B27D4AB661E49E215F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301880, "uuid": "5907a90c-9baa-4a50-968f-6d32f650519b", "value": "3072:Tdw2K49YjiJJTEUd+dj6eqMeaogF1Qwf8iS2blmwa5t:Tdw2bv/TE15qKfB+5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751301880, "uuid": "8beb58eb-152f-45d1-a18e-091f4f2f76a3", "value": 135512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751301880, "uuid": "ae8cc2c8-a3b2-4cde-91a2-e92741459571", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301880, "uuid": "b04342f3-058f-49dd-8b6a-334558b29f51", "value": "cutex86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebcd3598-55e1-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751308926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308926, "uuid": "e328a4fb-a145-4f7c-8794-eb6bba2c2355", "comment": "Malware payload", "value": "7a1cdff244260f62ca4093dc26f185d4", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cisco", "colour": "#C812D6", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308926, "uuid": "b0893b34-c17e-4d0b-ba69-62a971be2146", "comment": "Malware payload", "value": "a6d9e6c72d1f692780d184ba90ec9a57aedff60eb426c1f7bd29b0fa8aff61f2", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cisco", "colour": "#C812D6", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308926, "uuid": "0f938d4c-a59a-47ad-b3c3-ef7110963461", "comment": "Malware payload", "value": "fc2e31eaee71ba83c1c5006b563ccccac7542460", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cisco", "colour": "#C812D6", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308926, "uuid": "7eb658be-0814-4155-bd77-84627db29b9b", "comment": "Malware payload", "value": "c289d1bb788df128cfd52ff9323729498d2e99a1ba945d1e0d8df35616a7e8a475b81b5377c7dd586c57fc52293808eb", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cisco", "colour": "#C812D6", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751308926, "uuid": "f3e17955-2b55-4f29-bdac-3b5dbda5bd28", "value": "T19CC5CF8AF745D8AAC0F7C6368675462A650BCC558B43E2874A69F13C0CB7DC49B87ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751308926, "uuid": "8c5af904-3cf9-4f80-b031-dbc92c06f0c4", "value": "49152:60Ax7kA1nKW7t6EjQSBtc9ZCWXCmDJiUnFwRGu11CX:87kQKKoEjQSBtqZ7Ca0UneRGtX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751308926, "uuid": "6539cca4-fb69-4516-9ad1-ca8569d8c1d5", "value": 2742552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751308926, "uuid": "726b775c-8a23-487e-b65d-0d784b01cb90", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751308926, "uuid": "d439bfbb-6bae-45a9-abea-f3393315bbb2", "value": "6IlDBPwRa6_0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ebf5093-55d1-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751301710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301710, "uuid": "6a6219ab-38d4-4a65-92d9-82e12433c2de", "comment": "Malware payload", "value": "aea6cfcae30b413d7e3a9fcf4d864e26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301710, "uuid": "ba5f515d-97ce-4e9a-b115-ed2753f5e2ef", "comment": "Malware payload", "value": "a6db8c95fef1e8057fecaece23c38ee97a4dff46c1e85c6654452ba50d3a2286", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301710, "uuid": "a6eb99a6-093d-4205-899f-477a58f41727", "comment": "Malware payload", "value": "a1086d4c621d5355235b7c056259ba1eca7754d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301710, "uuid": "12266bb3-28a4-4210-aebb-1e2d8257261a", "comment": "Malware payload", "value": "a70feac710e8b724a004f0f431a5c90f95e189fed570b33bf01821c89d322c03f008b3c205e534b927074ac0dd8864fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301710, "uuid": "1f9b54d5-ef05-4f05-907c-57e1ebf8afa7", "value": "T18CA41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301710, "uuid": "66ee0ab2-3269-4898-9dd7-8efeb5bd6cc1", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751301710, "uuid": "37726c50-9add-45e1-9992-12f2a46f785b", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751301710, "uuid": "ff93a7eb-1b7f-4828-a617-a340f316dcc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301710, "uuid": "62d07e01-afb6-4e76-8d1f-5099f90c74aa", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e5a464-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751292006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292006, "uuid": "2e37f6b7-8ace-4595-9d25-f884dcc128aa", "comment": "Malware payload", "value": "8d7749120a8399473a56582e92f83d96", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292006, "uuid": "66628c3a-49b3-4dcf-938e-41048ef33d11", "comment": "Malware payload", "value": "a7d85600396969e5a2210cdc61f7f6efbbe15a279bfd65de8fa448a7ce0f354f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292006, "uuid": "e0660a87-f549-4e10-a733-d980eaac3fc0", "comment": "Malware payload", "value": "6a9ea030a2ced3fbe306bac1093af3f6cc8f3d8a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292006, "uuid": "1b3586f7-c3cb-4632-86e3-abb2f44ccd41", "comment": "Malware payload", "value": "068b94f1113d8f6e1d5fc654bd1d26249ee38a1852c8408c9c1fec3086a1a494f47a08b73ce2818cc028a668e78ccd42", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292006, "uuid": "5d6771a8-ad79-4ad3-8b2a-008f09835966", "value": "T15207799F3DF59469215419D1EF238DFC0A2AEA30DCEF6C4CFAD5E14C2A1C3B1944662A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292006, "uuid": "573dd3b0-656e-492c-b3a2-7c485487534e", "value": "1536:R888CeoGGsAoyrcy9yZLx/VkjAwW8gEW7fwRQ4B5YQEbYr/lQtnAShbT59U888+:Gf+YnYr/lQtnAS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751292006, "uuid": "797f985d-e5a1-4d36-94d3-62e5f4322994", "value": 18230628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751292006, "uuid": "c8faba01-4be1-42c7-b5ca-9d4c418ec0be", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292006, "uuid": "99c62312-baf5-4ec5-afcb-fabea8a5d456", "value": "Waybill No 4594301666.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "449e285b-559a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751278151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278151, "uuid": "c8b53b62-786d-436e-8e2e-d52bca32e306", "comment": "Malware payload", "value": "46ce5a7647770711f0c24d98ff7a2a61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278151, "uuid": "05be8dfe-b298-4b19-9691-dc48999586aa", "comment": "Malware payload", "value": "a84f5d7f05039d97cbd87097cb3bbfc2968791d06abed1eed239a8c88efe71ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278151, "uuid": "a3e5a88d-1e2a-4990-9e26-61763026b708", "comment": "Malware payload", "value": "173398f1e0461ec5a987e6a6b1dec3f3b7391691", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278151, "uuid": "545a5dfe-cad7-4407-9589-696f55d8f901", "comment": "Malware payload", "value": "c548d81e52be56d592d29e46bfe2a3f355e862461cf411dc428066057665325a11479100de40dcda172d274305462a2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278151, "uuid": "b6010c2f-74d5-4c5f-abbb-633f6e5f948f", "value": "T153043C0766AA017CD1A7E37C86975D02F77B390A13359AEF03C192720F66BD1EE7A610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278151, "uuid": "cc6c8ea6-0cbf-4595-9d76-8fd77cf81b50", "value": "3792137109807bfef8745bcbd54f161a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278151, "uuid": "0f4ca0cc-e394-46d5-876f-523ed72d96dd", "value": "3072:kmsGz78R2d5IQE2BIh6wY3uBecuqmhvdtjKoamVs:3GRk9IhfBecPyFFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751278151, "uuid": "477bbead-7586-47a5-bf35-212ec2a0d2dc", "value": 181712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751278151, "uuid": "96e5a63d-420e-41a9-8d42-805643654242", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278151, "uuid": "d0562bb2-4ade-42e7-b32a-a04cb02ddedb", "value": "Swift Copy PI_70082517 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bdfbbd8-55e2-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751309087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309087, "uuid": "3b1a3a26-e20e-4555-9af7-1bd29e422f16", "comment": "Malware payload", "value": "c8890c4a48fe55a7df7aa10251c1ca0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309087, "uuid": "bef46303-2df6-4bb3-b557-8b21f5a58856", "comment": "Malware payload", "value": "a91f60d34f0dc2d8b87120c8a7afb1138c3ba704e1ef541692febf3efbedb68d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309087, "uuid": "94bbdc9b-0d0e-440b-8509-61d576231307", "comment": "Malware payload", "value": "26ed2a66a12f826a67658527eb8a722622c58f2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309087, "uuid": "9d770c72-9b68-4489-a800-83e3d90e3afa", "comment": "Malware payload", "value": "e0a7fd003ad277533208705e6ea3af081777b3d41b966645eeaac9dd73c8ccd6ae8901e69963d5a0c2acbfaf9b832cfd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309087, "uuid": "3bb971dd-e5a6-4b1f-bcd3-61e4ad67126f", "value": "T1E3B41228EE4E3891F3D1E378DA0A4BB1B05B7DD0C166C1B2BA41E25D95EDEDEC5D0212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309087, "uuid": "c3ea7f12-4813-44c5-9c64-c7028703912f", "value": "6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751309087, "uuid": "79310cb8-fc4e-4236-9ff1-cb319eb33c8f", "value": 509896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751309087, "uuid": "10b53e7d-8718-4140-a867-aab50c2de754", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309087, "uuid": "52263e77-42be-4711-97ea-494a9fd99044", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "013a2fa3-55dd-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751306814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306814, "uuid": "ffcb667b-882b-44d7-8878-a32c6a82c9d0", "comment": "Malware payload", "value": "e9e69651fbbcc5ceb56bd24f2bf2ccf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306814, "uuid": "1107893d-1b33-49a1-9271-dc7d4b17f6d3", "comment": "Malware payload", "value": "a92b1195309367ec99f605545a65f9a89f67aaf29ede9ed8dd9ded3794660fa1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306814, "uuid": "2c2856c3-4020-4936-b6e0-25a941012f20", "comment": "Malware payload", "value": "5b2403983447c0a69eb51df1187039b493795281", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306814, "uuid": "9c8e0753-4301-4d6a-bb90-3297f7b11adb", "comment": "Malware payload", "value": "0f490ea6efb9334c8f08ed17bd9a11717da5fe04d4b90f6f06c2c550c46c5427b2c2b8a2cc243c8b5eba9b9cf5d6fb5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306814, "uuid": "79e4bfbb-30ca-4ef5-844e-105bad092327", "value": "T10CD63344ABB148FBD9EB443A8435D124D2B378A60B70C5EF1BACD2171FEB6E16931B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306814, "uuid": "363fa52b-cd44-46a0-895d-2295362a35e4", "value": "c990338f8145dc29c6f38fb73cf05c77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306814, "uuid": "5c440b25-9a77-4d9c-82fe-b91d45e5255e", "value": "393216:Ki9hEJMInEroXf14S2pn8hrpylsVn/ZLEqPiH:hYBErUCBaKsB1Jq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751306814, "uuid": "a011b1e6-49bf-4db7-81b2-ade6f64e3b68", "value": 13115807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751306814, "uuid": "30e02991-2904-499a-88bb-e3e20779449d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306814, "uuid": "335532e2-f7fc-43bb-8dff-6c85feb740ef", "value": "GPJJx4F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdcedb60-55c4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (GuLoader)", "timestamp": 1751296500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751296500, "uuid": "969af9c3-b6e4-4845-a959-56afce5657f1", "comment": "Malware payload (GuLoader)", "value": "8d5a28a27f0ce27fb092a4771f5251f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751296500, "uuid": "60b6def3-9320-4753-af2e-8f02f612ffaa", "comment": "Malware payload (GuLoader)", "value": "a92c336934ce54450c7cd4cb75788e8ee221fb682f38d7aa29e852de9f9f3ded", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751296500, "uuid": "a52eafe6-ce39-422b-a497-b7924e7d0955", "comment": "Malware payload (GuLoader)", "value": "dafd070dbc08cd9ff4a981102f5dc04f322898d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751296500, "uuid": "2f89ed81-36d3-4e1d-af80-28cece5cc99e", "comment": "Malware payload (GuLoader)", "value": "0afda5b1cfc91aec745d21bf4d6f768f4ba2961f045b623807d628ed367e396e66437f08945491903597d69d2b3b7df9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751296500, "uuid": "9001fab5-8f53-4c17-b4dc-5a9883dad174", "value": "T1FCD41235BB58C967E4120B3018EBA309F775EC255B029B1BDA00B7A93E32BDCBD06D55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751296500, "uuid": "33f46932-3205-44ff-a92a-b6bad97c2957", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751296500, "uuid": "d1f42892-b00b-49e3-9df8-34ce69cf271f", "value": "12288:2MwC2L2cvwjUe3EUC9MIfxPnVZVnj0xy0fJ58m7jguA0:2MwC2LXVM4PD0xlHa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751296500, "uuid": "b48a1dbb-ef0a-4192-b713-5a146a88d4bd", "value": 641776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751296500, "uuid": "229bc941-86e9-481c-8366-26602a11f865", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751296500, "uuid": "41a7f724-c9c9-4ff7-aa17-164d576da3fb", "value": "SecuriteInfo.com.W32.Agent.GLZI-9085.32020.8545", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53db2f1e-55de-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751307382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307382, "uuid": "53f2bf6e-9e7f-4463-bf66-74bc3205796d", "comment": "Malware payload", "value": "aa285cea1369c3eb09b90a6b30dc1c28", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307382, "uuid": "43d0f25c-f5ad-40e6-8665-e826b315f268", "comment": "Malware payload", "value": "a994b9664d2f0b664f7e97e2a6ca7f1d2ddff8888e2bff7313e75766260fb164", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307382, "uuid": "c08c2e1e-1b23-4f18-818b-ddb2c66184b3", "comment": "Malware payload", "value": "79d88797c907f8a10ec022126f51b4fafaf9bf34", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307382, "uuid": "abbf8b75-b4cf-4827-a61c-27c85d789b00", "comment": "Malware payload", "value": "37b18b106b6b3d0c9f6f15a8d27ffae3692ee74886b141c2333fc82ce84bfaa226a337554e8080609579bb80d3fe603b", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307382, "uuid": "d8b42f60-8d23-4631-9a98-3f44c8889d7d", "value": "T11D86339ABB98EF0EC83350761D096672549EA937C706C783D8390799788BAF41F123F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307382, "uuid": "bb541459-5462-46ea-a28a-d0fe61919a9c", "value": "196608:BreYiL96ME39NEV/eXrYgCbUCw4LXqd7LaOJ61pbaC91o/bZKS:0BL96UeXrYHw42dXaOJEaC9SbUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751307382, "uuid": "6dac118b-2787-48db-857f-f137eabc1142", "value": 8535046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751307382, "uuid": "48ad7afd-927d-459d-bd74-2b26dbff9322", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307382, "uuid": "758b9fa4-321f-4ea0-95c5-378aa678025c", "value": "app (11).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c64e291-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751243831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243831, "uuid": "45f2b0f4-5601-4386-838d-8dd296be662b", "comment": "Malware payload (Mirai)", "value": "dff4f7b6f55b7c581022d8da611fd1b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243831, "uuid": "6e3b39d7-5804-4781-92cd-772f352d05d8", "comment": "Malware payload (Mirai)", "value": "a9de287c2a002eedcb548a2ce749ea3a0fa212264374804ba91ccfc67de70728", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243831, "uuid": "c18fc4d0-cdf4-4afc-83fe-95e651a18127", "comment": "Malware payload (Mirai)", "value": "4acf9cfc8e4292fe9debeffc75d3fdb6f2f3cec9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243831, "uuid": "500589fe-5a6e-4666-8160-f8c8a7c5e6b9", "comment": "Malware payload (Mirai)", "value": "c3087acd718136567625cd92ff3319402fc231976282255b34550c8f1dceb323022cccad62a3c0bac66620f5a51e97e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243831, "uuid": "786fcbdf-15d4-4478-9f00-f91345481ae2", "value": "T132434C21BA710D2BC4D5A57A61F3432AF2F6479A24BC861F3D620E8CBF54A4036577F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243831, "uuid": "9ef234ca-f556-4beb-9ef7-176fdf7f0d38", "value": "1536:BVue+nR/yVFJJIkg+cI4Stw/Cl95G/tptz:bL+RqrvvZc+6alPG/tz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243831, "uuid": "3b5bbff0-4d23-447b-b7e7-2d8e4a0b190c", "value": 60520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243831, "uuid": "7c3f1e58-d837-44d5-8ec3-1c661a59afa2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243831, "uuid": "8493e485-6aba-4436-9c55-a54ff62d9623", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b0ab87f-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751243829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243829, "uuid": "39bd79bc-7c9f-4cf2-b4fd-49d3b1dcd6d0", "comment": "Malware payload (Mirai)", "value": "aeacdc4c3d49d4d00fef97a2c0258c60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243829, "uuid": "6c6e32ce-6e43-4d56-94c1-a811dcf3a5b3", "comment": "Malware payload (Mirai)", "value": "aa34b25ce4bc8fb8f49efa10049384985eff86dc3504ce61193e8bd51c76ef5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243829, "uuid": "a0522d62-f61e-4611-827b-34a5c4c222f9", "comment": "Malware payload (Mirai)", "value": "c647c91e48b1c16e1ccbeddc4bc5e9f9c718692d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243829, "uuid": "5500df94-3edd-49b2-bb98-4c3f728912dd", "comment": "Malware payload (Mirai)", "value": "20e3a662204ff805c92db16665a6a278fda57bdf3ba46802a56819dfedbc8b1849572c674f9343aeabc75746ae95640e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243829, "uuid": "64873279-7c5e-429f-9af6-d612ecbc5fdf", "value": "T19E432921B53A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243829, "uuid": "9f8a162c-75c1-47dd-a378-43114bb7bf43", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIAQKqgESnmC/xO+KpAwy:RqtmZPuutfbltZFBSJsBcfDSTFIUBEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243829, "uuid": "3b0e09c0-633f-4c1c-b75d-3781b426136c", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243829, "uuid": "822caafb-12c3-490c-a273-dd54333545c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243829, "uuid": "db494d1e-e84a-4ace-a1a5-d7e6ce307c57", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d39306a8-5599-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751277961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277961, "uuid": "df6a90a6-e1d8-471a-8845-2ead7015ebf4", "comment": "Malware payload", "value": "78e7923935618b9f3285b4b0ff1f861e", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277961, "uuid": "84a46df5-7324-421b-b2f1-97b6ea232185", "comment": "Malware payload", "value": "aa82a91ffbf5b0c6b365d5e69c918cd1bd9e9a0f791f33cd3de3117015fb28c9", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277961, "uuid": "c4c6677c-6d3b-4e71-abc7-9a932f39506e", "comment": "Malware payload", "value": "ab88ffc22de715a8b2bd38959b06f0281a40d324", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277961, "uuid": "92f6fc84-6dd4-4e53-95bf-1ef5312ef94b", "comment": "Malware payload", "value": "c9493c251a92b74d1489490a0a06f35fc9f41bb1d60bf57f222369064d1d9f211d9e011c8c2683f082be5ccfd96cd104", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277961, "uuid": "774878da-bfba-4b9a-81d4-477e44c4a759", "value": "T1F365E742A3858E2FD6E5C3701DB253E03771EC94A3924B175618BB3AEABA7D41DC1BC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277961, "uuid": "d641a1ba-8a8b-4660-88d6-6eb20a432361", "value": "12288:hkLKc7pSmDaWj2nK5nNHs2KrjzTS+pLI8TDWYq1hxFo3DbQ:+9djmsds22THbWY2H2zb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751277961, "uuid": "4c1dc5e5-c7b1-4c25-8f31-7293efb2ea39", "value": 1549312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751277961, "uuid": "9e7420ef-ea3f-4f39-91a9-29cd7e306448", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277961, "uuid": "515b966d-ee51-42c7-931c-21182bd90b0e", "value": "aaaaa.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9028b1be-559e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1751279996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279996, "uuid": "f17d89ba-f0d6-4e44-aa80-4c3ef89f5358", "comment": "Malware payload (RemcosRAT)", "value": "9f41ca21488dfb51bea293f5c1994530", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279996, "uuid": "567f838e-5e28-40bc-ba5a-4fba04b5e5ec", "comment": "Malware payload (RemcosRAT)", "value": "aa837ba94f1f01216bdbc8bb9736a48390f50982cc8499e774a6a668ad57d15c", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279996, "uuid": "b1bc6113-51e4-49d5-8c46-ce4b131ad0f5", "comment": "Malware payload (RemcosRAT)", "value": "f949530daa18109c42bc71fd31c4ae66df8cb000", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279996, "uuid": "6a09c614-e5dd-4cb6-a2e9-e2cd2ee57901", "comment": "Malware payload (RemcosRAT)", "value": "0611a844f42e9a8e4cd607449e0cd352819a6612a89aca3d5feab06b682fbcf9a419d33229a015c29d8aa2f00a1b339d", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279996, "uuid": "c3234612-fb2e-47cc-9d99-69c966f5b450", "value": "T15021DA5369241D97983DB83B16157F1E1FEBCE43EB3612B092669AA0C3C6B2146F12CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279996, "uuid": "eac69805-042b-4f56-a1c3-e8f52e81185f", "value": "24:ZOrmCIgyG2ZvBYgBRcTzw8cW+pRN69N1Zp6LALudmPx1Eee1:ZSmCIgyG2ZegBiTzBcFsPeAC9eE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751279996, "uuid": "46627aaf-2dd5-4d99-8f11-452250e19a24", "value": 1227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751279996, "uuid": "da7440bd-3357-448b-ad8c-25032dc5f92b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279996, "uuid": "b5a187ae-40db-4877-aac9-ae51be299c2d", "value": "FA25271NAFTAL-KHROUB-29062025165341.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e432c38a-55b9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1751291733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291733, "uuid": "8406cfb4-c50b-4382-8cd5-bcc8dc50247f", "comment": "Malware payload (RemcosRAT)", "value": "497915b6027f53ba98816b4455c70dd1", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291733, "uuid": "9528e03f-e9ed-4359-9510-f10b3c320e41", "comment": "Malware payload (RemcosRAT)", "value": "aaab431dab3880838f6be9e7eec86c82b0631029d4f804e91a39cd46596ca983", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291733, "uuid": "506e95f5-db96-47fd-9bb3-3fab97e94771", "comment": "Malware payload (RemcosRAT)", "value": "073e68a21da65cb0f660fec33ad7373b3136149b", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291733, "uuid": "d0fdbc98-02d6-4d1e-a24b-4a66e7afd65d", "comment": "Malware payload (RemcosRAT)", "value": "7a62bba6e825c07f89d0841ad3f391190143d9ff6f2045a44a57cf32959e4b530ba054675e694e57628d8de05f713bc4", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291733, "uuid": "db66c2bb-b2c5-48ca-b19a-6bf09b867237", "value": "T13515E0DA7E0966C8484232FA68148552F2DC83D2B309DB72FD7CC56573918F8E97B392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291733, "uuid": "c2afad95-bfb2-4e64-9510-43bbab96a7df", "value": "12288:nRH6YbbTqVLVs/M2TT+Ptx7D91o4xA9RH6YbbTqVLVs/M2TT+Ptx7D91o4x9:nhJGVLX2TTM7DZYhJGVLX2TTM7DZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291733, "uuid": "9182e790-2871-490d-936d-88c9a94e2575", "value": 875961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291733, "uuid": "2fecf37f-c82c-4f59-9398-c975235beb5e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291733, "uuid": "460489b3-d828-4513-87f6-e5a222cf5e61", "value": "Update.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870919f3-5596-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1751276544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751276544, "uuid": "fff21622-1b56-4371-bb3f-b0adde8e1708", "comment": "Malware payload (Formbook)", "value": "f11b95f243c809ca35aa81c162659b0c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751276544, "uuid": "078f2dac-ff2f-46f3-b329-80f0eee6e71b", "comment": "Malware payload (Formbook)", "value": "ab17798d22061a0f12d6550b35839ecbe8075ed60c6f0999ad1462741e90782d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751276544, "uuid": "5ccb2645-b8eb-414d-ac18-9ff27d966941", "comment": "Malware payload (Formbook)", "value": "e8a8295b707413cd4f015af8afbb52387e77f173", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751276544, "uuid": "353ed502-56f3-443d-a2b8-0100bb8dd3a8", "comment": "Malware payload (Formbook)", "value": "7ccf7829db054fe7ed228f04bff551a7d87a0252993f0ea313338ef862210491956bfad0f6a2a873b4868bcc2f074653", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751276544, "uuid": "b402278b-ae2a-4d47-b0ca-79e9d0b2a001", "value": "T168F4334C576A0780598A1D9DEF009FA7D97624F079252BC20468738E67C8C3DBFAFD98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751276544, "uuid": "3922728d-34e2-40ce-b265-a3cfc931e5f7", "value": "12288:PJixVTQnaYgEo4PgA8NcGWF1XELwUO+b3XQWgemJE5u0UXjTWufpUalgbwgXZHyR:PJiDQnarEoZ6GWF1XELlO+rrB5CnWufn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751276544, "uuid": "988b9334-1e88-4236-8405-e3a700ddf6cb", "value": 780337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751276544, "uuid": "e03da88a-7e23-4761-ab20-14b7e1f9110e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751276544, "uuid": "6bcac794-3a34-4fd1-9e00-792fdd2868e4", "value": "WIRE -$2,912.00 INV#SI25040059.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2bcf12f-55c0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751294710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751294710, "uuid": "53d61a5a-f542-4b6d-8cf7-bdd1e438ab92", "comment": "Malware payload", "value": "d172191b6c2a04c3dc20121aec8ff53c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751294710, "uuid": "dea83b17-b3e0-404c-9423-571633a2ed2e", "comment": "Malware payload", "value": "ab8ff9b3076eb1ab0a4170722be03f9332d5c33487ae8f9dc7ba89d966eff2a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751294710, "uuid": "fd5e6862-fbfd-42bf-b79a-83c1f573e2eb", "comment": "Malware payload", "value": "61712d4eea9c5afdb3f27c89f25651630b022de0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751294710, "uuid": "8e5ab863-d7b5-4ce5-8f0c-ef549dc7f6b9", "comment": "Malware payload", "value": "61eb8ea8a6f5dd45dbbb360995bce6c361a2325b2556b60c5605dfbb64f128a2575f226cb20e21db4698560290c9fd02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751294710, "uuid": "5605eb15-0884-492c-ada6-89cc005d487f", "value": "T1354523B980E2E5D0E34119FCDC86A4B497DCFE18C0682F061D5A3F1BB67741489B7AAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751294710, "uuid": "df26cde2-c710-4084-824d-59a02a47369f", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751294710, "uuid": "5418a719-f397-4e9d-a6dd-29a75d7332cc", "value": "24576:UfrF0PVwV6G/39z4PD/22wfRc61PjRewy7wE8jEG9/sMaqKwET:6rF0ds6Q54PD/22aRB1P9ep0NEG6Maqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751294710, "uuid": "ee8a3bf6-8666-4e87-a4ad-582b54327ee2", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751294710, "uuid": "9b7f75b9-90c1-44e5-bd5b-52e3e8f31c21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751294710, "uuid": "0111ceaa-da03-49b7-a0c1-a46b9ba6d039", "value": "Doter.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c93c1a1-55e2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751309088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309088, "uuid": "55412738-73b5-41cd-9423-4761dad53431", "comment": "Malware payload (Mirai)", "value": "19280cb48f3ab85b742f97a6ebad05fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309088, "uuid": "1b9b2eb4-15bd-4c11-8ba3-343b05810351", "comment": "Malware payload (Mirai)", "value": "abd581863881c8c3920d4373c679340efc53c549ec710dca96c47955af608f97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309088, "uuid": "0f6e9a46-d2d3-47ea-bcd9-48e8ae8c85f6", "comment": "Malware payload (Mirai)", "value": "13fa40bed3fdb4f77b6f9d2ffec0d97de2a76dad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309088, "uuid": "50f3427b-e5c6-4fe9-96bb-40aec2915914", "comment": "Malware payload (Mirai)", "value": "259c97d51fb96fc8b6a497b4f1e7fd747b182ee070ee927587c62c48c2c227805b39f56699944cb8c0dbb46b553c2aca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309088, "uuid": "7aafbf07-1561-4447-b282-739bbf7e14ef", "value": "T172333A07B98280FDC19CC274567BBA36C833B57D1239B6E63BD0FA276D46E211E1E944", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309088, "uuid": "7162ea65-491c-4797-8409-a9eb2ae7595e", "value": "1536:Un+fjzQtRXvaJXVUeKumw8w7pN+/mwPmfOm8G:BjMLXvaVUBu5Nom/OmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751309088, "uuid": "a7589915-b97d-43c6-aba6-122e86885011", "value": 51200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751309088, "uuid": "53782967-4d16-4b61-a31d-ab7e355394bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309088, "uuid": "5e93e206-a6f0-4fa6-8b44-28cdc1643300", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3667b092-5568-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751256652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751256652, "uuid": "e472e853-3c76-4d17-a53f-787ce03a35d5", "comment": "Malware payload (Mirai)", "value": "32f01ba486334878941e35a7ac11ddb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751256652, "uuid": "9e8ac8d5-0768-46b0-b365-2ebbaf2227b4", "comment": "Malware payload (Mirai)", "value": "ac627b19ca80a14f772635365f464d6c797bc7b23e20a644ea3604da98202d77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751256652, "uuid": "34af9610-f595-4093-b969-10ba33befffe", "comment": "Malware payload (Mirai)", "value": "bc3a88f17eaa05a7fdebe64064ea991bab87a974", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751256652, "uuid": "88501f48-3632-407c-9349-116b7a5f049e", "comment": "Malware payload (Mirai)", "value": "1c27af1edbb5077b72a7b2962637320c21a834b8f56640233a4eac7b21e4f1ee001828c29ef77332e3134d5cffce32fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751256652, "uuid": "feec4e07-cb28-42aa-bef5-40290f3b02cc", "value": "T111F329DBF900D9BEF80AE73748230909B130B7E254925B373257797BEC3A1950967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751256652, "uuid": "1e91b32f-bc49-4e54-b773-a9fb7402c937", "value": "3072:eTdm49M7QUGi56dU82p9QuJ/qNpK3N+RGL8rCU6VgjbiHLumlhk+yezMp:N49MQUbXQuJ/UYF4CUMLuAu+yeop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751256652, "uuid": "12bfea1a-3404-4ff1-abee-eefe7f333bf5", "value": 166592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751256652, "uuid": "c10d9a5c-b6e6-4754-8a45-ae211ffad21e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751256652, "uuid": "bb1138ab-24c5-4746-8027-73f62a1c1f3f", "value": "neon.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "429ae3f5-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751291891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291891, "uuid": "ad1ba4ec-37ba-4b9a-834f-5588bc5fe083", "comment": "Malware payload", "value": "7498a3b4921664bd51c1cc6680648ffb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291891, "uuid": "373da083-e6f6-48d2-84b7-1132b0edfe9f", "comment": "Malware payload", "value": "acddb76f6aa25af158356144b4dd81e6fe202e9a36d78a683bb66c7394a1ebbf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291891, "uuid": "7336a5ae-3e1a-4fbf-b3cf-2b2744376e1b", "comment": "Malware payload", "value": "0d13ce52bf3b4a5c7f96d9c2d0c832252cb348c1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291891, "uuid": "800dcd8c-da18-4cd8-92c5-fb836cb67661", "comment": "Malware payload", "value": "b1da216b5d594ff4c14743a08390e75d81f5fad89d16e32877381ba78c81a5390d08245443698b67290885aa9e3ffcf2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291891, "uuid": "3cfd42ad-6d41-4a40-8f0e-f7cf446234e7", "value": "T18CF2DA84B851E5A483F32651011E3804EDA8D9274CF9F47492E8C7D137B27A35EE6B7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291891, "uuid": "c4c33295-6702-4392-98bd-27279e9bf071", "value": "384:94CxjDM3q6Lg/r3VDdeI/zMe9f6RUJ2Dmtkuxf2Fa23yzLEacHbs+TC0ym00TY86:94yjmq6Lg/r3DTzQ5sVsY8VK3522Ke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291891, "uuid": "cc70f626-10fa-426b-a19e-5aa357c8e320", "value": 36369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291891, "uuid": "b3c17d67-6501-42f4-9c89-5b042bb8ca93", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291891, "uuid": "3d333a06-050a-431c-b9a6-71ce79f32f15", "value": "Construction Plan.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64d744ba-55d7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751304404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304404, "uuid": "62818407-345c-4110-b850-650a02ce5ec3", "comment": "Malware payload (Mirai)", "value": "32c602d81ef57b7704923485e1e18aca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304404, "uuid": "dbbb49ea-5ff6-4373-936b-38d58ffa6b44", "comment": "Malware payload (Mirai)", "value": "ad0014f7c3e604337ddc19ef434b8026e712d03400cec2b7c10c9c5617d16a81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304404, "uuid": "9f186c3c-5505-4fb4-9a5a-8a2daac06c70", "comment": "Malware payload (Mirai)", "value": "219036e9a2022b66fe13d74b8caa6edf07a2a167", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751304404, "uuid": "a3ab9ef3-3fa3-49fd-b0af-a7e2b984fda9", "comment": "Malware payload (Mirai)", "value": "6c4b5605400b7211d0291256e3e6bee523f62b5bcad8522fa6ca796131066ebf36404df551cbc534ed90101c80d95847", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751304404, "uuid": "6be709b2-707c-4fa3-bf1f-7c1d3b860486", "value": "T12D13F1AC3F000457E63964FA2FB40F960F608E7230268C6A7F59DBA7DD8259978539CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751304404, "uuid": "4729c8b7-6c81-4cba-aa63-47c56459bcef", "value": "768:w4jx5aCXqdUrm4+F5/vE4KNguVB95QG6mSkbKOXtQCxmJB+aGSmJZsqIovJgGlzv:wUxIC7rlA5E4KSuQ4bP9QC2B+aGfJjI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751304404, "uuid": "3049af2f-72bc-4d27-b01a-d3d9faf94fda", "value": 42008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751304404, "uuid": "c09a3184-128f-4d14-a526-b3edfd6e09c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751304404, "uuid": "0e329fc0-c104-4867-84e8-ba63ee0c0adc", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0972fb5-55b7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751290895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290895, "uuid": "363f8672-2bd3-4d67-9b32-32b1e3c81ba3", "comment": "Malware payload (Mirai)", "value": "aa2c9c6128b6322110fd3be7c8a03861", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290895, "uuid": "3ea4be24-bfed-4194-9dd6-36ab581d5883", "comment": "Malware payload (Mirai)", "value": "ad312d7549c7704554ab1c6e9010cf017db4d19a35e29084b8cbbdfa8b51e179", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290895, "uuid": "12c8a15f-f200-4d5b-85eb-430d792dc48c", "comment": "Malware payload (Mirai)", "value": "6b1f1a9ed0841c216bfad5a5b13f2031a1cfaf5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290895, "uuid": "0378ee3e-1978-4109-9d6b-a847a1698440", "comment": "Malware payload (Mirai)", "value": "19d8039df13a67e9982c3cabdb68c3d06de325abb42a776ed29770d5b52304c693e53c4a0a56ecf27f540673b8247ef2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290895, "uuid": "e7df98ad-6649-4c59-b2bb-6f814429f3da", "value": "T1A5B3AD9FBB4B1561C86547F10BC78BED3E2322119E5BC8E36C0E263D49B51DF4A0A792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290895, "uuid": "76052c92-3d51-4cd0-aca4-1c56e4972575", "value": "1536:KGlGNu830Yo68qDkWXaLYIEEImcG8qYMGd9Kgj/LWu:KvNuXYeqYKQbE48qYRd9Kgjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751290895, "uuid": "37de40bc-ba00-4e8c-9183-de3bd3641a55", "value": 115820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751290895, "uuid": "c2f5b291-1d9c-417a-93da-a11ccabe03d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290895, "uuid": "8c011fb3-a792-4adb-bae7-f72a6a692289", "value": "mirai.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94fb34fb-5588-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751270555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751270555, "uuid": "0c203033-996d-47ee-9914-4932a1b21119", "comment": "Malware payload", "value": "d91f5fbd6f402924101e53dfb46dc82c", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751270555, "uuid": "054fe5b4-0bf5-4c2b-b292-d9f7148ccaf1", "comment": "Malware payload", "value": "ad32afe426639f17e949d2736685f5d21bd8f6c57e658d345a68d535b98b021b", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751270555, "uuid": "95a19950-cb8f-46cb-b80e-c63394ddb222", "comment": "Malware payload", "value": "9a235cea8f09eb904809e7bbf87eeb064ab90feb", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751270555, "uuid": "20c8648f-61ee-43af-9f6f-554a3eae82ef", "comment": "Malware payload", "value": "a8df4ca5de406d256a4737ba346ac8635f7b60ccbca2d3ad13f4901febc247507046784393aadedb091905b46b955902", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751270555, "uuid": "b0c98e4d-1542-41d2-a893-a2f14689dc97", "value": "T1DBC3136C9A14E839E436C5E05D2D7D9FB27838F6BFC202861C2F5F4B0BAD045EE0A654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751270555, "uuid": "770be9a3-5604-4171-8aa8-fe641da15b2a", "value": "1536:T7QXs7VS2vzrnKyHQupqwGy/az2ENqCUM8o0ndVfdgkWN7ifjTU2mvVtcfG/jhep:wX0VS2brnjDpep6boodg+TAvfnLcp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751270555, "uuid": "733b6c2a-33b5-413a-9607-7e65daa3999b", "value": 125560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751270555, "uuid": "0ce98115-af27-475f-9641-09904a824b49", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751270555, "uuid": "2ec2972a-b284-492a-a0c1-45b18a3b20e3", "value": "\u0424\u043e\u0440\u043c\u0438_\u043e\u0431\u043b\u0456\u043a\u0443_\u0456_\u043f\u043e\u0434\u0430\u043d\u043d\u044f_\u0456\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0456\u0457_755776693.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a46838c8-556e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751259414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259414, "uuid": "0d9422a8-bd73-406f-847f-be2d1dcbd9e9", "comment": "Malware payload", "value": "97eefac2b4c837ec8e849811db1ab904", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259414, "uuid": "1a7ab03a-237e-4748-ae4c-28940e118497", "comment": "Malware payload", "value": "ad4f296996ac6104e78b5260f2c1e62ab361175cb40d497db6660a74af9de6dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259414, "uuid": "74f81c62-69f8-4ed5-9c40-391fc758536c", "comment": "Malware payload", "value": "2e965041f8a0c6eefcb402299de07fde924a3cd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751259414, "uuid": "08ec444e-ccfa-4aa1-b479-dc5cc01d3c8e", "comment": "Malware payload", "value": "c526124337f0cc45b0b61a0b67425e7f697f45846911c8ba77e2745cc544509d4899b3901bcba46b7ad3fbea8e70feaa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751259414, "uuid": "d71f3194-fa24-44a9-b509-875d5a14b161", "value": "T1D7C42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6D742F661EDB1B424A9E66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751259414, "uuid": "d482607a-2312-4d11-ac11-5285d69b19e4", "value": "12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751259414, "uuid": "0aced120-6d18-41d1-8cfe-c2c00c56a4be", "value": 587764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751259414, "uuid": "4f69fde0-6334-429c-83ad-ff52e3ecff7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751259414, "uuid": "d9282c57-ed13-4758-82c9-9b9479f4875b", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c39a6da-55b5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1751289679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751289679, "uuid": "1a3eff6d-58cf-4c1d-863f-035278ba7fa5", "comment": "Malware payload (Rhadamanthys)", "value": "d7933e823502882a21a709b196ac8ae2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751289679, "uuid": "1ea66d8b-c911-445f-9c6b-983791f947ba", "comment": "Malware payload (Rhadamanthys)", "value": "ad8ee1e12c4788113097f98503b83d1d7abe4d9e43243f999d40a027caa4f8e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751289679, "uuid": "decfcb79-1032-47e9-8c08-9f4df29ce924", "comment": "Malware payload (Rhadamanthys)", "value": "0bc24764deffb4a1ad36c8e8db874147a69e868c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751289679, "uuid": "470541a2-f107-4766-b395-b8463c110a88", "comment": "Malware payload (Rhadamanthys)", "value": "b5d34e398fa65ed548fbdd0e6b4d369549aee0a794e7a0e8cc6b468749965568eddb0a4962f5b4cb2bcf8b4ef4d68a70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751289679, "uuid": "69bf5d89-bebc-49a9-9e6d-002ca423fe03", "value": "T192A55C40F49BDCB2EA12F2F1E89292BF12E0AD0417754D83C1747B5AEA76993FC2521D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751289679, "uuid": "4beee381-b240-42f6-84f3-7e2a06767def", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751289679, "uuid": "01f35d62-0703-4148-906b-9b10fa4215d7", "value": "24576:pwQ1XdXXsmOzPza+oRouzJEhKmaLrLrLrLina8mLL2cd71eih+/Sm5U3j2qQcb79:p59sTldZn/5YOqOrWK1BJsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751289679, "uuid": "a68a2e42-8473-4a66-926a-966643ba54a8", "value": 2176984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751289679, "uuid": "98408111-70a8-4979-98fc-a9c95c996585", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751289679, "uuid": "7f5942ce-7b4d-442f-aba1-bb1216d63b58", "value": "d7933e823502882a21a709b196ac8ae2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af44ba78-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751291215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291215, "uuid": "27e8e3f9-8f90-4f5d-9405-05589b69a363", "comment": "Malware payload (Mirai)", "value": "b34f3a82e6663800aa20c261cc346623", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291215, "uuid": "5e7f89f0-9211-4475-adea-785d707e82c5", "comment": "Malware payload (Mirai)", "value": "adc5d9f2bf761477a4872e1890ea0f3624f398388988b62b4e9eed2df6d64994", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291215, "uuid": "230ce2b3-5a09-4187-a993-49ae75a4cc98", "comment": "Malware payload (Mirai)", "value": "91cc10a97b2abe0ddaaa3be1f3b10628dcf12014", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291215, "uuid": "a166ef2b-d2f7-49b5-a038-def27da358c5", "comment": "Malware payload (Mirai)", "value": "050a4cb4307658e9b33d5d3550e64e1b4397b0ccb1843ce73a1be1ea87fd467fe3f642a0002ae5c9670195f58b9a109a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291215, "uuid": "75542c16-17d7-4b0c-88c4-e9ca94a4b1ac", "value": "T1F0436C21A9BD1E17C9E4A47B62F78339F2F1070E25A8871E7D320E4EFF21540664B6B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291215, "uuid": "b086b391-9b2a-4df1-8b1e-c97fe2ddb59e", "value": "768:ru7vJtKruqoSh3SAYbr7q94yw0/tbFr6EFwxkDeJq6M5WnVO+x3uNFbW:r6BJDS4ywMtbFmYHDon1Rv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291215, "uuid": "8a0b7f30-2285-403d-9d04-575de0c0a81a", "value": 58196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291215, "uuid": "5b2d64df-aaa3-43b8-a842-744be15384ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291215, "uuid": "db506511-eada-4c4a-99af-97ff04042c2d", "value": "miraint.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f155f4-5578-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1751263553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751263553, "uuid": "1558dcf4-c194-4d96-8dbd-4235c99f5966", "comment": "Malware payload (Gh0stRAT)", "value": "d8a8da1bd0fb994124e2f88cec201865", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751263553, "uuid": "08b73e3a-87b6-4681-9539-234caa46a861", "comment": "Malware payload (Gh0stRAT)", "value": "ae9d06fca126492880e4f243575fe474bd75876ad6ac797edc4344436d042911", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751263553, "uuid": "0487aaab-2d13-41bb-b423-2f4b8270c3c1", "comment": "Malware payload (Gh0stRAT)", "value": "9dff96361c867535c08c2d31790a6ffbeebfa735", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751263553, "uuid": "dbb581fd-9659-46b0-8e7d-ff55b3b7fb27", "comment": "Malware payload (Gh0stRAT)", "value": "638b9d3698e14323e2f2a7d31ff9c1471fff4795dc70d1dde7c3055b58e58de7ad3c4a031692a8baf1f2bcaf0f26ff9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751263553, "uuid": "a03d8fb5-db44-48f3-904c-e20dba3f9ea8", "value": "T104D5F113B2CB613FF07E8A364AB7D212593BBA6169128C6797E4485CCF261D01D3F746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751263553, "uuid": "cfb4ec07-5664-47a0-a4c4-0262f6bf8e49", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751263553, "uuid": "d006d02f-dd19-4fd8-bb0e-8dce2c60d197", "value": "49152:6xXXm66OSmtI20JQTG2gCWKy2Nj1EzftRD92mhUDzsPRMSy0xS76:6xHXST2h5gC33iz7Dtgz4RMSm76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751263553, "uuid": "53008f30-c0a3-4fa0-84e3-48004e496e10", "value": 2772824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751263553, "uuid": "51d7ce26-d751-4a75-9fc2-a32086614065", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751263553, "uuid": "66d1e84f-ef0f-46a4-bb1c-35722caeb029", "value": "GhostWhite-6b999_Install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06578a9c-558f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751273322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273322, "uuid": "ca369031-ef63-4823-9ae5-19b8a6542d05", "comment": "Malware payload", "value": "3130388308ec6cf22fd6948e6568ec81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273322, "uuid": "f20bb631-1ddf-4113-a612-14ee41ba5594", "comment": "Malware payload", "value": "af2103b2ece50211943a1057626f949e415e436df87e91e6ed62ce44f8093130", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273322, "uuid": "362d5fd1-37a5-4929-8c2d-a1284bfdddd7", "comment": "Malware payload", "value": "e43ca818bc006c54e3ac4a18ab7432a8d4d72035", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273322, "uuid": "39606a74-b796-48bd-85bf-cc0f9b9090e6", "comment": "Malware payload", "value": "e636e4a44cfdae0b7c197dc54ac8b860952cdf0f86bdb716aae41b00c5810088790bb81a88457db3da039cc5755c2415", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273322, "uuid": "0eaa162f-78c4-4712-8074-73f505a9dea8", "value": "T18CB6D0E3E790D694C149E0B98116F12F870678585B24BBC7F6E7772FAE62704AD3A700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273322, "uuid": "51975e35-53d5-4530-b7e7-f5c3ecd90dd7", "value": "472939faa55c6ba646c396e5de65f59e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273322, "uuid": "311e8c13-0c77-4445-a71b-f149b0a359fe", "value": "98304:etu55JWNLHXUqSPMxEY/0vBvhs2ETUz+wG402Gq+w28OoCya5IPi4:cu55JWZXtSkxEY/82Uzx4qr28baE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751273322, "uuid": "99547247-b518-456f-8a25-e305845bb33e", "value": 11166720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751273322, "uuid": "3d631796-99f8-448b-ba75-6668c982fad0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273322, "uuid": "8ddd532a-994f-40ef-bf45-d5702ead65a3", "value": "AlWZq5dmR85D2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cae572a1-558f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MassLogger)", "timestamp": 1751273652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273652, "uuid": "5b578821-d3bc-4488-9add-2e772bf838a5", "comment": "Malware payload (MassLogger)", "value": "afcc8012f9dc7f5dd5ca0e9c7a01639b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273652, "uuid": "cd757fd6-b2ab-4c16-9685-16c4a67d95c2", "comment": "Malware payload (MassLogger)", "value": "af60f6448e10012d575ca88300966151294e7011090656ec4d5d8137ff29152d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273652, "uuid": "b1b35b9f-4326-452c-968c-95f4327e8429", "comment": "Malware payload (MassLogger)", "value": "9e38a5b163918daabd3702ef7c3d11c8eea818ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273652, "uuid": "9fd48631-6a8d-4ceb-be3d-779d8ba9fcd6", "comment": "Malware payload (MassLogger)", "value": "294704e8ca11d7115ad17deb9cffe8e70cc608ecd8df9e471db195a1a9b0877de345b656c2826d70c86236453cda345a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273652, "uuid": "7373be6b-f4eb-4195-ae57-b2ea3d5afd7a", "value": "T17122E725BBA86333D5360BB7A97352410772F25A68A2CE5E6C04512F6E5330187F3BB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273652, "uuid": "961b56ab-07ea-49e3-abcb-6e4130209e24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273652, "uuid": "ae5f9766-de48-4647-923e-34f534ac155e", "value": "96:RJSoFpD8BWcZ+CWjB3fRt+kIXqfCsZzHRYgDBYuydZRf5ELTkxOLSKKB1lqBmZzh:R8QfGX50Yuyt+5LSKKBvSMcH45to+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751273652, "uuid": "87e40dd3-af1c-4f90-b206-729ab3e7ca5a", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751273652, "uuid": "4e4d330a-0552-4dc0-b537-707a84e29ed0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273652, "uuid": "9004268b-b6d9-4cf0-af86-58b1a9b344aa", "value": "Outstanding Balance\ufffdPDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e789f52e-559c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751279283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279283, "uuid": "fbf377fe-d6a9-4503-b90e-050f28a03fd0", "comment": "Malware payload", "value": "d0de96c44c196871d00e604f2e61859b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279283, "uuid": "92e03fd7-461d-4d91-a851-0011e3b6c20d", "comment": "Malware payload", "value": "af943b44fc46a584d4f97a3bb1d848e838a4cc21ff6be11485969e6266cabba2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279283, "uuid": "2a5519cc-71c9-4ca9-b02d-7921bb99cf54", "comment": "Malware payload", "value": "20e4df045e86465dfe8e38218f0eff72ac07a011", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279283, "uuid": "48515120-979a-4c27-89a1-8c2778276190", "comment": "Malware payload", "value": "0a549f444ee688d65848ac85eae8b831787a7eb9514db2aaf596976b98db4042fd23901ab9018028b93192507afe2547", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279283, "uuid": "8b621875-89d3-4b8a-9f60-bd3a1040cffe", "value": "T10DA41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279283, "uuid": "f788d5da-b201-4935-9057-4d367d09361c", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751279283, "uuid": "5730ef35-431b-42e2-8c04-173fd0252d18", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751279283, "uuid": "4f5eb54a-a831-47dc-9c7e-5875b959246b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279283, "uuid": "7ab00226-7900-44f6-937c-6253ead6426d", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b1cf34-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1751291791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291791, "uuid": "e26a4d28-f4ca-4d87-a025-4df8ee9bde8c", "comment": "Malware payload (SnakeKeylogger)", "value": "3a1332171c63a3cbac8dc11649e51736", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291791, "uuid": "52d861bf-6a73-428e-a441-87883824b4e0", "comment": "Malware payload (SnakeKeylogger)", "value": "b02cfd7a9cffa9d0c420a912c25cb7533fcd7d844dcd8171d6ad767748b17800", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291791, "uuid": "a42db33a-11a6-48f7-8e03-7622da6ceba2", "comment": "Malware payload (SnakeKeylogger)", "value": "baa5cb912115b0d3d1ec7d18a953916783567853", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291791, "uuid": "c7f7a7b2-ce51-470c-b6ff-b9ecc8387a72", "comment": "Malware payload (SnakeKeylogger)", "value": "fd30f7b45442ff22157f8644df827f2b984a3eddaa163766bf912b040c24e52759390d6fe6052c2c7e6ffd68d163d186", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291791, "uuid": "46681a87-8921-45a7-98a6-24e41b4458c0", "value": "T1F2E412463736DC13C0E907F94AA1D27593B98EDDA811D3DA1FD22DEBB5E87012A40763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291791, "uuid": "a5b3cbee-906a-41e0-8183-69bbc7b35fb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291791, "uuid": "d3607743-2275-4c56-b768-2494e3e76bdf", "value": "12288:Cl/e9WeLfiSuXvkKL19Y36nFC1n+UT3Dk4XFvrrnppD1QXUya9vVDqjb:4e9dPuvLvCoCJ9D1XVD+5a9dWjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291791, "uuid": "fe6eec42-9e84-45dd-89b5-f4b8e1f41b84", "value": 719872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291791, "uuid": "7a9ea6b3-dee5-4147-98d8-4089362d2a71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291791, "uuid": "5e9823fe-65c3-4377-9333-a9bcc5e83186", "value": "FIYAT TALEB\u00c4 YILDIRMMEKANIK-PQ24-9208 30-06-2025 -P98731654.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2726ab2d-55e9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751312032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751312032, "uuid": "4d991024-4ce3-444b-8219-6036f2a0c8fa", "comment": "Malware payload", "value": "35e5a98afc57ec1a7a70c353439854d1", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "axis", "colour": "#820AA0", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751312032, "uuid": "57783cb6-5dff-44c0-9eec-7759f73891ef", "comment": "Malware payload", "value": "b1989d76664b8844c581dee24bfa204ba0649cf864c3d26473ef70ddeb96f265", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "axis", "colour": "#820AA0", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751312032, "uuid": "fd333844-4304-44f3-90d9-b33edf7c02cd", "comment": "Malware payload", "value": "9aecd244a138d8d0eb2e69d13f3fb82473f25575", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "axis", "colour": "#820AA0", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751312032, "uuid": "8b29f8bc-c4a0-419a-b7a7-ad8cff75dcc5", "comment": "Malware payload", "value": "72332be75ce0ea067de283e1ff930597b27b3f9516f6d01d02782433d7673b10daf043323166fc062936688e8299d18d", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "axis", "colour": "#820AA0", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751312032, "uuid": "5226e189-7915-4409-9055-f3196906f9be", "value": "T1ACF623E7BBD94D75C472A0B5982D17A1A51B9D308B579A0BAC04372C38F75E42FC8EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751312032, "uuid": "3bf90e4b-acd9-4f96-bbf5-4c666388add9", "value": "393216:UJHAkgw8xOOSOIk+aiI4zQpCaofskaivc2IYFlGyF:UJHAhxOOWI4zMCaof5/c2ISln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751312032, "uuid": "cd425571-e701-411e-8d53-23f790c5ed64", "value": 16514005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751312032, "uuid": "48d6c0db-512c-4a91-a3a6-ae77f32e8c53", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751312032, "uuid": "14913363-207d-4b6a-a20e-6f60e8cf9139", "value": "axis(1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27f597b7-558b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751271660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271660, "uuid": "ebda41a7-6511-4747-9343-6915b1ed8954", "comment": "Malware payload (Mirai)", "value": "e02ef2bfd80052fb7be8b1f4a0f039dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271660, "uuid": "7ec49191-44e1-4bf0-b94a-4f6cbbb68d03", "comment": "Malware payload (Mirai)", "value": "b212b55b9afd6dc903d3aee022e764cda02d82095b2d65dcab485417280ab956", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271660, "uuid": "5e37ec0e-5a7c-4ca5-832b-72da028dd74d", "comment": "Malware payload (Mirai)", "value": "0c00b453aa11669c21578a62e18d80b706980a87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271660, "uuid": "0d517faa-9ba0-4231-a23c-a4257d21bd1e", "comment": "Malware payload (Mirai)", "value": "d1542f7e5667b5f85b1901c605c138506982ae865e79b7977cd7560aab200cd9413efde0e0075f21c8dbdfbf7dd08dc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271660, "uuid": "57bbbcd3-99a4-4c66-86f2-df3c70bdcc30", "value": "T17DA34A67C8266F58C628E5B4B0B08F792BA3A95582875FBE1577C2748043DCDF50A3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271660, "uuid": "d57449dc-0119-4180-ae0e-f4f787d37c08", "value": "1536:Pyf8SdCjHuVVICXKgqYLP7oqi+9w2NWMVG2L6hSC:6JMHuwLgLU+BNWKG2eSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751271660, "uuid": "ffa25cc1-485e-48e0-8891-c4f1d8f7f556", "value": 104944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751271660, "uuid": "2582542c-6bad-454f-9acf-00ab71e222a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271660, "uuid": "650a0ac7-98d0-4c28-8d5b-eb0343d3f453", "value": "cutesh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44addca6-55af-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1751287170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751287170, "uuid": "1553a9a8-118c-4648-9753-8022204c65f1", "comment": "Malware payload (LummaStealer)", "value": "e7398216a7b187022e11af494cabd68b", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751287170, "uuid": "c8966a7f-b67f-4bca-907d-321245e84950", "comment": "Malware payload (LummaStealer)", "value": "b24477878c83be07a4a266902e4c51b3069f29d5b85560dcb8f5618df70a06ac", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751287170, "uuid": "c248c079-4d13-4282-896d-309ae7889495", "comment": "Malware payload (LummaStealer)", "value": "a09f5c5491049af01202c91388438ddf80cb4f34", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751287170, "uuid": "beec8a2b-bacb-45ff-a836-4956bbf642b0", "comment": "Malware payload (LummaStealer)", "value": "d98a442a1641dcf361f35eefb8b0073e51770089a6f97dec3eccfd9c46de762e4968e78ab24383017e8f5821a0db4a23", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751287170, "uuid": "b919e4bd-0cce-4b1e-a391-a31897765cf5", "value": "T174352265C2205CDEF4115FB2789405E10AD52B2136E8DEEF239DCF673E94A03DA09EE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751287170, "uuid": "d38a57ab-3273-41f9-8513-54d2785150b6", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751287170, "uuid": "3d275c70-d367-46da-adff-c14de624ca70", "value": "24576:h0aXgbZ+rNCT7oD4LAV4WAERtG3VQY17IGFX77KuTzuBRPn:hByaFMoHHs3V79Fr7FSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751287170, "uuid": "a2835c6f-eff2-4b59-9aba-6af8f1de479b", "value": 1099334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751287170, "uuid": "661f0bb0-f5ba-451b-a069-451931cee103", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751287170, "uuid": "04d6cc5f-77c1-47e6-83be-3450292385d6", "value": "\ud835\udc12\ud835\udc04\ud835\udc13\ud835\udc14\ud835\udc0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4318a294-55d0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751301341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301341, "uuid": "e4c95e42-1dd6-4f43-85c5-999c7147a034", "comment": "Malware payload (Mirai)", "value": "4eedb36460acd7115d170ab16be964fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301341, "uuid": "69922df4-6ae7-48ef-aa3b-378dfeda139c", "comment": "Malware payload (Mirai)", "value": "b2510b90cc924b8bde71cb86f3875a466de3a4dff19efa2cc4d93173f38a3381", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301341, "uuid": "ef655a6a-23e9-4e4f-9a70-ef900c58f559", "comment": "Malware payload (Mirai)", "value": "6cc0067a23e6a49c5fd935df864a8e6469e5cbf0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301341, "uuid": "f7defadf-8774-45a7-b2f6-7e163cc659be", "comment": "Malware payload (Mirai)", "value": "5adede7f530f16046f8f89345d53dccc1bc0b6e5c308feba5ea5b23c846e2dcd6d540bb63ae84b462cdda39e6e1ecb23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301341, "uuid": "969c66f6-dffd-4a3e-817a-8f39d61828cd", "value": "T10ED32A56E7414B13C0D61B75B6DF42463333ABA493EB730699287BF43F8279A4E23A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301341, "uuid": "eb2d8a7c-df87-4d75-bcea-62f664e8d34e", "value": "3072:aPmtU/qqdawJjsBBOzefzfvUyRpY9qGlbFM/9j:aPFyKawJjsBB4e7tR+9qGlZM/9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751301341, "uuid": "50d64e62-2c28-4e84-9a4f-a8719ac35b01", "value": 139206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751301341, "uuid": "c0549437-f50f-4a4b-bb11-53144e9c8a04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301341, "uuid": "eba30277-a405-4066-a4c9-2d98b3e700cc", "value": "cutearm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3413304b-5580-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1751266956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266956, "uuid": "84467d35-2244-48cd-bf36-cafb4d1c6b8e", "comment": "Malware payload (SnakeKeylogger)", "value": "e32ad3f866176497c6f75488bea43a7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266956, "uuid": "d110194c-8cf3-442a-920c-a2a2c27353c0", "comment": "Malware payload (SnakeKeylogger)", "value": "b2e9a4cdcfff86ed04abb8a1aacd185a35fce2d28beda0fc8b5b93c802e78e18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266956, "uuid": "f24015fe-dfb6-445a-8206-05b4fab62afe", "comment": "Malware payload (SnakeKeylogger)", "value": "8d26bc16c6b985bcf79dcb5ee2429894602b26b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266956, "uuid": "d9043e35-1dad-4f98-9f4e-60d10f2bded1", "comment": "Malware payload (SnakeKeylogger)", "value": "6d632db48d2316e92b30f6aa772f4fb641c983f07bd5a60c8b3b8ca3389af6cd28c09bb8b502f64451150e8b52c12407", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266956, "uuid": "85babc0f-1ef0-4fa6-9506-e728c15e7ceb", "value": "T11205CF29E252A3E5FD2640B944A1A255B532B933C2386FFF53A0E3335F077D05E2A764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266956, "uuid": "d6f281f5-735d-4515-bc2b-f73725ee5f39", "value": "a466125a9d0f2613cec3e55975386798", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266956, "uuid": "6b8e8af8-144c-4fde-9476-ab5a260f22b7", "value": "24576:QuE0Vsb8ImfhK0JgQkx3dIO920JgQkx3dIO9:LPVC8phK0Jgfx3d00Jgfx3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751266956, "uuid": "0ca09cc8-79a4-4cf2-a54b-0094f1c7c6b7", "value": 818688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751266956, "uuid": "5128306d-f101-4581-93de-8b446b6e5649", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266956, "uuid": "e7d56331-59ad-471a-a281-2d32e5db8e19", "value": "25032111UFUF25.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "336d8cfb-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751291866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291866, "uuid": "0694e11a-24a2-4ff9-ba9e-111fb96decc7", "comment": "Malware payload", "value": "c47e1647c19d350eedb44df9d8cf6a66", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291866, "uuid": "c911e278-d747-435d-9b33-850699537017", "comment": "Malware payload", "value": "b36d4a256902dad5087356cf0f368d26de11342c2069ebf677be8f10f3509445", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291866, "uuid": "1d6956ca-2324-4105-a3cd-90d7e65806a6", "comment": "Malware payload", "value": "cd95def2d87ad5e3a832ad09a2ebadae792df7d6", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291866, "uuid": "6057ecf0-4881-4eab-9ce1-d5204370e324", "comment": "Malware payload", "value": "4cfaa5c6e6ac2b0c46f34e597531ecc335924d0cd4652361ea60dd73beb43e40b63a902f521e00d81561b6aeb9bacc28", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291866, "uuid": "6c359cbf-7c37-4e99-a66b-6733cd105edd", "value": "T17221656717C6D750C14943B342E780E3C717A7E0BB0F9EB6A4806309C8D190A5CEC53D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291866, "uuid": "a7e06c7e-e7bb-4bb6-bb59-c0c6c75f178f", "value": "24:8ELK3uMEnb4AeNEmViGqtBJStEAJYu8CGsBzokMw:8EwVEz0EmoGqtHSqBvC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291866, "uuid": "ceef0fd9-ef18-45cc-b480-a02e43afedd1", "value": 1311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291866, "uuid": "96665960-3d3b-45cd-9677-20b48097d1f5", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291866, "uuid": "853a0b38-0f7a-4fea-b27f-72aeb72777fe", "value": "P6300424 \u2013 odkaz.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a21d15c0-55de-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751307513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307513, "uuid": "ca6ba383-cde7-433b-9eb5-a68d5f7ef421", "comment": "Malware payload", "value": "a068455a037fdc3a7f24728dae3ff20c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307513, "uuid": "78e2a667-5c04-4717-bcf3-8df92f982eb3", "comment": "Malware payload", "value": "b447327d85d1e90eb66ba6875fb88e4adafeb665448d317d068c6525e23218d8", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307513, "uuid": "be170191-5560-4e27-ac73-f66be28b72be", "comment": "Malware payload", "value": "2b3c321bc81eba95a42bed0589c9465c26f4506f", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307513, "uuid": "f1505f9b-ed6f-4e57-9997-0725803694d2", "comment": "Malware payload", "value": "3545f1ab653cb1da83533b5ee50c6f574185760fc09d73efc4ebda77f206f5eab266d27d644c7e48d4846eb9bb97b875", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307513, "uuid": "0e6798c6-c144-412b-82c4-cffac9f066f2", "value": "T11927334BEB0AEA22E6B3C635933646078A1A4D844693E7575B57B43C2CF3DC05B83DC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307513, "uuid": "7e0615f7-108a-4581-b041-5ab4cefa808e", "value": "393216:EY32p28tILZMADKgMBOdQ/39cThFyr8U5AFV4HQafoo5q5WmUkSczko78NKSBy4k:A/t8MgZdQ/tcvyrLzHtfoWP0ARRWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751307513, "uuid": "ca0ea72d-9578-4354-880c-5969f7df30ef", "value": 20486745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751307513, "uuid": "b37c80b5-1c55-4467-9898-099f95c9c2fe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307513, "uuid": "1d70cc1d-cd0d-4f1f-b75c-3d05c08ebfae", "value": "apk (2).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4c0253a-55d2-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751302418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302418, "uuid": "1658cd35-fb13-4b80-874d-e62f3b87f064", "comment": "Malware payload", "value": "06a2a6b3c00c0b4574b894860a5f5c71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302418, "uuid": "3f854fe8-061a-4312-bc82-a81394a96a36", "comment": "Malware payload", "value": "b4d2c633d425bf85c4c811df816cd8a41665be11d60f99856c374f2b9f4ee702", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302418, "uuid": "554f631c-2181-4bb6-96e7-6f34db71a7fc", "comment": "Malware payload", "value": "6ec005d5f70b3a6b339bfdb9f847e9624e14650f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302418, "uuid": "24c3ce26-6025-4c52-b76c-1f0f3859bbab", "comment": "Malware payload", "value": "857695b522a13074008ee333a684835c51e419643f78c0af8f21422b18105451994acf41a48c8f00e4333b796deaf554", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751302418, "uuid": "ee10c078-ed81-4032-815b-1aa18a30b979", "value": "T1FBB401CE9520D295C4B02D33C57BA2F282AB6D3609596E1CDDD8FF6B2CF67450638B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751302418, "uuid": "4bd22500-4081-4321-adf3-69674b8a2ae5", "value": "12288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751302418, "uuid": "d59ef3a4-c1c3-4d99-bfca-23aa41d77251", "value": 502120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751302418, "uuid": "b8cbbd84-f0a4-41eb-9baf-8737c95d9eb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751302418, "uuid": "013d2fdd-1c1b-47ec-bbbc-88b57dfe95c3", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c4cbe8c-559f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751280392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280392, "uuid": "8c57e01e-df1f-4906-a81b-88d6c95ed207", "comment": "Malware payload (Mirai)", "value": "0193aa5839daba021d7acb0ae707fce0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280392, "uuid": "184deffc-fd68-4fc0-a1a6-6b33f119c8a1", "comment": "Malware payload (Mirai)", "value": "b66d5566906a675fd39e61b5fbd5dba81e7ed06009e1e20e1b3f9b83695f70eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280392, "uuid": "7435eeeb-0865-4521-91a6-df1508ea6553", "comment": "Malware payload (Mirai)", "value": "40d69ad61ae9da82fbd9d3fcf80cdb0bac4de88c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280392, "uuid": "2a72d2df-1ba2-40e3-8836-61395b247819", "comment": "Malware payload (Mirai)", "value": "8ade59f3241c9963a85005a97d98705905330e240bb756e75343b4991ab145072d349c1ef5520450d00c5eabe1128972", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280392, "uuid": "dd82ad0a-64ff-4b91-965f-d7b494fd507b", "value": "T189C31805B30C0A47D1633EF03A3F2BD197EF9AC121E4F641256F9A8A9172D325685DDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280392, "uuid": "77ba9d0a-d6f2-498e-924f-e304dfa6e7f9", "value": "1536:xbgMZaVj1jJGKxWf3t67Ye3SmV88r+wRbEMDvANtaDjRe3O4xqCjcWa2U:xsEal7vxhY/s+wpE9vCJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751280392, "uuid": "3ea2dd74-af9e-48ac-b2e1-a017673f1ddb", "value": 125844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751280392, "uuid": "76269fb6-16c0-44df-8a37-d6c4a1db45a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280392, "uuid": "b33c2b6e-1be2-4c07-8fcb-51f6e48c7222", "value": "cuteppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4aed86b-5568-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751256891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751256891, "uuid": "8f0aec7b-25d6-4972-8f3d-6a1f8d26f2f5", "comment": "Malware payload (Mirai)", "value": "8f514f017464d815c243a1867660c702", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751256891, "uuid": "2273a34e-3cdb-4a61-a0b5-c738bfceb9ca", "comment": "Malware payload (Mirai)", "value": "b6d6ac4bb29f671fd57e2168e944c1d00045933fb27b182e1eec65f088978e60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751256891, "uuid": "12b318ff-864c-4898-981a-3e9ad3cc6d2f", "comment": "Malware payload (Mirai)", "value": "78daa0ad7ad7fe0e47e1d07396d10fa87a065803", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751256891, "uuid": "f48d8847-3903-4d45-a6a0-0f2636d72466", "comment": "Malware payload (Mirai)", "value": "cb19f82f59caa9542f9b1f6f43ff657c362a0b31b24455f4382507add56415917faa9f2497eb1e05469c446681bb6ba3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751256891, "uuid": "118811e4-4a2c-467f-a820-aa8868cbf359", "value": "T11AC36B73DC25AE68D664D070F4789F792F93A5A0824B1FBB15A7C270A043C8DF9467B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751256891, "uuid": "670741c3-7b36-49b2-b5c3-f188ef57c507", "value": "1536:yHzwto+In7V24e4VMM8CQKptrE73A1T0X7rQ+DWyuFLOjjYl+M:yHzgIn7de4V4ip2IT0LMqWykLOfzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751256891, "uuid": "14baebbe-0c18-49c3-b13f-b18e379b39d3", "value": 129380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751256891, "uuid": "0f6a97cc-7910-46ce-9806-ae6a405cca25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751256891, "uuid": "8913940d-c230-408a-8b37-5583325cd594", "value": "neon.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5706a5e9-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751243822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243822, "uuid": "97251a8d-2823-441e-b8c2-e8f037ce066c", "comment": "Malware payload (Mirai)", "value": "07b06328a5564a542d6a9a49ccfeb89a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243822, "uuid": "6c5818b3-e94a-4f17-99c1-5dfd20745c3a", "comment": "Malware payload (Mirai)", "value": "b6f9fec28a5fe5c24e69e9155a58bdb99af6ecdbf19f43cc6a1280c3e542347e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243822, "uuid": "4261eab0-d138-4b85-8588-08b3cd6cd731", "comment": "Malware payload (Mirai)", "value": "f6661e7635b65469dd0445e36a59d6ff89a832ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243822, "uuid": "6881ea3b-a9a4-4602-b121-5ede56e9575d", "comment": "Malware payload (Mirai)", "value": "d0c5c9b5f884f79f183fb8fc4513f55c2626e0f1036218bd847a09db4d566a02d553dab00a5491d813a2cefba5f7ce7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243822, "uuid": "51ef65cd-bc15-47ee-87a9-8a9544a74fc4", "value": "T1EB82C034209774F4CAE10835E77ACE8667124BB5E3FC32A312856B68DE4641A46FD3CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243822, "uuid": "e8c356b5-d812-4fdf-97ee-29db4c92e0eb", "value": "384:MnJzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUE/pXTi1dnhymdGUop5h5l/:2bV0P6+kom0tVAoNvm+tDti1dns3UozV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243822, "uuid": "8a4e9641-3c59-41a6-b715-0a78b2ab0cbd", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243822, "uuid": "0fede03f-64c0-4007-973b-ad0dc8560d35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243822, "uuid": "c4ab6370-ec5f-4e05-a5a5-273bd8a01be9", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50dc558f-5580-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1751267004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751267004, "uuid": "10bf5f3c-26fb-4f67-a7b3-32a3a684c379", "comment": "Malware payload (AgentTesla)", "value": "8c875f00711b4778b22509f380459e58", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751267004, "uuid": "9e9e62e2-8646-4ffe-bc0b-d1c31b1ec3e3", "comment": "Malware payload (AgentTesla)", "value": "b701915ad4195c38aaa73a5e369ae24d920922fa3ebe7bdeafe1717def792e01", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751267004, "uuid": "816d3f2b-13f3-4d48-90f4-331664bff71e", "comment": "Malware payload (AgentTesla)", "value": "3310806662f5ec75c45cfda6cbecc836fa436fa0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751267004, "uuid": "aa703928-175f-434c-8f44-1dce75206139", "comment": "Malware payload (AgentTesla)", "value": "7a01b6a84efcb4d4ce06308ccc7f51dc50b5c1c8e643a5a07059a563cfd313b9cfc44bba80075d563f38486d310d0c0e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751267004, "uuid": "3b32da5d-5508-4e20-8081-b0e5fcc81a42", "value": "T18845CF027391C062FFAB95334F5AF6115ABC7A260123A62F13981DB9FD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751267004, "uuid": "6ab078a5-5891-4432-8f11-1188aa352448", "value": "0b768923437678ce375719e30b21693e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751267004, "uuid": "f2e9f29e-0a1a-4bd4-bd9c-3c3931fe5ffe", "value": "24576:X5EmXFtKaL4/oFe5T9yyXYfP1ijXda/FjQ4enk09fKpeS/qzl//:XPVt/LZeJbInQRa/FjpKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751267004, "uuid": "e1548686-1248-480b-80da-d99ca0c3ee10", "value": 1273344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751267004, "uuid": "e4a4ed29-cdd4-4bd9-a321-ee947645fd1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751267004, "uuid": "a2ac52a2-ad44-4e96-80f2-02cde7289c07", "value": "Ugovorni dokument.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "218fcacd-55d6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751303862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303862, "uuid": "b7e8f481-6485-4cb7-a356-d5a385d10a3d", "comment": "Malware payload (Mirai)", "value": "2cfef3d5bda166325e173ddbe5c8c879", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303862, "uuid": "576a2878-80b9-4640-99d3-ac6295f5e446", "comment": "Malware payload (Mirai)", "value": "b753598a4fbed7ac94a38d7ff805c905afb2127604ac69050d463c75b4b726b6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303862, "uuid": "1b7b9104-9ae9-4b8e-9a0f-be1897004067", "comment": "Malware payload (Mirai)", "value": "0f8c1bb16baae80793dc9378dc07c850d577d4a9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303862, "uuid": "66db1c20-bc39-4484-8346-9bf301312123", "comment": "Malware payload (Mirai)", "value": "65f4240b50cafb8128d51b289bd27307c57fff33a259778705f0201eeba463ddaab29c9847d9c0aecc1188ddf543b8b3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751303862, "uuid": "94b081ae-b40b-4b6c-92c4-0853ff6b643b", "value": "T15111EEEE001E7444882D9D31B0392C41E68687E075A8DB85F4CED477F1A9E2B633AF4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751303862, "uuid": "6f9414d9-bad5-4f6d-a070-8e01d20bc0a9", "value": "24:bIIItIRGNINkInKMIKIDIGPI3SIaOI8I6f:8P27ns50GA3xaNj6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751303862, "uuid": "ae85ec69-dd97-4737-8d8f-e1d049b7c6d0", "value": 979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751303862, "uuid": "a7a15c39-095b-4cf8-9871-f82454e37945", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751303862, "uuid": "b8752585-913a-43b7-b1d1-4eb0d831989e", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20da4a4d-554b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751244161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244161, "uuid": "bc723971-19e2-4c12-860c-e6a240f27a0b", "comment": "Malware payload (Mirai)", "value": "762f3db5001012fbc54168907cca6c58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244161, "uuid": "7d497aea-1e35-42c4-9a36-44a93668d7ff", "comment": "Malware payload (Mirai)", "value": "b78b1514bfb67b6b93499422160decc3020f41c79bc1ce68314f4dac2881c1e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244161, "uuid": "a3db446f-219b-4b6d-b60b-86b280e2ad6b", "comment": "Malware payload (Mirai)", "value": "4b0d724d9d0f43e1f783f4ac354869ffeb6d4b59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244161, "uuid": "4b2c1e19-f09b-4920-acf3-0b85023af375", "comment": "Malware payload (Mirai)", "value": "f6a622dc74d8a9fb09f6a347ecf36d434fdb9cc9c9e0b76b9c69dd91be5f62bf3220e892303cddb2f81a5680f8c3dcc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244161, "uuid": "ed8fabe3-2932-44e2-a2da-072d286e0bd8", "value": "T1D273A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244161, "uuid": "5f5c1c29-140d-4b9d-9694-6876fe28b975", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerESt4:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751244161, "uuid": "d5f181bb-6c20-4600-b7e2-e953677b59fb", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751244161, "uuid": "0e13c738-2d99-4122-ba35-136ea6b2c1bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244161, "uuid": "0117a918-4ff8-4743-8de6-6c5866412cd0", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95060ddd-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DarkVisionRAT)", "timestamp": 1751292030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292030, "uuid": "d230b84d-244e-4915-8534-7c6854e9911b", "comment": "Malware payload (DarkVisionRAT)", "value": "c8a013a25fc58dc85b389d8cd6b9b420", "object_relation": "md5", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292030, "uuid": "de0bceb2-4260-4671-8c71-c8ac685566cc", "comment": "Malware payload (DarkVisionRAT)", "value": "b842ddc35525b66569d22aaa47c0afdb7efe6dbe4236d4f59af4dc8cba73e327", "object_relation": "sha256", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292030, "uuid": "d1420edd-c979-41a0-a1e7-194573cf7864", "comment": "Malware payload (DarkVisionRAT)", "value": "f23aa99edc23171726eba8ed4938e9b146994ab3", "object_relation": "sha1", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292030, "uuid": "412dcb70-d21d-49b1-8b58-f4111a4de914", "comment": "Malware payload (DarkVisionRAT)", "value": "47a044b2e950d93684d03d3ff3214d44b92f0cff75bfef4132fb94432b8e7f38932fa878d810f1a6c900c401373fa9c0", "object_relation": "sha3-384", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292030, "uuid": "4330ee8a-bb60-4f11-99be-44c18c510663", "value": "T1C8A4F847EB7551E4C87AC0788AA26323B9717C5C53346BDB9B508E531F22BE0E93EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292030, "uuid": "5a368819-ceda-43c5-b5bc-51bd9a528f3a", "value": "acd61b4f7cfd85185e5b79668f89c899", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292030, "uuid": "5b6f8587-73f4-4c70-8e3c-ea149dbe8ef4", "value": "6144:PYvIo4Jtmc7p5GYa2YS9c/LWq8ZAmT153a2fS/sflYuFR:lmc7HZIWq8+Xi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751292030, "uuid": "4e1e45a8-f7da-4e88-b83c-79c7d24faf64", "value": 453120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751292030, "uuid": "c9778399-ed76-4e47-839c-64637a03c5d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292030, "uuid": "148c6a73-170e-4969-a0ae-dd2ef5101c18", "value": "Request for July project Quotation 24566.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b3a6a5b-558b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1751271854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271854, "uuid": "707638e6-8883-48bf-bc8b-a36816bda735", "comment": "Malware payload (RemcosRAT)", "value": "e2ec75d14c46a1a70c156ed58c4dd559", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271854, "uuid": "1a2705ef-8ec8-4071-8ce7-264376a4bb1f", "comment": "Malware payload (RemcosRAT)", "value": "b8b40abd2fc17b67fb15d35362d2edca099d02f9489171733b3abfbd971c6a5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271854, "uuid": "c0e3e952-3bea-4747-b151-a3a361bcbd3a", "comment": "Malware payload (RemcosRAT)", "value": "35c7982380a8a6cf63738dcad7c101d3e12da7e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271854, "uuid": "aad2b0cb-4d8b-4035-8b41-b6c469fd5a6c", "comment": "Malware payload (RemcosRAT)", "value": "71088d16b8925876f23b458092a628b6f0a043f5ae8ec02f13c8c7e73046725be06849da01b7b37c410c6b52cf689149", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271854, "uuid": "f9cbd874-7328-438b-9a02-a1b6b57abfb0", "value": "T1981522097A75885BC2A717F12E31E2B253BD8DCC6101E792AFD67CFB34A1B116980B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271854, "uuid": "9e90861b-6d0a-4b49-8aab-56c226fcd7e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271854, "uuid": "7eb72a06-668d-4553-87b5-d01368831474", "value": "24576:XDbbPEbEEh7u0iNWniHOLoHySgLeHWmwKzrFWjbS:zbbMAEh7hi2gt2mw4rFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751271854, "uuid": "081db680-ee21-4956-876b-85e90356500f", "value": 931328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751271854, "uuid": "a06beb02-82b6-4585-a6d4-af33ce5f4111", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271854, "uuid": "0fee808f-1f4e-4d13-a3e7-7f7d3e8c5ba3", "value": "SecuriteInfo.com.Trojan.PackedNET.3358.8143.1554", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8807bcbb-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1751292008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292008, "uuid": "26451af4-d332-4985-8425-5999bf39a049", "comment": "Malware payload (Formbook)", "value": "0d28a8299e4f63e491c997a370ce33eb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292008, "uuid": "9291f377-3910-4053-949e-89bf7ed6d58b", "comment": "Malware payload (Formbook)", "value": "b903648925f1e924cfe18019ad2a45e324244d3c3f4f975b78b05e4f9873f007", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292008, "uuid": "72c83b70-f634-4dc9-8b37-4492c6789bfc", "comment": "Malware payload (Formbook)", "value": "dd0a06f442a5a036a2c599cae0a6e2e53d5d6007", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292008, "uuid": "8bac8ef1-2131-431e-8931-e01bf91f3b60", "comment": "Malware payload (Formbook)", "value": "4c26e951f2ddafccbebc3254d944bdfbe59c064942557fc3db3a78c42cda7c86bc10bd2e4573df8ea1f41136e4789567", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292008, "uuid": "eb93901f-e07e-40fd-af03-d382a837ee0d", "value": "T159B3C122E7BA4128B1F34B8D96AB10324B777E56163CC48D05CA734A4FF3A4598953FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292008, "uuid": "dd9da1d3-1e74-4165-b9d2-0042dee7b196", "value": "3072:B56APfDA2pk7iulZoScRcRcRcRcRcWcRcRcRcRcRcRcG:B5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751292008, "uuid": "42329388-1c38-4e07-bd90-9ea7f596c23b", "value": 111310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751292008, "uuid": "e2dfd247-5d2d-4cbf-ac61-fa706d876cbc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292008, "uuid": "b179c462-f162-4539-b23a-f2c21f7887c7", "value": "\u0395\u03b9\u03b4\u03bf\u03c0\u03bf\u03af\u03b7\u03c3\u03b7 \u03c0\u03bb\u03b7\u03c1\u03c9\u03bc\u03ae\u03c2_30 210261.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d75e3c-5550-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751246644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751246644, "uuid": "f6ca33b8-18d9-4f76-a25f-8f3c25dfc44f", "comment": "Malware payload (Mirai)", "value": "37474fd30c8211afe673b59d3b3dd890", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751246644, "uuid": "b8a528d7-41d8-4035-b5b0-500c57f3e8fb", "comment": "Malware payload (Mirai)", "value": "bb3b94d82cb7fce9a815816dea2dc960a82d0e66698ab094621905ec8849d053", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751246644, "uuid": "63e99e29-3c20-49b0-8b7b-b87bb8f0a75d", "comment": "Malware payload (Mirai)", "value": "5611f1bb47ee744c0466f1837bc75e5bc0cd1b06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751246644, "uuid": "9e4c8568-e81c-456e-a874-25703cfca2ac", "comment": "Malware payload (Mirai)", "value": "8752493e113a85d67b4a11b21e3df2f47f36d49f8c1260162c75941288f8fda120cb49ba588efd1fccf2d01d9b1476d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751246644, "uuid": "ea88007f-939b-43f7-995f-b1a835784c86", "value": "T1201301D0122127C89361DA3938BE302BC434666F32F92D403DA7A18EE54B71658B7EBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751246644, "uuid": "a4284915-f6b5-428f-add6-8a33f2d7342c", "value": "768:/kAKuobq1rduMGAXSEYEYv6DjbChaAUKvNvy0OQT23MTGU1DkKe:87vbq1lGAXSEYQjbChaAU2yU23M51Dje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751246644, "uuid": "61dc5978-2189-4c6b-8664-4d947fea120f", "value": 45500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751246644, "uuid": "ffaf63e3-3527-41cb-aac8-8bf09f098ef4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751246644, "uuid": "a6e0c8d9-b09e-41c8-80d4-7e297153f074", "value": "SecuriteInfo.com.Linux.Mirai.6523.30735.17372", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e09458b-5595-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751276100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751276100, "uuid": "2ac59d96-cf38-4b63-b99e-e94b71388532", "comment": "Malware payload", "value": "7a00c15b4b35459329e2e9c5c0d98e4d", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Shopify", "colour": "#541B62", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751276100, "uuid": "a303a01d-fb70-4924-b77a-ed56f658de0b", "comment": "Malware payload", "value": "bba808c12437ad32e94db62ccfd7bb5a2e0470bc17c0039a7a1b42e1be079cfe", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Shopify", "colour": "#541B62", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751276100, "uuid": "6f2c1257-cbe3-40d6-8d00-7e41b5f9189a", "comment": "Malware payload", "value": "52cf541cf2b67a174bbbe3210ac2210a11df39ee", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Shopify", "colour": "#541B62", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751276100, "uuid": "5fb67983-5a93-4141-934a-2e6eae362f63", "comment": "Malware payload", "value": "ea9f060971ffd1b914255fa87f09651ca47f5e4fa530b9b6c0a97f4fd56b67c1ed68fad94b5854428f463f696fa13b6c", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Shopify", "colour": "#541B62", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751276100, "uuid": "58603ddc-5959-4032-a8ee-8b9f0ee6216d", "value": "T13BE63387FB4BE967F1A38231937A475A69274D448507E3472B85B92C0DBB9C08B85FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751276100, "uuid": "22cc5a2a-5a82-474c-a91e-d9dc71848ea3", "value": "393216:FrTDdUZoXIzWd5h3b8836xjIVMZoaaWdSsp2zBN66eVE7:VTDd0igiLrFqaWdSwkAo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751276100, "uuid": "5c45b9ad-bfc3-4615-aa04-9822f9eb17ff", "value": 14859078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751276100, "uuid": "9a8e966e-0b20-43c7-8b2c-182782243232", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751276100, "uuid": "8816acb8-07e2-4aad-b6b0-c6c5d910feeb", "value": "app (8).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a8b036-55b6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751290338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290338, "uuid": "8bbdff05-a1d7-4f65-89d6-ee46381fc944", "comment": "Malware payload (Mirai)", "value": "a33c3060f179d6f90f43b9363f671df6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290338, "uuid": "f154f13a-d6b9-4aee-948d-86c039466b89", "comment": "Malware payload (Mirai)", "value": "bbba2bda7da7efb69756fe094dac5971e9591e3e314ecca63df2d85c56f2727b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290338, "uuid": "1cbe7937-ac32-4647-9ca0-a6d7be645323", "comment": "Malware payload (Mirai)", "value": "5a93c02387be64bb8cc867c4cf73e03d6f9fcb01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290338, "uuid": "8ccd6c0a-2208-4177-b28e-7bce95e1ebfc", "comment": "Malware payload (Mirai)", "value": "6899207145b176af220a17d48cdc038c797e83478fe03e169ce5fd4a3088f575b5d54541d467797f2e4df782dc939a00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290338, "uuid": "205cbf1d-3063-4c4c-a281-29667d3be2d0", "value": "T12EB31846B941AF11C5C325FBFF9F41493303AFA8D3EA3211C9245FA4378A9DB0E66616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290338, "uuid": "f04731ca-efbf-4541-9aa5-959acbcc12d2", "value": "3072:+C/fGt+6x/N21Maq8+3L5LoRaKu7WmD5jfkpaUNxixcFKnGHG://Ot/C1V+3lkRa77WmD5jf0aGixcpHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751290338, "uuid": "888d25d6-7f52-42e5-ab05-2b5637492bc6", "value": 117772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751290338, "uuid": "c7bf2171-3691-4e61-b74b-e6f4065d2015", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290338, "uuid": "65a4827f-c47d-4293-b9ec-7c0884872db9", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf1f3ff-55af-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ACRStealer)", "timestamp": 1751287075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751287075, "uuid": "3cd5635e-282a-48a2-be14-8146712f6dcf", "comment": "Malware payload (ACRStealer)", "value": "d24f5e6b0af882553ab140fb10b8afe6", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751287075, "uuid": "4ddedd93-b5fd-4537-a9aa-c2e53cc2f09f", "comment": "Malware payload (ACRStealer)", "value": "bbc8db645229fd5880895f1717f3d3776602b77f4709f423e9b213edceffdfee", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751287075, "uuid": "b87baa41-981a-40fd-9bd0-1e1f1eb50c31", "comment": "Malware payload (ACRStealer)", "value": "c50727282fefb4b0db6c667b61640574eb9fd23f", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751287075, "uuid": "011720de-9838-49ae-a5c7-a2a6b5695ca6", "comment": "Malware payload (ACRStealer)", "value": "fdf82d7bdf13b7b03274fb2bf99a598ba31c1aa31bc4149ba941eddd1cc87bb95a6a0d7fc12837f5725da0550f18f252", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751287075, "uuid": "72cac8eb-d658-496f-b59f-a2f7786eca66", "value": "T1AC27A3F65318932AA86B38137DC213F5113F82D774057E3E366EA6082BAF364979B711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751287075, "uuid": "d644157f-08f1-4b92-ac4d-dc566f7a5019", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751287075, "uuid": "8590c1f8-318e-401d-9e87-a5dfd721f009", "value": "12288:K0aMxsRsOxqYrtii8/DRVGKI3S5OPafx/wDERDLQm/HYzJnGjTSJNT9cxYkPR:K0absQixzG1hE0eDLP/YzJKTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751287075, "uuid": "e10cba2f-f4b3-496c-9c9c-31c0141821e3", "value": 20981928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751287075, "uuid": "431808dd-b056-45e0-8478-3fdc9a5f6c16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751287075, "uuid": "62f724fc-d49e-4da1-bb88-c52c6b79638c", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf7e485a-5606-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751324743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324743, "uuid": "74297f95-5795-415a-8267-e557714be264", "comment": "Malware payload", "value": "c9422c85e159a160b7f959a058a98786", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324743, "uuid": "f0a64298-186c-4cda-8371-32f4b3fce384", "comment": "Malware payload", "value": "bc2e3ac6a4938544c470ebb27673c0a447250be84dfd74a8ae9c058f62821d7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324743, "uuid": "91215f4e-3a50-4d63-9fcb-ca8e683c95bf", "comment": "Malware payload", "value": "d9295a0f5fbf865ee75a4e35108c561b5748e56f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324743, "uuid": "568d8171-4ce9-4903-a41f-627f10a9c6ae", "comment": "Malware payload", "value": "cb54bf6a07513083da90a175e5fad7477506099e9ba72df25acffdd05a0a53f13bb7df3ad4c9226ec4b5394222b436c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324743, "uuid": "8c801840-8c0e-41a1-9b98-f282626a22ae", "value": "T1C5B401CE9520D295C4B02D33C57BB2F282AB6D3609596E1CDDD8FF6B2CB67450638B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324743, "uuid": "c0584e44-09c2-4110-a400-cda18bf2bbf5", "value": "12288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751324743, "uuid": "7060dc94-e1df-4f72-86ed-8a30ea88de02", "value": 502120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751324743, "uuid": "b9163e16-24e7-42cf-946d-7baa0e9a3e9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324743, "uuid": "a033d741-cba7-4e9f-9530-3f76df41cbed", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6bdd61f-55b7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751290905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290905, "uuid": "7bbdb3d5-394d-4c64-9ee4-4b75b93dc4f2", "comment": "Malware payload (Mirai)", "value": "1891c6baec8386e2c868879079c1bbf6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290905, "uuid": "bb876d57-a732-4d89-ab61-4532967f931b", "comment": "Malware payload (Mirai)", "value": "bc5313f7b5cbdcbfcd2df355309801b306df467067482b470c02efc8a2269199", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290905, "uuid": "29866b1c-4477-4357-bbf8-779678c0e0af", "comment": "Malware payload (Mirai)", "value": "d8f5e5001d6eac9903f69f0be316beced3236d66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290905, "uuid": "c91f6263-243f-4152-b542-9bb676bcd7ea", "comment": "Malware payload (Mirai)", "value": "73da139f85530a8d27aaefee993dc27720a366509ad03de9bf40ae434fffb90bf30981b0debc008c28e1b67d092b0343", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290905, "uuid": "ff33806c-4ff1-4c69-a234-9b946c2547b0", "value": "T101537D8AD657C5F0DD4609B0107FFB3EEE31EC362120DEA7D7D4B967A9A2612A40325C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290905, "uuid": "6815a97b-da9a-450d-8b76-0b3ad243037c", "value": "768:YhKys3c2JQ5R5BAKlj5b/rcwsCEDY4P3en/7IKIYjQdGW1H7JustK6SxJaVYe5PK:EWsD5BAKljp4wqNkE4+LE6S+/IocM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751290905, "uuid": "6f04624a-bc7e-439b-92b0-39e05e92353b", "value": 62464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751290905, "uuid": "122da276-280b-4e99-9121-b06aa444144c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290905, "uuid": "692a22f5-6759-42fd-a2e1-e92a00bc538c", "value": "mirai.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33e3a04-55e9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751312374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751312374, "uuid": "9b7dc95a-190b-48d6-b2c4-9614281f0344", "comment": "Malware payload", "value": "bf16ace7c29c7688331d0516b01a25a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751312374, "uuid": "8de728a1-9cbd-475e-be1d-5761c652baa4", "comment": "Malware payload", "value": "bc5d307898660f41fb03cf318cc34dc22a73aa380877474773af3b7a7b1b3871", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751312374, "uuid": "36a6584d-f139-4484-ba79-bdb62658a89e", "comment": "Malware payload", "value": "efed480ceeb6365a50a4159c2e29408622cc48f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751312374, "uuid": "5be7a5ca-34b5-48ea-b6cf-ada15e69d8bb", "comment": "Malware payload", "value": "eaae63d30c93f371a881f222355e5706c4ee5272bd4fc7a8db94932b4f3543857192d8e1992c46b4b254fb2f573595dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751312374, "uuid": "8de9ca17-34cd-492c-b60a-5697309d3055", "value": "T1D2F413197A1D9D13D0BA5AFA08A0E3B843B88DDC6112D3CA6FD62CFF74D57112A82753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751312374, "uuid": "46a45bb4-44dd-4500-88a6-b52815cab34a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751312374, "uuid": "bdc46fe3-b5c9-4c23-9bed-451211676579", "value": "12288:8BdfKFKz8jgAtsSkFxFpOHovnAoM+f9QJhyogPKE7GEHYADGbB12Ojb:gfKbjOx3OHcDMfkogioH1GbB12Ojb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751312374, "uuid": "63ccd298-1479-4889-9f89-9c0442bed6a3", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751312374, "uuid": "b185815e-8b71-45a3-90db-c40c22583f09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751312374, "uuid": "881d57d2-ae70-40ba-b59f-f272658a583e", "value": "AAZORDER321202025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b12fb085-55af-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1751287352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751287352, "uuid": "71c41188-cd34-489b-a726-917f9d4dfbe0", "comment": "Malware payload (LummaStealer)", "value": "2727cdc000899b9fcee17e23521e1c69", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751287352, "uuid": "5c08b582-eb1c-4505-a6c9-bb20d39d7ca1", "comment": "Malware payload (LummaStealer)", "value": "bc9c5c8dfdcf0d2a321478207b0870274fba25b93075fc987768623237973646", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751287352, "uuid": "1702a7cf-ca89-4995-b4f2-4bc2bd01f6c1", "comment": "Malware payload (LummaStealer)", "value": "08d22b8d0a95843932e5fdc2c338a454858bee0f", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751287352, "uuid": "673fc1e4-3419-4b44-9365-d30ea35cbcdc", "comment": "Malware payload (LummaStealer)", "value": "4907cb9dec91f35855ccef6afbcd0403526233c0c5380238c0a4497d10e04f28335b50de71864b27ca28be1e8648abc6", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751287352, "uuid": "ab1bd5e5-7efa-4947-bf33-4db7ea081d60", "value": "T19D2892A0231C93354C9764DAFE1B6AFF6071E0E130912E57293EB48563778E9EA4BF41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751287352, "uuid": "06fdd715-ac38-43a7-bf78-83d49b7180e0", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751287352, "uuid": "b880ee71-fcb4-4f2a-bf33-a5d9f63e685c", "value": "24576:t0aiiefqjhZDVVe3JbgPQkc8a5Bm3t9kgxcUXuw:tReCnZVeaIkc8a5Bm3tVPuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751287352, "uuid": "f0d1411d-6f87-401e-b214-8946f67b648b", "value": 97536841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751287352, "uuid": "a04ef85d-44fe-4680-b83f-c66a24fecea7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751287352, "uuid": "7a2013b6-3591-4f5b-b478-5b44656c72dc", "value": "\ud83d\udcbf \ud835\udd64\ud835\udd56\ud835\udd65\ud835\udd66\ud835\udd61 \ud83d\udd12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c7b98fc-5580-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1751266997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266997, "uuid": "83b0e3d0-c987-487c-85dd-0a1dbef45f99", "comment": "Malware payload (SnakeKeylogger)", "value": "49560394ec031e2488f08d1aa6d7e3ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266997, "uuid": "587e6b21-b515-4805-b310-81982c0b4fed", "comment": "Malware payload (SnakeKeylogger)", "value": "bca9aa6afa59d954082fb4602d4d1ace3be386c99a069bab16d7ff0553689955", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266997, "uuid": "438c4121-e4bc-49f4-bc92-8ef5f0899b9a", "comment": "Malware payload (SnakeKeylogger)", "value": "bee23412ea9cd038d6908f61f4aa421a8418d84d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266997, "uuid": "46ca2da4-d811-40a5-9d68-7c5416fa827a", "comment": "Malware payload (SnakeKeylogger)", "value": "1bcd1c4b7064eab2c8bcbfd93520c113bcd3724aea936c781109d7500a386743021b376cdbed26fd3ff946de2c613884", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266997, "uuid": "372d42db-9038-4d19-88b9-1eff778107cd", "value": "T16845AE0273818062FFAB96334B56F6115BBD6E260533E61F13983979BB701F1463E6A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266997, "uuid": "1e93223d-b165-4b5a-8d84-6cff87e06479", "value": "0b768923437678ce375719e30b21693e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266997, "uuid": "e913b041-8b08-4e42-8cb4-85fe4b88c128", "value": "24576:B5EmXFtKaL4/oFe5T9yyXYfP1ijXdaadlh+ehg1K+v+w:BPVt/LZeJbInQRael4eh4K+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751266997, "uuid": "9e2770ae-4d6e-4ba3-92e4-e29cf5548798", "value": 1239040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751266997, "uuid": "4a95d9df-4b90-485a-ac1e-4203266863a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266997, "uuid": "23e8fc97-ef8a-407a-91b6-f118a7c88ed3", "value": "S2240 Shipment Enquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f885264-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1751291994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291994, "uuid": "b2eb940f-1408-4412-b28a-d17fd5d4e2de", "comment": "Malware payload (RemcosRAT)", "value": "2172879d3c97f967092d25f39585c3f0", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291994, "uuid": "33fa7def-e7a5-4728-ad72-9f692860313f", "comment": "Malware payload (RemcosRAT)", "value": "bce64b45bf63f5867086a9490b9b11d7c50e8d2ef5702387c86db39e45ad50fd", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291994, "uuid": "1fc18cb8-1c33-4399-bdaa-fd9e0bfe3ab0", "comment": "Malware payload (RemcosRAT)", "value": "a1b8def09914b4139074b29399c100c814a1e6d7", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291994, "uuid": "85901600-5010-4a1e-a0ce-890ed281f757", "comment": "Malware payload (RemcosRAT)", "value": "37a3e4faf989706972d0b0fad06fc43809cd55ccbf56b79ab2ccef995d720dd91a0ad65235e6d95a003034da7762751f", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291994, "uuid": "e6d8f511-93c2-4497-ae42-6a86d4293292", "value": "T168C5C05D94B05D922024FE74AAC5F793CCEA17851A174B921FE5E2A63202C43FF7B362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291994, "uuid": "e48742a3-ac7c-42f2-bb55-062f5207ae9f", "value": "24576:bXLWA6CVKcC1QQHK/bYViQ2KS4cxXnSFO7lVjQgbj48Cx7+LmtNC+uW:bbVtcf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291994, "uuid": "8524f68a-0063-4856-837a-c67c092c5b30", "value": 2622310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291994, "uuid": "1e9b1327-91a9-4558-b040-59de935489e2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291994, "uuid": "ae265836-ea36-4019-91a8-3c9dad09f060", "value": "SWIFT_Transanction_pdf.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8225ad38-557f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751266658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266658, "uuid": "8b1e6e1f-392d-4445-a782-7486ed234ad4", "comment": "Malware payload", "value": "9611aba962fc7ab35dc806ed9d6e7f2d", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266658, "uuid": "fe0b133a-88f5-40ba-9622-3c10fa84dccb", "comment": "Malware payload", "value": "bd5abbdd50946fa9d18c5711787cf8da3b1655475cc7f7a491cb46b5e61b30b2", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266658, "uuid": "dc17e027-4013-4d23-8af8-d9520ace5820", "comment": "Malware payload", "value": "4cd713838db7521ef88cd3c65f14d55a38b858f1", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266658, "uuid": "863db5c9-be9f-4ec2-b14c-a2f22f2ad848", "comment": "Malware payload", "value": "7ed652016c5ef92f57da59936eb6df303daab58c6cc817cc6b5a29025d058afbf4d2b90571f985bf009acd8319ca1cc1", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266658, "uuid": "118bd9da-fdd2-480c-af94-699aab09f16b", "value": "T189450181FFA28E5AD859433149F74B682B25FC4067634B0F2358F3197DF2AA06E57722", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266658, "uuid": "7cd980fd-bbb0-4dfd-b70c-e743b4753b2a", "value": "24576:KgMsTOeD3eMRD3d1zIEvndYUb4+BMFbOmM3+ECenBQ:hsMl15b4sAhM3+ECa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751266658, "uuid": "c19f2c9c-aba0-4c01-99e1-34df222f1a8e", "value": 1263104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751266658, "uuid": "b164baf6-f5c9-4be8-8565-a398e2d85dd3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266658, "uuid": "4dea7d60-b41e-4afa-879c-a26261df7f67", "value": "9611aba962fc7ab35dc806ed9d6e7f2d.malware", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2419a4e6-55d6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751303866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303866, "uuid": "7cd6303f-688b-405d-bc08-c4d21f931fd7", "comment": "Malware payload (Mirai)", "value": "2e85c77c2373809bc7b934ef80d120f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303866, "uuid": "de39eb3f-aeb0-4f1b-9509-20125e5025fd", "comment": "Malware payload (Mirai)", "value": "bd9985dcf472642b9aa9acf0f50fced0c4c92c917bdae04a5adf37c09ffcc5ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303866, "uuid": "d045d596-6baa-40c9-a9bc-d1519b9aae75", "comment": "Malware payload (Mirai)", "value": "6f434f16f26970bc654602aedfe661dd7ab34f27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303866, "uuid": "2479c78d-c4a2-4445-833e-9ce489a5fd9d", "comment": "Malware payload (Mirai)", "value": "ca6d7015c50cc32023c3f3fbbbe2180e859615d957358c4ac66d78031758e5ee894db6e79bc6a5154243687972d5fd23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751303866, "uuid": "71db0f97-d45f-42d1-8e0d-269e1a3cbb93", "value": "T11B73E657F8419552C8D096B7FA0E02C9375BB3A4E3EA320399954F30378E8693EDE6D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751303866, "uuid": "68d67c02-0ab6-43a2-807f-e96ebf1d15cc", "value": "1536:+vBjcLRNZU8RCJdzJP1ph28Dbrq/cuPGSI/Pq/7Scj3iX8u+gUOJ76:+vBjcLRNZU8RCJdzJP1ph2kbrq/cuPzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751303866, "uuid": "2e20cc51-34e2-4801-b11f-f789fe524e1c", "value": 75124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751303866, "uuid": "e553cbef-cf0f-4aad-a765-c936a66f9e52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751303866, "uuid": "319973e5-571e-4d81-b435-14911c0c2bda", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b003ccd4-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751291216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291216, "uuid": "48d7c759-b0df-4e2d-8f9e-d65576634438", "comment": "Malware payload (Mirai)", "value": "e866340d756c185324607b647d68c461", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291216, "uuid": "7d21ff9f-704f-401a-a610-e7db249231b6", "comment": "Malware payload (Mirai)", "value": "be069da00c628d67e988a5845bea7adb3d64ce017177ec99f21723733ae7bbcc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291216, "uuid": "e8f8ae25-dd46-4299-96c2-10802112798b", "comment": "Malware payload (Mirai)", "value": "1ed3fb19cb923cb3f6bf79c1a283d39a93344b32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291216, "uuid": "87985926-fbe4-4e2f-956f-b408bd404077", "comment": "Malware payload (Mirai)", "value": "730d6ffe226fe1370fb9013a50019585175c1040c710e621c8b648dc1c89b115bcb7230446a3b97b36ae9c3b2f937d6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291216, "uuid": "cab6857e-a5e8-433d-835c-c51712bdd8e9", "value": "T13A4319C5F48B81F9D50B4D309057F23FCB71D52940B1C6ADDFA9AF35DAA7A01960228A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291216, "uuid": "cea17c81-6ca2-4e65-9c53-26f79a308bc9", "value": "1536:ovlFCsZE+rKI2Z3UK6gj6VGsskC/iu6Qp4Ha:ovlE+rJ2FUK6gjaFsN/6+46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291216, "uuid": "bece258f-ae65-4e3d-ad74-d369273e7b56", "value": 56068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291216, "uuid": "a7979107-665d-4ede-8ffd-c763199958a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291216, "uuid": "81832436-2727-4912-8a01-f768fe64f83e", "value": "miraint.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d9c2c2-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1751291820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291820, "uuid": "e875e2db-b7bf-4f34-a4e0-67d3560fa7c1", "comment": "Malware payload (SnakeKeylogger)", "value": "37e350948972a4be683db63e42755413", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291820, "uuid": "5a77b3e6-284f-4cb9-af63-9238f2a67840", "comment": "Malware payload (SnakeKeylogger)", "value": "be7855cbace4c35a3525ee28c84ae6a84c3e0ae2c1862ec37627a33c4677cd85", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291820, "uuid": "961aee4a-f55f-4edd-a5ab-61b6cfb94b77", "comment": "Malware payload (SnakeKeylogger)", "value": "5a9a4117d404db622bd2f434dd76918d1a086631", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291820, "uuid": "2f563bb5-0fb2-45bb-93ec-acadc1c90e01", "comment": "Malware payload (SnakeKeylogger)", "value": "7c34b8c254a918704d039955fe1852367a2420ec2cf67e448429b6386df6f6f882fc069f9a7e67f4db89ae4dc28d0cfd", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291820, "uuid": "9cf7efe2-bcb6-4208-9a2c-385f838a584d", "value": "T166E4124576A6E923D0AA0BF90A50C27453BE6FCCB811E7925FC5ACFF75E23291981703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291820, "uuid": "fcb30722-1e3c-4f77-a136-6368230fad55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291820, "uuid": "525bc9bb-8868-4c68-a82e-c17f581122b1", "value": "12288:10gKmjZcKa/ZhmsUHnsA+N/Cc+auAW449VTNAtiyTh5xi/XEeeec9cPKBsrL4lVH:QmCPhhgnWBCc+UWzAEAtiPle5cPEsrMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291820, "uuid": "3062d61d-b768-4013-ad02-e31d8a0fbe37", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291820, "uuid": "b4312fe9-9172-4a23-a4d6-529f2a426639", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291820, "uuid": "e60e619b-c6c5-4287-bea0-b850bb0f03a5", "value": "DHL EXP. HESAP EKSTRES\u0130 - MAKEL DIS TICARET A.S.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c74fb5-55cf-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751300804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300804, "uuid": "ff50a7ed-9337-408d-9fa8-c3390f9078ff", "comment": "Malware payload", "value": "9cc14694854396162b7327c779a4b5bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300804, "uuid": "82b53e11-0d77-4ca8-87ac-e92287cc674e", "comment": "Malware payload", "value": "c00db190f7e0b8b5c5786960f7a752169cb4e7a756ddc6fcf1f319297dca0c3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300804, "uuid": "933c538a-23c7-4286-b209-863df98b8645", "comment": "Malware payload", "value": "70902119e11fc4c025da223403dfe185609d86aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300804, "uuid": "9ca6f5a0-5fcf-431e-a7dc-9a5e0c2a4d32", "comment": "Malware payload", "value": "29c52e4813a354ec2b45f45fd4d121ba856cf74aff8d6165730ea23e8b9afacacb5add9e87da25dc152d4f1a621bab44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300804, "uuid": "857a34b6-4625-4d8d-9faa-3175e5113060", "value": "T1BDE4F1037308A756DF4BA83A82CBFD31B7C2799113D096667A80E29F8775726CF0D649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300804, "uuid": "b485fca1-579a-4f20-b6fc-bc6d691e9128", "value": "12288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751300804, "uuid": "18c6ab78-e0d0-42b3-a26b-02cf2d906ac3", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751300804, "uuid": "c2083d26-45fc-4de0-8cee-6acfc1f97352", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300804, "uuid": "3e37470f-ec5f-4f10-b2ad-39ae438a5ee9", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "497f8bc1-555f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751252819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751252819, "uuid": "ee410e72-88f0-4db6-8c19-3cd7f97d9bf8", "comment": "Malware payload (Mirai)", "value": "94dcc6dbe2259b4a73dfa8f6de9f6c27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751252819, "uuid": "ca653ff8-2def-472b-961f-1583c9cd041b", "comment": "Malware payload (Mirai)", "value": "c0203d4a204525281f9f39bbfb62946d8162852000256dbf45629bcd2cf50c3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751252819, "uuid": "a55d7d18-e662-49b4-bf33-eafa6751966a", "comment": "Malware payload (Mirai)", "value": "167c817448fc12ad36019ff73e4b069e3119813f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751252819, "uuid": "f315b8b9-aa0b-475a-ac19-9e9a479275a2", "comment": "Malware payload (Mirai)", "value": "39b772924164ef4102b7dc20c4708dcf480b13a183cc901f5e13f27013f280a3e0bec936ec78d530659e6701c77640cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751252819, "uuid": "d9137c18-94e3-4411-b68c-028e9009f335", "value": "T1F4F30946F8819F26D5D111BAFE0D124E37231BB8E2DE72129D246F707B8A87B0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751252819, "uuid": "08d321f5-4c5f-428c-8d57-7f23cc23ca53", "value": "3072:HJod3/v4Xn/XYSaBvRJp/Fu0EwqSy6is:6d3YX/X/an9u0iSyVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751252819, "uuid": "157fda2a-5cb7-4aee-b21d-539b56c77b43", "value": 158428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751252819, "uuid": "96f82d4b-67e5-4ac2-b143-4fde7642cdb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751252819, "uuid": "74bdeccc-f13f-4151-84b5-a6e46d4c3854", "value": "neon.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7515d692-556a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751257616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257616, "uuid": "b7cc7857-296f-4094-bdeb-c3838849faf7", "comment": "Malware payload (Mirai)", "value": "2b44c898fc17fb404ec1b2beaec8d6f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257616, "uuid": "63af2b6a-a1b7-4405-8071-742b1bd95da6", "comment": "Malware payload (Mirai)", "value": "c07f3fb9f3251b3448ddedb0169a4b69d6d614eaaa70bfb1b91a180e812352fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257616, "uuid": "54ea3c49-d45f-4f5e-8df1-7fd5ad69b33b", "comment": "Malware payload (Mirai)", "value": "4c49c7e1d4aa64df4f4ebf52aa15d80d2c195e55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257616, "uuid": "af427cbf-4366-496d-a1b1-7372d49944ed", "comment": "Malware payload (Mirai)", "value": "a9917adbf5ed1e7ea1a0822c02571cd484a3462d55e273e021fc6fe616a5d9b404b5e82e3fca9ea97eb558622d94d154", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257616, "uuid": "a3001b75-eb53-46b2-8ad8-8250e8aad498", "value": "T19314D70AAB520FBBCCAFDD3706E90B0139CC645722A53B397674D528F54A64F19E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257616, "uuid": "3d21a371-bd44-4a08-8262-d8b2075cbc84", "value": "3072:Fld1JMDPUwwSE48OAHnGwiEhjkrTtTG1ZaB:Td1JMTUyEcAmw1wrpGZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751257616, "uuid": "6f757587-5a6e-46dd-a2af-13fe0549a23e", "value": 198384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751257616, "uuid": "91d6a86e-46ab-42ba-856a-d95a60e6a859", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257616, "uuid": "c84e4481-2b5c-4462-bf5b-5583d17985f1", "value": "neon.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7838b6f8-559b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751278667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278667, "uuid": "e0fc3b09-d0fa-400f-9cd8-27fa842f5388", "comment": "Malware payload", "value": "a70aafefb980b90d435b619140cf4374", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "Exchange", "colour": "#76A307", "exportable": true, "hide_tag": false }, { "name": "Kraken", "colour": "#145964", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278667, "uuid": "036de288-b85b-425a-a30e-c0a7829e0db5", "comment": "Malware payload", "value": "c251df83fd43149f21db90641baa885c4dcd7c8b868c8046b456afbbb01f76f9", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "Exchange", "colour": "#76A307", "exportable": true, "hide_tag": false }, { "name": "Kraken", "colour": "#145964", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278667, "uuid": "7eac9e16-618d-4c46-8873-f4fbde147584", "comment": "Malware payload", "value": "655c62e192c90db4313a65d16ee71516ba544b6f", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "Exchange", "colour": "#76A307", "exportable": true, "hide_tag": false }, { "name": "Kraken", "colour": "#145964", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278667, "uuid": "d6e60fb0-ffd1-4cfc-b5f5-4b934b4c4438", "comment": "Malware payload", "value": "2d0d2eb31ace917888d1fbce04854333bbc4c4b84073a334c8a596899da4e07b9fd12d1259d57d28edb738cd9eb54791", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "Exchange", "colour": "#76A307", "exportable": true, "hide_tag": false }, { "name": "Kraken", "colour": "#145964", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278667, "uuid": "168248ec-edba-472e-80b6-14038491a302", "value": "T154F63356DB89F913D863C1368777465726090C6C4212F7923EAD702C0BB7EC4ABA6FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278667, "uuid": "b5361c86-2593-4ff2-953b-51b2c919b2cd", "value": "393216:K7e16xd7JisLlhBBW5Md3F9hBBW5M3hBBW5MzhBBW5M5hBBW5M1xT:K66bvBBW6NF3BBW6xBBW6FBBW6rBBW6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751278667, "uuid": "e07f627e-151b-4757-baa7-983dc286026f", "value": 16220312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751278667, "uuid": "6aea0741-6c8d-492f-841c-717b270ac62b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278667, "uuid": "102e6c2f-0111-4077-b83d-ed8e5821272f", "value": "Kraken.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee7a00f5-555c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (NightSpire)", "timestamp": 1751251807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751251807, "uuid": "1626a2c6-bf4d-4648-a7c7-15f67d6f9d1c", "comment": "Malware payload (NightSpire)", "value": "cc1da5f900c8d38f4d56006549e6734c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSpire", "colour": "#1B04B3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751251807, "uuid": "d5960d71-dda7-4a94-89cc-e9f64be335c8", "comment": "Malware payload (NightSpire)", "value": "c2859adc342cbcc36485ef6c3020913c459079acbeae3456b44297d7704f6853", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSpire", "colour": "#1B04B3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751251807, "uuid": "aa5368d2-d69e-4cf2-97e4-2321bd461fec", "comment": "Malware payload (NightSpire)", "value": "9de183c7e9f7c57e53a49721b891681f50babd60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSpire", "colour": "#1B04B3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751251807, "uuid": "bbaa7724-7c68-4588-82ab-87b899a78757", "comment": "Malware payload (NightSpire)", "value": "d3466cf0fce5b423cd0c88f2e6fe124bd5c1a648927fc1ce487ab654fcda68c502bf7f53570de9f847117f3af2c7216c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSpire", "colour": "#1B04B3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751251807, "uuid": "d0df47f9-997e-4c6e-a7e3-617b544fafed", "value": "T15BD54B17FC9669E6C0AAF231896291527B61BC483F3123D32B90F7782F72BD059B9750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751251807, "uuid": "34d1f428-170e-4682-914b-a04e51e97e30", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751251807, "uuid": "ade82f44-2437-4088-bff3-41b3c64b90c1", "value": "49152:K+R+xprDHMf7Dj40WddpvMc4yaL21KxK9Kx55E:KCJCDGvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751251807, "uuid": "af34161a-1232-4eea-ae36-ae57e0ab08e3", "value": 2989568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751251807, "uuid": "071ab394-a631-4ef5-a535-de88bd820b37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751251807, "uuid": "c24936a6-47c6-4e65-b45d-fa28daca35f6", "value": "c2859adc342cbcc36485ef6c3020913c459079acbeae3456b44297d7704f6853", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab431471-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751291208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291208, "uuid": "003a6480-2999-4adc-9ad0-7612daee9889", "comment": "Malware payload (Mirai)", "value": "c31a64a72582fd2381261b0b63e8d3cf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291208, "uuid": "13459058-8f9e-44d7-a319-590d2d606d6e", "comment": "Malware payload (Mirai)", "value": "c44ce4c7309d9e220ba5604c539871e812814286bb2be42c3bd23234e96f34db", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291208, "uuid": "86ff7138-8213-4151-a94f-0f0dc4dc9d05", "comment": "Malware payload (Mirai)", "value": "e82a8a1445a7dab8da088fff9ad250478f73a8ab", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291208, "uuid": "c19e797d-0388-4958-acde-5838902b706b", "comment": "Malware payload (Mirai)", "value": "9e8f2398569bc8cb8e8167e508b3b343f557d67a6549e7a1288605cf919c084d8e230113232ce6a4d44d229081a18fba", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291208, "uuid": "d0771667-56a3-414d-ac5b-7748bb75b254", "value": "T1E2511A9A10A218B93DA39E63327E4AC132C1DEDE50C65F5DE8DD78F440DDE087060AB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291208, "uuid": "6543f781-d99b-49e9-9821-efb9e24888ee", "value": "48:v8Zvmvus0ja9aUGsTgbOmTZ24XJ5S46OY2W4Z:vEm0mUWTgymTZ2455S46n2W4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291208, "uuid": "f3e85429-c82a-4a96-8d9c-29266474fc79", "value": 2444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291208, "uuid": "62509e1f-29be-4dfd-820c-21fb8cc742e1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291208, "uuid": "9cdf37c7-82e1-4138-ad60-13bfc6a29733", "value": "faith.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d21544-559b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751278879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278879, "uuid": "aafbfba8-6138-4467-9b9d-6cc4a3f26f1d", "comment": "Malware payload", "value": "2f47e10aafc7d657b43bf7cbb1fa7fd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278879, "uuid": "2fa94287-7635-47ae-b466-30e980fb73c8", "comment": "Malware payload", "value": "c45465f5007a5dbeaaf60995405974a7970b850026a5500f6fb1ee5ed60601cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278879, "uuid": "e4d218cc-860c-46d8-925f-15b87bc7650f", "comment": "Malware payload", "value": "1fea34fc2cc492c641c4da850ccf04b461d18d08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278879, "uuid": "0c27e76a-c94d-4782-a702-8bc2607e63e3", "comment": "Malware payload", "value": "513d9035e0450e3203eb19ac0ec224407aa018e72a87d808de1a6bba2cf200b83dd3c59d16cf562af95b8aa4d62dc852", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278879, "uuid": "92c4b22a-3b41-448a-97ba-e50f22e7ab44", "value": "T12BB402118F881F8BC5BFCD750A2E167311AEDD9F46CA643E807CDD48B6A6D096783C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278879, "uuid": "92fafa93-846d-4e1d-9c5f-665a99f8a3f2", "value": "12288:7A84JF9Qc8GgZxTM6m1U3snB6NnVuqnAtSyBpywBdlEykR6LkV6N0L8AXwtZJHZz:/M6m1U3rVuqAtSySwY1gEIZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751278879, "uuid": "2203520c-8f1a-4063-837c-3f36fb6c3f20", "value": 509272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751278879, "uuid": "b5aed9d4-e760-41a4-a7f5-6b2c48c15a62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278879, "uuid": "6c7c1d0f-afaf-479f-afba-37fd5a5d5413", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467eeb0b-5580-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1751266987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266987, "uuid": "43cfb8d2-a550-4a9d-8663-1ead2120f1f8", "comment": "Malware payload (Formbook)", "value": "f0305e15c97c4393b3bcca721e31b8c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266987, "uuid": "12623621-bc21-4957-96a3-56fe8f3fe5d1", "comment": "Malware payload (Formbook)", "value": "c469e3b39fb0f585e8aec2d841d6d8e6b59525928009e29287928e1bc6d0f972", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266987, "uuid": "8b5ac765-f504-4dda-8074-45f4e6f9ce10", "comment": "Malware payload (Formbook)", "value": "d3a85a33917e4914edd69a2575625400083f4555", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266987, "uuid": "3f49b809-3b93-49e9-9162-9c18510e34ac", "comment": "Malware payload (Formbook)", "value": "8405409ee55e34353890358bdf3b5fc464c8d74e52c49a4ede864f9aa839481400aba86bdbcf87b44537e8d6a49f079c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266987, "uuid": "4b8f04ee-cb23-4866-902e-e1bb257ced4e", "value": "T11E45C02373DEC360C7725273BA567701AEBF7C2506A5F86B2F94093DA920162521EB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266987, "uuid": "ea2f8533-29a2-408a-bad5-8fcf4d28934e", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266987, "uuid": "0d58e83a-8883-4c83-88bf-16daa5744c08", "value": "24576:Htb20pkaCqT5TBWgNQ7a6J/gF+sTzVMy3AE1g6mytrduK6A:EVg5tQ7a6JoF+Ez3mIZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751266987, "uuid": "bdb61a3b-87c5-44bf-a4b7-382ee8dfb6ec", "value": 1190912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751266987, "uuid": "bb341184-62ce-4ca2-80c4-5d93dba29256", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266987, "uuid": "42817d28-007f-4dc0-a27e-710bcb5ba059", "value": "PAYMENT_COPY_TT 3006009993184895607242454362616625636366226268776445548000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f3ecc56-5569-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751257016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257016, "uuid": "35bc1aae-5311-44b0-9a61-c3d781c891a7", "comment": "Malware payload (Mirai)", "value": "d60164fd4e60fa72849585660a0a73d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257016, "uuid": "b07ce13b-fee3-4a49-bb41-bb238a499c37", "comment": "Malware payload (Mirai)", "value": "c4ae8904aee46f96f9ff643e6de4c06effd9609e278cca8a385e7e3def324e1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257016, "uuid": "27946757-b8d6-4c30-b822-c76afc6e72ba", "comment": "Malware payload (Mirai)", "value": "01d13bf31dadcbd53078a31d37d8649723295214", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257016, "uuid": "5b2347dc-d4e0-43a5-a5a4-dcd7fb8e0808", "comment": "Malware payload (Mirai)", "value": "9a76ae4d436bc94a5f42642e4ba5c05c820f3ff3ec8ba12ccea503f77182ccc45603fc1dc9800955a111a33632f67322", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257016, "uuid": "09f1f146-e940-4c85-beb6-f967362fc385", "value": "T12F93196DF9928A12C6D215B7FE1E828D7B171398D3EF310B8E254F11679B92B0E7B050", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257016, "uuid": "f6c908e1-45bd-42da-bb7c-bb3c597dd9a4", "value": "1536:bhLg3ha1ufy51YbP8bYlqljClSSlHl3lkHDldlplLplilJlKlrlRlZlw/l3Jl0lx:FKha1kyrWiYlqljClSSlHl3lkHDldlpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751257016, "uuid": "c3532184-d0e0-4ba3-8766-289e6e2baea6", "value": 96749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751257016, "uuid": "5c440093-5791-44de-8983-d68ca310efea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257016, "uuid": "58b4790d-c4fe-471b-bed2-b7c90404f909", "value": "rondo.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92bd14a9-559c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751279141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279141, "uuid": "0e8e9b36-6e05-4a1a-a38e-8dbfb423d306", "comment": "Malware payload", "value": "f8f0758b078602c5c0cb2ff93b881599", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279141, "uuid": "9d8b774b-06db-4f26-b936-33ef711c7b08", "comment": "Malware payload", "value": "c4c571a7f457952b61e86d272dde2a7d85eedc76ccfdf88c62153c8e75af5b8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279141, "uuid": "d95a746b-769f-4165-b0d2-78afe888e048", "comment": "Malware payload", "value": "cf204511969730fb3c077810f6e67bc03c68b268", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279141, "uuid": "b60a48bf-a3b7-42a7-8e70-461ba006f208", "comment": "Malware payload", "value": "9962f10bf15d2a88bf4168e11e202bf5f149862d0107b112ee7622b3b6cf0aea8c1ed113c16476a9aa9eb83e3b5c5d1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279141, "uuid": "4b60604a-bd53-4e00-adc9-67f3d4684a02", "value": "T19AC4F1A377204F91C35195B209F389335AF6199706F29982537DEE107F20A6C386BFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279141, "uuid": "108501f8-bb9d-4171-bfea-4e77ba0893e8", "value": "12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7zy:W7v+mrY2xzf03yvZ/YIS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751279141, "uuid": "964f7b81-64a3-48b1-98b0-ff4341aba6e0", "value": 592688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751279141, "uuid": "9c240966-ba52-4d49-bce2-bf8315199042", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279141, "uuid": "aad87c43-2b5d-4d82-a0d9-ccad5ff0c973", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0681c57-55e2-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751309336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309336, "uuid": "4fd7af25-561b-4aa5-9876-be02417c4b61", "comment": "Malware payload", "value": "6a3f2b3ee5a199b710a1801549e5b310", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "Drive", "colour": "#3ED7F3", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309336, "uuid": "dbdb795f-a1fd-4cde-b217-9960cf498343", "comment": "Malware payload", "value": "c545f72d7f515777963ce778d8aa6e53f9fdc907b0caafd86e5dfc1cbd606209", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "Drive", "colour": "#3ED7F3", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309336, "uuid": "77543494-633f-4460-88ae-86c515abd657", "comment": "Malware payload", "value": "93a014c475c573d1a9c94fa1ea28206b15e7f962", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "Drive", "colour": "#3ED7F3", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309336, "uuid": "b51fa3fc-d158-4a97-bcd0-5118c0e9bbf9", "comment": "Malware payload", "value": "791d533d367554cdaa16cda6e5f504f2cf186595d2cabaa4d18dda29622e9e004f45088c14916db2a96f5f19e1f7f3d0", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "Drive", "colour": "#3ED7F3", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309336, "uuid": "4f9af236-68fe-447d-b298-5350640e0158", "value": "T1DD87E107E6926E31F96E033479B74741B7337986BB439BC32049E5687DA37C19F4A288", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309336, "uuid": "6fbfb189-4237-47c7-827b-9b9b591e25da", "value": "393216:2rBPYqhskL0WxyrI0M8oaaWdSsp2zBN66e8CqxILJUNtKLZNh0a8YUPE+DE5RXCS:2VlsjuxGaWdSwkAoaLiNtKLrhYPEJ5Rp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751309336, "uuid": "8ea82e8f-fe7e-41d4-b476-ec03963fa470", "value": 37598465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751309336, "uuid": "9112ca0d-7306-407f-bb73-c0bf034bc4d3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309336, "uuid": "6080abd1-f714-4591-9919-ec61cb6a0159", "value": "app (7).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2438f421-5592-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751274660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751274660, "uuid": "7e205d17-8842-419e-a907-dbf61c673f5c", "comment": "Malware payload", "value": "2fea84289e1b679e3a2d837412432aac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751274660, "uuid": "566ad991-9017-4f59-8de5-604be908bcd1", "comment": "Malware payload", "value": "c558262df81e8a7d9ecff058a95ce429fefa647c8c02fdbf1130ffd6e032c8b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751274660, "uuid": "4681de1f-f818-4863-8603-0c95e9b20cb9", "comment": "Malware payload", "value": "5d4449d52ad43040dc03f6f952832ab78aa1143f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751274660, "uuid": "3e47b144-8dd3-424c-bf6f-8623d91f63cc", "comment": "Malware payload", "value": "5d11e043ebf319e1f1742898bf2a59fa293910800a0233dcb227b18295cb522db487939e938379cf4d0e224572a79622", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751274660, "uuid": "d4725733-6445-4c6c-b078-542df6d7bbdb", "value": "T199B401CE9520D295C4B02D33C57BA2F282AB6D3609596E1CDDD8FF6B2CF67450638B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751274660, "uuid": "ca155487-5886-4537-a288-fb36cec5b3e0", "value": "12288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751274660, "uuid": "beb1a67f-e5da-41c3-bb6f-d838d9f5afb4", "value": 502120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751274660, "uuid": "61e2e1a3-ef89-4e2c-8c16-ec5433725e86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751274660, "uuid": "d68ef443-a44d-4c93-b545-b499f430b70c", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35cef3f8-5580-11f0-8bd0-42010a9c0005", "comment": "Malware payload (GuLoader)", "timestamp": 1751266959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266959, "uuid": "0e2c9fd0-7103-4988-ab72-fb2af63c5b61", "comment": "Malware payload (GuLoader)", "value": "23b93af6e41258de21beaa82446c91d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266959, "uuid": "e84dc3c9-be19-49a1-a11d-b7e3f7fd61cd", "comment": "Malware payload (GuLoader)", "value": "c5630906f63c7dde15439147088fe7608183b4b423dd1215051e4a4265771119", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266959, "uuid": "91e59dc7-222c-47e4-be3c-433709e78915", "comment": "Malware payload (GuLoader)", "value": "4b7d6352af7203164cdd560cfa0d925b815b0939", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266959, "uuid": "fe052e2c-7129-49fe-9346-dc8d61daefdd", "comment": "Malware payload (GuLoader)", "value": "d3b6d4e34e6c2e3f031d775a47b6a49c1c6e3eb8409047ac0100353dfceb058de69b6d7771624093f2ff4a330f6c1fdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266959, "uuid": "08c05097-c61a-4266-9afb-d80c6be73b91", "value": "T170F413506634C647EC4A193F0D3EFA123674DF3678B2158B779472986A393B2F805FA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266959, "uuid": "1e1315de-7d69-4a98-9014-9b62a5ba5c8b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266959, "uuid": "11f91649-3771-4085-8766-ac69254fde64", "value": "12288:BYS9skLDLS7GJ7Poj2tYPgqxIHUnw3TFfgEtkaR4BIUx/63fWZf2n+we0vE1:BYcskLHSGYhIqS0neT7kx/9ZfHwe0vE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751266959, "uuid": "665d216a-803f-4ce1-9cba-49487dca2112", "value": 771920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751266959, "uuid": "7bc98e32-1ae1-437a-b0d4-0f68dda9d5d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266959, "uuid": "3ec93a95-3a94-474d-b7a6-dc4486ac07ba", "value": "Aforementioned.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e87a085-5569-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751257015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257015, "uuid": "750fc215-e119-46bd-b791-b452e29740ca", "comment": "Malware payload (Mirai)", "value": "f983328acd30c2a80c97e191c07c98a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257015, "uuid": "691ca9e8-e350-4b7a-85d2-120b568e459d", "comment": "Malware payload (Mirai)", "value": "c5794991f1ceca147265864150f2a8c245ec60ab0462abc0cf2d00543b74b3b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257015, "uuid": "a729075b-ba94-48a0-853b-75b06488e696", "comment": "Malware payload (Mirai)", "value": "4ec969017a570cb7babadc0b59484642eaf802ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257015, "uuid": "d540bd0b-c1c7-452d-8f6e-d1229fe59fe2", "comment": "Malware payload (Mirai)", "value": "1a5314d817fe389fe5693ad165d8a3286e689a83bb76979bccf6374ab8b35e9c306a1ce5e3516486adf5e4bf2197947b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257015, "uuid": "b0e1da33-9696-438c-8fe3-4c7a29e6eb49", "value": "T123A37CD4F683C4F6E81701751036AB379F32E4BA312ADA83C3A8AD35AC62551D91B76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257015, "uuid": "348ca69a-ec4a-4b24-bfaf-20d2b5abfbec", "value": "1536:Ro3f95nrSxs0zijioAuQkyecjeBE5FNOYOOJKMpySLCDvC:Rov95rfDiwQktHB6ONO1bmC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751257015, "uuid": "688f7bb8-d196-4eac-8c92-aa32fc51a27e", "value": 99340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751257015, "uuid": "8d6e4f71-17f7-4f74-87b8-a8dc05949708", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257015, "uuid": "8849235d-cc21-429f-8c24-afec53460b26", "value": "neon.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e2e15d-55a1-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751281206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281206, "uuid": "aa7eeba3-e22e-4ed4-aa70-1a6ff3ac1e07", "comment": "Malware payload", "value": "101825ad964438d9fcb808b037683719", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281206, "uuid": "ae748ad1-89ba-4eac-9ea5-a0ba7316ec93", "comment": "Malware payload", "value": "c5de614c37ff4209a14f7b1a7bf9808745aa96078dbb0c7f6ba2535b36ba1437", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281206, "uuid": "c558452b-fe00-441e-a41d-3ed6be0048ba", "comment": "Malware payload", "value": "5d5c9e80f287c1a04c1febaba0bedee855cb6b28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281206, "uuid": "f2b398c7-54c2-4891-ab52-846ff74e43da", "comment": "Malware payload", "value": "25fa709d3d5f75f9fc9bcf7722df9eea7aa00b847d96b92273148484cdcc2f0428f1a5a4c1488f480d5f589c2bc3ba80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281206, "uuid": "ba862e48-2897-4d6e-8b58-b4002c852d53", "value": "T1A2C42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6D742F661EDB1B424A9E66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281206, "uuid": "e1868289-a157-42f2-9cad-ecca571ce578", "value": "12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751281206, "uuid": "5876ce21-4dd8-4c89-bf76-0eef66512704", "value": 587764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751281206, "uuid": "10612e6f-4c17-45da-9061-dce0071b1730", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281206, "uuid": "f01808b2-f3ec-434b-9fea-38a5e85ae4d3", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dca1277-55ae-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751286837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751286837, "uuid": "4ef07068-d409-4e46-bd92-c53b8bfe07c9", "comment": "Malware payload", "value": "47b84ab49666e8d0d8b567d623af271f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751286837, "uuid": "1b1d277d-e10f-4358-9e9b-70aa6d6b2b1a", "comment": "Malware payload", "value": "c64b86f7e6eb7bff6d84cb45764a93ce65a7811a517dba5efab216466d702e75", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751286837, "uuid": "e7eadc67-7044-4b3f-904f-fbd8da89c8c9", "comment": "Malware payload", "value": "bc1cb7a0e52e0c1eed7cf205542f3f6162c28b17", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751286837, "uuid": "bb2394b5-a93a-4f81-9c39-603fad8aa54d", "comment": "Malware payload", "value": "7cd03cb91c4f35a7b613e8900873fb07d2eaeb84ae041059495efcd312a02797ccdd4775bff045c8f2b294a9e986cdd6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751286837, "uuid": "8947f8ba-2417-454b-8a60-8b896e2fc14b", "value": "T1B6866C52BF9FC0B5CF4A62B0080EDF0E8539E1488B556ADFE28B9E571D112D16CF9E06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751286837, "uuid": "eea80610-ede7-489f-9d6d-5f8e6b6ab532", "value": "ea4c24180f72eaaa4b62f97d255bd680", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751286837, "uuid": "1ff8baf6-18ac-43e7-8707-3475652180f3", "value": "98304:5xf1WZBthheu5S2K50WyBZpfH9b7S9FzUab4PugZf0:5xMZxVSbSZSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751286837, "uuid": "c5ee937e-3abf-4d94-b22c-27f7fef05530", "value": 8437760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751286837, "uuid": "3f65d13a-c0ac-4ce5-8daf-3488377728b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751286837, "uuid": "ef743277-d546-47de-88a5-5f4741b4779a", "value": "QtGui4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a0409a0-55b7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Amadey)", "timestamp": 1751290508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290508, "uuid": "0aa55e83-ae1f-45b9-a2b6-2cb6944037ea", "comment": "Malware payload (Amadey)", "value": "d6ea75d40605352af1b07211bbf5966a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290508, "uuid": "606e3be9-0397-4b3a-88f1-fdc3bd035dd9", "comment": "Malware payload (Amadey)", "value": "c7050b4d7c0b17267a0b38b40d37c03118d25551a804cb2cd644b1dfed3def89", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290508, "uuid": "80fa192c-14d3-4f03-9833-d06cc903086b", "comment": "Malware payload (Amadey)", "value": "da6497aaf5c4ec10f922fb746333fa3d296c5856", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290508, "uuid": "29c33c72-6069-4a03-9a3f-3340f5ab38ba", "comment": "Malware payload (Amadey)", "value": "067ed5bd37cd93b8d4f8ebab7751a25b389dabab8da413035af363b3df31d29be105eb034d307f18c56eecaba40cf390", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290508, "uuid": "175332a2-ce82-464c-a1e2-01840bcfc54d", "value": "T12B939555791AD031C690A2B236B97FF5E4ADAD39A7B005DBABC00F7295012F73931E38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290508, "uuid": "844a86f9-2675-41ca-b11e-19bf32ef2531", "value": "1536:6mkPUITO0tK4O31gvSlxbqkPIIBbn2yAIUs4Fk:6JPUITO0tKh317lx2DIBb2yAIUHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751290508, "uuid": "0c6d7551-ad1f-4e5b-afe9-3532cb8174fd", "value": 95867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751290508, "uuid": "77464579-716b-412e-93b7-7d79bc08ffbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290508, "uuid": "70ae614c-2c40-4c1c-bf0a-ccaa7276a413", "value": "d6ea75d40605352af1b07211bbf5966a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811cb6f4-5605-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751324208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324208, "uuid": "4d0c538c-7368-4af9-8d78-262913130b41", "comment": "Malware payload (Mirai)", "value": "568a169d42a19f8a47f253e38f3f6774", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324208, "uuid": "4a5573fd-4b56-4c5b-9da6-8d443d61aaf7", "comment": "Malware payload (Mirai)", "value": "c76e7bf10f20ce1a107ebf3f1c4ef36ad7a0344c7213c46c3c90cdf828ba5d80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324208, "uuid": "5328f9f2-542e-49ff-8445-a4462cea49ab", "comment": "Malware payload (Mirai)", "value": "29203033d71cda75c63dff0388f8a6dcc3d8929c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324208, "uuid": "b8cd68d8-6763-4035-8910-2b92b22381a1", "comment": "Malware payload (Mirai)", "value": "fe0971d5b13651d657c8996faaa0182e593bb8c2e2e0e5eb882d31bcec4a13a2ad45146aeedc5ca9b85e33ac845854f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324208, "uuid": "d198f283-c003-4592-ab05-a98e56b6dcf8", "value": "T1A873E649F8819F11D5E922BBFA1E018D331757A8E3EE72129D206F2467CA92F0F77542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324208, "uuid": "45037368-f2c7-42eb-b7a1-642570b3ebcb", "value": "1536:XKnZjZFBNTM/dYDWRKqUUBpgL++D1z7YBc6NlDIiR2zk3lK:QPzTMYDoKqUWpgL++D1z7Y1P2zCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751324208, "uuid": "bc8d8d7a-23ef-4bf5-9154-5176d980c6ec", "value": 75772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751324208, "uuid": "b2ae36b7-4b56-4a6b-acbc-e633a6bbf042", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324208, "uuid": "745b67e5-3580-415f-8211-fdca4024130e", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc30006-55b5-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751289900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751289900, "uuid": "9b564ef9-4506-49af-ae66-e3cc939e8305", "comment": "Malware payload", "value": "9ae1a976c76c3569c888229345ceb77d", "object_relation": "md5", "Tag": [ { "name": "dgrescritorios-lat", "colour": "#494784", "exportable": true, "hide_tag": false }, { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751289900, "uuid": "e2a91256-424e-4346-af95-b05db148b72a", "comment": "Malware payload", "value": "c7d8c51b3cf44bd8ea4e6e3824e55c9094f0ce6784228fb773f40a2983d15af9", "object_relation": "sha256", "Tag": [ { "name": "dgrescritorios-lat", "colour": "#494784", "exportable": true, "hide_tag": false }, { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751289900, "uuid": "fe6233f3-332f-47af-9ab9-e81efef9c3de", "comment": "Malware payload", "value": "4213b73a7bf15df2d37d0b432ee0da7de179a435", "object_relation": "sha1", "Tag": [ { "name": "dgrescritorios-lat", "colour": "#494784", "exportable": true, "hide_tag": false }, { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751289900, "uuid": "04388c8c-6afb-4d20-bd5a-8fb7cd7b874f", "comment": "Malware payload", "value": "460489edc2f74a3170f9b0b38962cc3b79485d036ea06bf635031a0f4e86f6ffac3a439c60ccd18f1dd02965586205f0", "object_relation": "sha3-384", "Tag": [ { "name": "dgrescritorios-lat", "colour": "#494784", "exportable": true, "hide_tag": false }, { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751289900, "uuid": "96dc84cd-bcdf-45f4-9053-16416ac1b078", "value": "T130063345CB867AF3163F5E819E0C9DD4E8B423182C2F4289BD0B5398A5D76377272CDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751289900, "uuid": "129aa21f-fd24-49e1-b30d-b9ce55ab8b75", "value": "98304:Fb9nLE+4MstraEpVMKOYPqxL45fy1cZscT3HLCAtWO:FxQ+XsMuVMK5qxaDsU39WO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751289900, "uuid": "e3523468-8985-499b-8fd2-42131a42583b", "value": 3977462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751289900, "uuid": "6ff5bbdd-9aff-4ad3-924e-bfbc7193e699", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751289900, "uuid": "c32b3347-7311-4099-a257-d6f361c634ba", "value": "Nota_Fiscal0c3461195174.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699531da-557e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1751266187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266187, "uuid": "56303430-865b-4565-97f2-e3587646dcfe", "comment": "Malware payload (ValleyRAT)", "value": "ef7aad0fbd1adec2d1168fa2d32ea2c1", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266187, "uuid": "df82f52d-bad4-450e-9a89-5ad533dc4d10", "comment": "Malware payload (ValleyRAT)", "value": "c7e04f27a4dfadb90270ef0ffd93629df9a7395a0f49d0c2a386eb35fd666f3c", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266187, "uuid": "7ef40770-7ab6-4386-9bae-9b002c671069", "comment": "Malware payload (ValleyRAT)", "value": "d7af728e7523f1c405c0f3963317ac669a68505c", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266187, "uuid": "530dc574-d3d5-40a5-932d-8742862a3709", "comment": "Malware payload (ValleyRAT)", "value": "0ae119f23e3b29b455ce89a7e3b0fe0394715b04adea3b2e6936058f97b52182d7ad52ee81defa9db54dbea68a2220f6", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266187, "uuid": "80be4655-fb0c-4199-8cb5-5fd57563fc01", "value": "T1AFF72B369BD502E5D4FAC070472ECDA5F663BB74877146EB34B008351F6FAA9693E202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266187, "uuid": "fd83628a-f655-4c13-bc96-aac675547c7d", "value": "a20719a318838066b9cad81101a495b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266187, "uuid": "162ec313-895d-4ec3-b7c0-78d95dc00798", "value": "196608:LilzFoGMZd0BkPzgSQjse3ixUA9RGKqSxeJsv6tWKFdu9CuSbh:Lilz7MekrGimSxeJsv6tWKFdu9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751266187, "uuid": "d1d3c0e9-e00f-4cf3-b9ff-e94d5aecd596", "value": 76172288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751266187, "uuid": "d560c83c-3e50-4aff-a6e2-1b921507a3c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266187, "uuid": "f553ac72-d031-4780-8ffa-c6c27b8a41eb", "value": "Explorer-2Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4abcfe6-55d1-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751302068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302068, "uuid": "4d3e5b5c-0c5f-4bbf-abb3-afcdf1662ea6", "comment": "Malware payload", "value": "cb3101f6da24ccf4c5302f99ddba219d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302068, "uuid": "80ee81ec-0c65-4ef4-8f2e-d17b27dcb4b5", "comment": "Malware payload", "value": "c84020f2f660fbaa62096b57de1a8d58918af1c11fc9ed70d2c2fea6ffaef476", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302068, "uuid": "f9c9fa9d-4cea-4804-822b-e3bae45b8bfb", "comment": "Malware payload", "value": "56b97a2550ce636a59fc9a7ae2f6fa7743e4650d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302068, "uuid": "6fbbd349-cd57-4e2c-9d29-2f7ce6d13cd5", "comment": "Malware payload", "value": "ac45c20d90e05583943fd8445ce6db7a9eee45581e41df3730e09c2dc370313bfae773a48e4835111c3d18cc9c81bc41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751302068, "uuid": "9655f288-b360-42f5-aec2-d11cec7c421a", "value": "T120E412017F152032C9D21AF0A8B747B4EB914CD650B4D6777749EB222BF36362C8BB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751302068, "uuid": "c9135895-5e07-417b-b77e-4a118008357e", "value": "12288:XeBWVNQiXY8aap1qXG2YmzwcyxDKsFM+t9j+9+X:uQQAYLapnLmzwhtLy+t9j+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751302068, "uuid": "f7d9fecb-2228-4abb-ab36-6593495d0e64", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751302068, "uuid": "65073840-f022-4b81-b32f-e6b63115f202", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751302068, "uuid": "b614d91b-e765-4797-8812-1101b4f83915", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577b9c2d-5606-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751324568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324568, "uuid": "70275370-dec2-4b0e-9b11-98368a2ed745", "comment": "Malware payload", "value": "79e35a06b3f8f08efff5a8b4c4b497fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324568, "uuid": "106dd1e0-affa-4021-8013-0ec565b04b59", "comment": "Malware payload", "value": "c952ea01b9ae54fcf570a140e8b66f1c964edddba6def9f7c4c479b6d934b560", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324568, "uuid": "669b5070-d9ea-4226-b8f6-fc48a15e5604", "comment": "Malware payload", "value": "f7642c5c66292c1c4adf96e595a2ec650d6e76f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324568, "uuid": "13433e6b-a414-48b8-bcd1-7e968da84c10", "comment": "Malware payload", "value": "e32ba8616653b075b145c4a352a7c48d7e9ef6ebdcbb687e6e4d2bea5d708aab7a72cb0a731d6af82fd2bf67cd14f720", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324568, "uuid": "a5fa464b-b232-41f6-853a-ccbb5502e472", "value": "T180C4F1A377204F91C35195B209F389335AF6199706F29982537DEE107F20A6C386BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324568, "uuid": "26781924-cad5-430a-ba0e-794aa7924dc9", "value": "12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7zC:W7v+mrY2xzf03yvZ/YIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751324568, "uuid": "a422b819-5a0f-4f13-9c87-1b80613937a5", "value": 592688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751324568, "uuid": "4a6f1f26-f661-4755-ad48-0554020d64ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324568, "uuid": "8c5b3d74-083c-4b6c-bd86-2b7c426a63a5", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb22316e-55dc-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751306804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306804, "uuid": "ead53729-417d-4cbe-b5e9-f3170e44de1e", "comment": "Malware payload", "value": "b6390fafa564a82a3ebf8c9e6390e3f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306804, "uuid": "c5282d8a-de5b-40bc-9723-6b1088f974e6", "comment": "Malware payload", "value": "c9b72fb640030a0f0dcd46eaec6f924d2da922cd4d8882a29cff4b0a14e6c1f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306804, "uuid": "546a0554-2da0-4618-93fe-fc87abbc5f1e", "comment": "Malware payload", "value": "63a63f2b8724d0ede0235cfcccc7f70feb84579b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306804, "uuid": "81299b07-7cb8-40f5-90ce-25f947e2f085", "comment": "Malware payload", "value": "b265309664070845437a1d1ffbbe5796e2ba55a5027e0b86983e71643ab20de8937a4756ce2c94a7a581ea88027e0890", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306804, "uuid": "0e01b5f9-2d5f-49d8-a816-256c180ab1bc", "value": "T197A5235179C68CF2E46708325A689B217E7D7D302B61CECBA3D4255EC9725E0DB30BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306804, "uuid": "e8418412-b8ee-4c28-b961-7a41f6339875", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306804, "uuid": "1df10a56-9c1d-4338-b3b6-41831e550961", "value": "49152:IBJfTpc8iYMhPE3o+Ionk5d+qE75Eo3dzJnMlK:ypTFMVQMgq+hzJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751306804, "uuid": "3621cb6c-6200-4de8-a15d-c640b73348ed", "value": 2222878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751306804, "uuid": "2729db07-72ae-4541-8204-278aa37bbe1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306804, "uuid": "7a1c9f9e-cec9-4a3d-821b-84fca45c32a0", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a563524-55ce-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751300602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300602, "uuid": "4d6c2419-d2eb-4bda-9ad0-b91301525ec8", "comment": "Malware payload (Mirai)", "value": "cc79a8ec38fd480c15111dfd5bc66194", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300602, "uuid": "4b1b4901-5ae7-40ae-8643-1e5c10a524ee", "comment": "Malware payload (Mirai)", "value": "c9c63e841c9ae53e16ce72ad79e1c010a646dea11a0887b68c30073cdbce3024", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300602, "uuid": "a2c1d584-87b3-4bf8-afb7-725b3ca6666b", "comment": "Malware payload (Mirai)", "value": "8d190cb0e59b1ff9299ea80178d80c0a1000aedf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300602, "uuid": "f70a92de-6da9-4c2c-a862-f406996b5000", "comment": "Malware payload (Mirai)", "value": "93cf605bd68d1e5cf4364ad07489ddfdb52f8b409cc2eb7a9fa64d12856057c8dbcd1e1adbb9a1fac6b408f67a52d585", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300602, "uuid": "82b50fdc-7685-40dc-995f-e2e0ddbaf873", "value": "T12D331880FCE29A6EC6D4537AA62E618E33917394D2CF3317CC189B2137C661F4DA7A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300602, "uuid": "47f4366e-670a-45d9-8a68-cc12d14fb19d", "value": "768:U/Y1ygXSyCpi2rgDH5KrHaXG5qb+wwLBrCZJQb3a84o7XM8WBNynomz:l7VUi2kr5KA+wwLsZJQr/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751300602, "uuid": "a942d212-9dc2-4bf5-a64c-25e00df0a9f8", "value": 50820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751300602, "uuid": "d9638170-d0e5-471e-8c63-a424f483ef45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300602, "uuid": "f78c2223-444c-486f-9388-27d77c48d47a", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "155c93c3-554b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751244141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244141, "uuid": "ce32e125-6d2d-46f4-a7ed-a79c440822e7", "comment": "Malware payload (Mirai)", "value": "7af35ba26c929ff0b7d55591d10299d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244141, "uuid": "23d83e88-8ce0-4ca2-ba83-51ec44be1e42", "comment": "Malware payload (Mirai)", "value": "cabead82759bc98cef2495dd2238bf6c000c5ac3e7360eb7ba68e6f4bad00aaa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244141, "uuid": "a2ef52a4-63a7-406b-9161-815f59459956", "comment": "Malware payload (Mirai)", "value": "d979861ba551f9361de6c16525f4ee980a1cf98a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244141, "uuid": "bdaafd0f-55ce-49ff-96fb-4ddc81318f66", "comment": "Malware payload (Mirai)", "value": "365c61106fe750ebb1a5e3427daa3583902d678606fb5ad416d46a9a880788baac170ee366a68fd14d46c31be30ad3a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244141, "uuid": "cb27de39-06f8-4016-81c1-8a64f0b48c19", "value": "T1CA63951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244141, "uuid": "f1c30133-0925-4144-ab41-dfbca6729007", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAw:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXzDL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751244141, "uuid": "cab5b2a6-d3d5-41dd-b547-dce2ed49d896", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751244141, "uuid": "6d3ecca1-f4c8-4066-b76e-52fb1861f824", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244141, "uuid": "55f7d960-ff66-44bf-a82a-6fb2964c6139", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7550604-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751291228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291228, "uuid": "878200c5-7106-424e-935b-c7c23c54aa91", "comment": "Malware payload (Mirai)", "value": "2c88790f0bb56b98e37c7525d2a8c3a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291228, "uuid": "32e2aaa5-e39b-4059-8623-31254d32fb5b", "comment": "Malware payload (Mirai)", "value": "cae379124b4264cb99a922b2c135166513424a3d49ca2bdff9046b3e77754b16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291228, "uuid": "bb34a217-4cac-4f89-a025-a36b7ecac4bb", "comment": "Malware payload (Mirai)", "value": "2443db996506aa82ae2fe988c0eb06cf3276a5cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291228, "uuid": "686cfd3e-dc4e-43c9-8278-25d5b978136e", "comment": "Malware payload (Mirai)", "value": "75e3883c3a3946b6b3bdb6771313e5c65c8c7125078da3b2b1ad0cd113bab878d60862d2362f958eb016998334688e93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291228, "uuid": "16193faf-70dd-4c0b-a159-66cab9730c74", "value": "T100144A966645D8B7E31313B618A78B310331E63E2647D90FF744AC79A637340E293B6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291228, "uuid": "421a2720-a40c-4add-bdc3-0402a7d01fdf", "value": "3072:x5e2eF6Ri9v0aXAbkua7N06+EYP/YJPvtqG4Iy9p42OiQbFruSfRCgD2JIrl:x5gai9caXAbkuaZH+EYMt5orQZPpnl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291228, "uuid": "f71e81b3-4a36-4f0e-bfab-8e7221509996", "value": 195572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291228, "uuid": "5c914d0f-b1a3-4b1b-8615-9fb4418015fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291228, "uuid": "6ddc794d-ed31-423e-bb88-72beb7ee7c20", "value": "dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f5eab2-55e2-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751309021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309021, "uuid": "c656bb44-a14b-40bc-a1f3-5181ac277661", "comment": "Malware payload", "value": "9ad355511baf964a4cdd4cafc53efff6", "object_relation": "md5", "Tag": [ { "name": "anrdoid", "colour": "#30AD61", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "HMEX", "colour": "#E6853D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309021, "uuid": "3fa86e5a-af60-4122-a054-b4322e495fdb", "comment": "Malware payload", "value": "cb00aa2550645729c93bfc2bcbe9411ab7f8b14c41f80ced6313e51f1b8b19e1", "object_relation": "sha256", "Tag": [ { "name": "anrdoid", "colour": "#30AD61", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "HMEX", "colour": "#E6853D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309021, "uuid": "b9f0058f-619f-4640-ae88-d3f5c7a8cfe9", "comment": "Malware payload", "value": "4a64efb56061c1227d35f4e388f1f84b75662ef8", "object_relation": "sha1", "Tag": [ { "name": "anrdoid", "colour": "#30AD61", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "HMEX", "colour": "#E6853D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309021, "uuid": "2cc5cd47-19e9-44c4-8d45-ca9ece5ec5d3", "comment": "Malware payload", "value": "ee0c92d5ba50acb99600b842e3e995f501ef6e9e1901531886c09b14748a5475f4c3ac37c357a0c9728cd098f4286cf4", "object_relation": "sha3-384", "Tag": [ { "name": "anrdoid", "colour": "#30AD61", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "HMEX", "colour": "#E6853D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309021, "uuid": "639f282c-f9ad-4fcf-ba1e-cfd4e8dbf1e0", "value": "T1D575E043FB4A986FC4F7C3394A36462641069D6AC783E78B4955733C2DBBAC04E85EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309021, "uuid": "bf504b95-dc09-4fea-839d-449bbd4241ba", "value": "24576:wzMmzBJWUaioCz/ykKgIjAEQJ5+lSKydevTG2BavfVVBxnKnNRmH:6M0zahCz/opM5+lwTDBxnKnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751309021, "uuid": "36abf72c-020f-4b7a-a039-bc99a2ef05e7", "value": 1618167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751309021, "uuid": "cd38ef38-c715-434a-801f-8aaff4aa95b0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309021, "uuid": "e2b39bbd-e663-4ed3-baca-dd30e9c07dfc", "value": "app (6).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f436bc99-55b7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751290901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290901, "uuid": "7830b3e5-ca77-4815-a503-cc751b7c5cb5", "comment": "Malware payload (Mirai)", "value": "75631ce8fa24531b9698d0706005a47e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290901, "uuid": "b3abda1b-6805-433b-9dc4-69e599246dd4", "comment": "Malware payload (Mirai)", "value": "cb6cd580f97b3106f7d7786fbc53e2ebb15d55d82442a0ae87a693c17b471b56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290901, "uuid": "d1c623bb-386b-4abe-a043-172762d3e2f7", "comment": "Malware payload (Mirai)", "value": "e27847e8d56ad12ff9e42462b3c255a27642b3e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290901, "uuid": "8ad32390-bcbb-41d6-b268-b550d2dbbe52", "comment": "Malware payload (Mirai)", "value": "7b7c8d21ab1e2248c3954751d8badabbc8d613d6f53e8235cfec5223eaf728af15c507b66eadaeeb5b86dc6da04763ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290901, "uuid": "d3dfeffb-6aa0-4e52-88cb-67ee5d567a26", "value": "T1698383096F610FF7E8AFDC374AEA1B4924CC651A21A93B757934D818B24B24F49E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290901, "uuid": "d4c9a6b1-c50c-47e4-b41d-eac550d2b44e", "value": "1536:zCr+EzicGQp8cIJIrXWI3tWvlBECqZo7vCdarD:er+EzijQjrXW0UNfD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751290901, "uuid": "28b9e388-3667-42d4-8bd7-b13dbe66f92c", "value": 83924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751290901, "uuid": "52cd4e04-d4f6-4a86-9a8b-5476acc6da2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290901, "uuid": "217c937f-be5b-4c9e-b2e2-fa644f4c468a", "value": "mirai.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d3a493-55d3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751302775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302775, "uuid": "29ffb3f6-1ae0-46a3-9e18-9c3188f780e2", "comment": "Malware payload (Mirai)", "value": "67051d4de174c6d5df4d17d0517c2df6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302775, "uuid": "ed610abb-18cc-4e00-9fa5-dceeb19252c0", "comment": "Malware payload (Mirai)", "value": "cb894059764a25d53785b0745191805a775872b11ce1a5ee24b9d5688c26a969", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302775, "uuid": "6b300dec-c01f-437d-8ddf-552dcf2d3c20", "comment": "Malware payload (Mirai)", "value": "c49fe9f4ea1ba7d1c3737484c262618d7d662c42", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302775, "uuid": "830945a1-8787-47ca-8003-193f77adeb8f", "comment": "Malware payload (Mirai)", "value": "d15fe1a5dba8796c9ac3b8c83d9c313a0c7e9f852e3639ea8e07984b0ad54e4862c4679cae721e57e7530ceb1b29288d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751302775, "uuid": "f388bd8e-8740-4f1d-a610-f297e815f7ee", "value": "T1E21160EB005EB4408C2D9D61B0396C59B5848BF03594DB89F48ED4B6F2A9E3B6336F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751302775, "uuid": "23127554-cf8f-4165-a047-c3aa8ef47836", "value": "24:9IjdISdIRGNIN/dInKndIRdIEdIGQdI3ZdIaldIXdI61U:GjmSm/mnsmRmEmGQm3ZmalmXm61U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751302775, "uuid": "d8b7a252-0c7a-45ef-9af4-f8efcb5c8851", "value": 1078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751302775, "uuid": "2a5fe690-4ba7-433b-b256-77f9a80caed1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751302775, "uuid": "60824539-26c3-45e7-8fc0-4012f980158c", "value": "busybox.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db10fc6-5571-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751260610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260610, "uuid": "0db6127d-ddec-484f-971f-35e35af3d12c", "comment": "Malware payload (Mirai)", "value": "238a8f8b3da5f4b7d2e08928c19192f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260610, "uuid": "75d088ee-c156-4676-b96a-72124e120787", "comment": "Malware payload (Mirai)", "value": "cbb5c0c5548b3b96c5a6ae6a37b50b9d9b714d2a37eb39d66aaa8f862bff213c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260610, "uuid": "9768c52f-85dc-4f23-8aea-a3f149defe84", "comment": "Malware payload (Mirai)", "value": "f4dce1b154e7f128d04431420061d8c3ed4393d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260610, "uuid": "a31297ae-bca3-42de-9f53-f44fdd418d87", "comment": "Malware payload (Mirai)", "value": "689158ef93f4f1e8ba59ecd0baea671ec48f244e372a02ed7bc85b731ba21a042a5922e0b903aa158f73452ca4f00bfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751260610, "uuid": "399fabb6-9cf1-4844-8637-bda8f0304a92", "value": "T18C3302D00762278C93A5DD753CAD301E4424256B32EA2D102DABD18FF55B722ACB6EFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751260610, "uuid": "0f4b08ab-3f5e-4c66-8c7b-38df4761e1e2", "value": "1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgd:8D+CAXFYQChaAUk5ljW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751260610, "uuid": "436eb89f-775f-4f8a-bf5f-770f690d3c9f", "value": 50544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751260610, "uuid": "447e0501-a60c-4d4e-906a-2dd86478f7b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751260610, "uuid": "71cb96c5-0585-43d4-8198-d6214106fa2a", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68404f53-55e9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751312141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751312141, "uuid": "d91573bc-2c2e-4daf-9918-d9c65102c395", "comment": "Malware payload", "value": "dd67350be684440b38fda684fe596125", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "axis", "colour": "#820AA0", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751312141, "uuid": "264b3e75-c134-4f94-819a-0f122eff0df9", "comment": "Malware payload", "value": "cbd1db1d117054fc747b0ce39a7ca8f260824c408a30d8a27ac36c8d0b6b18de", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "axis", "colour": "#820AA0", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751312141, "uuid": "116c105f-99c6-46e4-87be-e21c3c921a48", "comment": "Malware payload", "value": "06f7f25af900f019035aa8d3a7d608e8579c4174", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "axis", "colour": "#820AA0", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751312141, "uuid": "38ae49be-bcdb-437d-a9c1-541da75168c5", "comment": "Malware payload", "value": "4ab24c2fa6b3e4da9f763c754bd8212627b52d979085ec3613e4f41628235aee2dd81732b7c59aea5664be2fdd3e4165", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "axis", "colour": "#820AA0", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751312141, "uuid": "3f188ec0-7a33-4d6e-a4d0-39654b23e5ba", "value": "T1819601C7B367754AD4F74A3F86B7A32511236D714F63C2A3D825B32C58B7AE08E14A84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751312141, "uuid": "316eba0b-c147-410f-ad3a-0f0147b0a3f3", "value": "196608:oNphipTBbOSBwRxoEPIDeM3dVy0nCxY1bBB6rQKSX:7pTNOSBwRpQDeg/yXxY5vKSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751312141, "uuid": "3b09ae15-b80e-4336-9a00-38102633bfe0", "value": 9443502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751312141, "uuid": "c665c5c8-b6c7-4e1f-9366-a79ec06a2629", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751312141, "uuid": "c915715f-a396-4e70-ad95-b48a2ca17289", "value": "axis(2).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43123096-55f0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751315085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315085, "uuid": "20d97ce8-c631-49b6-8190-a79924ebcbc1", "comment": "Malware payload (Mirai)", "value": "8dfb1f0049b877f132d097be576f00cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315085, "uuid": "c4cae1ca-e412-4103-a33c-ec18143fb23e", "comment": "Malware payload (Mirai)", "value": "cbe635cbd3f1acd96cfa7c320164cc891e92d3f0a3d483f5de3c4fcbb5fa6fa5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315085, "uuid": "1fad6766-c159-483a-8a33-75e998b72306", "comment": "Malware payload (Mirai)", "value": "8e3b517d464a5b3a55c8e721a92ec6326627ec0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315085, "uuid": "7ee7a7c9-e2a5-4b50-b31c-3ad9c2ca0f30", "comment": "Malware payload (Mirai)", "value": "8e241d8c2d7d93e265a9c4551e2a1835ccfa652808fe2fd853ef5be334fd4c84d85ba070051770b4876df1f6944bc7ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315085, "uuid": "aa81c99c-b5f4-4b3a-a42c-dcab16a2e8f7", "value": "T101733B85FD919653C6C5537BFB2E028E371623A4E2DE3203DE26AF213386A1B0D7B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315085, "uuid": "d48ff501-73d7-48be-9cdb-5bb755c418ad", "value": "1536:1O3L55aUsNMVhGvhoCQX40vWQbZNozAjNsbRev+C:1O315akVihLW4JQbrRsy+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751315085, "uuid": "74745ae4-0c22-4041-a79e-85cf53d115ca", "value": 79492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751315085, "uuid": "1910cf10-4be4-4919-93b4-badcb09118cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315085, "uuid": "a193fdc6-ac9e-4a00-abb7-4f0e4c7c02ac", "value": "SecuriteInfo.com.Linux.Siggen.9999.20988.14355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7429cdef-556a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751257615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257615, "uuid": "cf691895-3f78-4e01-a648-739155520a71", "comment": "Malware payload (Mirai)", "value": "602e85083044564683f7f9ba0bc92eee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257615, "uuid": "f0df608b-88d4-41e2-adf9-f2f888d189b2", "comment": "Malware payload (Mirai)", "value": "ce170ef64daa43aff21cb7dc0dc9c9d2209aebaec5457935023aad89bbabc054", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257615, "uuid": "71b403eb-b9bd-4faa-9dec-e2405cf7d3c4", "comment": "Malware payload (Mirai)", "value": "8eea28c45fc26623bfd19a4488851fdb2d0aff2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257615, "uuid": "92b5c9c6-c50d-4ed4-86c1-73eee0255cb8", "comment": "Malware payload (Mirai)", "value": "0035c4790e4a2d4da450f9e5ceab4d8e464a2d6eeb15c9a153aa297a0b4ec367aca2f3f9262995824153bdd23a7b8635", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257615, "uuid": "5f589a7b-c096-4016-8090-96275458bd01", "value": "T105E32A16B30C0943E1571DF43A3F5BE583ABA68120E8FA45750EDE4E96B2D33950AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257615, "uuid": "2093709c-4f8c-4d71-be7c-48054a5386fd", "value": "1536:ss4pWsrKFyw7o7MU/q5xPIyC04jFgZNmWzPMgFZjJZmxvrmkWy3vAG1Gf/A8unFh:sfE7O/WxRCZ5gZNBZjQvrvIGNek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751257615, "uuid": "03a78130-4b73-4273-b8d5-802e3dabd722", "value": 147036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751257615, "uuid": "8fcedd9a-4c8c-4f00-a9f2-ece915b37eb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257615, "uuid": "0eb2a827-5b44-45e9-9c4e-dbf5a26fecc2", "value": "neon.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c198e3db-5598-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751277501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277501, "uuid": "a31cf692-f87b-4363-9de5-13d4a07688d7", "comment": "Malware payload", "value": "b1dbcb99c22cef6d94cf220a53339c18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277501, "uuid": "36aa5faa-e278-4bc0-8a08-fee340dbc331", "comment": "Malware payload", "value": "ce24c20670a87388411fc3fcb1cc3db347876237555f93027b5c75a76a513576", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277501, "uuid": "40378579-15e4-4de3-b7a2-db79a003edc9", "comment": "Malware payload", "value": "4220c42c8cbafb533b3a99b18fa73fc35aeacf30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277501, "uuid": "53912060-3e16-4c97-a301-7e79f360a64a", "comment": "Malware payload", "value": "afc15819b93c75b81b734faad5fa6873591b5a364d0cad09a619d0e5cc88c3671e18fd8ad8542aaf04de6c15e2ba459f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277501, "uuid": "f8b453b9-e20d-4dd1-b43c-5ae00a8348c9", "value": "T1A195BE13F29900E8D069D1B8C756863AE9A27C450B34A6EF0B90B7552F7BEE45F3E710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277501, "uuid": "dd9e9e02-8cc1-4b93-b666-e0550ba3879e", "value": "ff10541ccee6de117c9c9017577256ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277501, "uuid": "2e649a48-576c-4a3a-98f6-b3b2f0f91c69", "value": "49152:aFEmpklJ+jTX3YFmpFOHUzdDmg27RnWGj:0klJ6vpD527BWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751277501, "uuid": "502e9721-4580-41e4-a8b6-11757b4e12b9", "value": 2016256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751277501, "uuid": "6487632e-f23e-44b1-9473-30d3429c51a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277501, "uuid": "021d9ecc-d129-49e4-8adb-01b05220d50d", "value": "Bpl New Po-2000023038.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb9a887-5580-11f0-8bd0-42010a9c0005", "comment": "Malware payload (GuLoader)", "timestamp": 1751266971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266971, "uuid": "e809abc1-e950-4bef-8ee5-1f4088bffbc1", "comment": "Malware payload (GuLoader)", "value": "49b45566bd0d1f6d9dc836217dc1e1bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266971, "uuid": "9121cef0-6969-4680-80ca-c211949d16f7", "comment": "Malware payload (GuLoader)", "value": "ce99bfb1b5dc3b8fe9179e761754dae06aafe69f5c44e341c8bd6505a2cb5e35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266971, "uuid": "f3c7d4e9-2541-48cf-ab84-217211e35082", "comment": "Malware payload (GuLoader)", "value": "ddaec056b9edf66a8a8350bce3942a8e0e561ab4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266971, "uuid": "51fced29-f956-4790-8e30-e75120caf7ee", "comment": "Malware payload (GuLoader)", "value": "62e1d4f76fb008eee71689c89932a9514ae75a5522b4aab416aa1716488329baafb9007fd6fcd0bdfbfd3a25c1d6a0d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266971, "uuid": "1eb24483-66eb-41d0-95b8-067ff569c12d", "value": "T14BF422602A3DC653C8048E3B5DBEBA413978EF34B46724CB3398B52D1CB52B3D925E95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266971, "uuid": "f3b8a93a-6999-4817-94cd-4cd841c95591", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266971, "uuid": "73b1585b-905a-4355-9af1-1a84b06417af", "value": "24576:OYcskLHSimXrlLeGvzpbw+0gghyNruy5bfa:TnkLXmXBLeGvzpT13rb5by", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751266971, "uuid": "2957486c-a473-4db5-bd35-4e7bcc8f45a6", "value": 788752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751266971, "uuid": "53e67d97-9f34-4f78-b9b0-9615fa7cf371", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266971, "uuid": "f3623a7d-6dc8-43b6-85c6-7bd9068fcef0", "value": "F-67846.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f6e78e7-55d2-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751302248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302248, "uuid": "7980017a-5364-4293-bf0e-1601e415d4fa", "comment": "Malware payload", "value": "63eef9d83f7a8986e08225d52c10f1ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302248, "uuid": "b8f53d01-85e5-4ead-9a69-d2920f3b4638", "comment": "Malware payload", "value": "cecdcee3ba46b49ac89c4053f8ff8ad79ffa4ce60f4ffcd08b6e5e123bceee4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302248, "uuid": "951fef87-75bd-4835-8c80-2bad9f212134", "comment": "Malware payload", "value": "ce0540895d6439d5aa1861bf7bc75b6a19f5f18c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751302248, "uuid": "8cb85e79-d0f4-4fed-bace-3afed1bbd392", "comment": "Malware payload", "value": "71b01ca37b12ee7c25f37edb4744edaab5bcd057ac1a96dce7fcba87fc28555b2a8825775bdac4edeaad269bf55bb0eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751302248, "uuid": "70548cdd-64cf-4f4e-8432-8fa2595ceae1", "value": "T1CFA41294E9819B62C2C801BFFF0F45BC77A31F69E1EA71068D16EB2662D745A4F7E400", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751302248, "uuid": "410881b4-4971-4151-afb3-77c383bc1886", "value": "12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751302248, "uuid": "a0cd80c0-b136-4df4-a598-790de4a35498", "value": 480792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751302248, "uuid": "f9833c12-b576-4e62-9dbc-e5a0fbf79057", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751302248, "uuid": "64d2aee0-1e33-4265-a848-a337ba5d428f", "value": "arm926t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d9b251-557b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751264778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751264778, "uuid": "5567ae6b-7d47-4294-bfc4-f761f7dc8d3c", "comment": "Malware payload", "value": "ae30174bb9821635b3e7bb48fcb3b6e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751264778, "uuid": "678045ea-8fa6-4181-a04c-1f2802488242", "comment": "Malware payload", "value": "cfdabc76b751399eb89f19bf235e24c604eba5ceb02702a684cf40237cd1d893", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751264778, "uuid": "e3e67551-c56b-45cd-bb1f-c513ce0e19fc", "comment": "Malware payload", "value": "428100c1a95e5a34997e268c89ce447268393973", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751264778, "uuid": "2b2a4148-1ef6-4040-a2c4-f34ec9d4b5ab", "comment": "Malware payload", "value": "4e3e1d288e058be336bc7ab8b8d97f4c598606c5693df5c70b886708f2045f56181454b610dd796c3c2bbc2bc86fa255", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751264778, "uuid": "d1690ea7-c27b-47b7-a487-30587627dee9", "value": "T18A473332341605A2F87C93F01AE35BBA5C9E2EBF68814C695BDC72E4577663480DE13E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751264778, "uuid": "85d2064f-6d0a-4974-a925-706911e4e34b", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751264778, "uuid": "97436a9a-8c2f-48d1-8fd0-7e11a16a2ce6", "value": "393216:etB4lmt14sRdjmq5aGzwa3JpmJLkzgU67KOvD/a2ilBqBsaWueMIPels:ez4lWdjdYqwEJpmJLkzgHD/adOBsFuen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751264778, "uuid": "7d7f3f24-cc5c-43e7-bc58-efdcabf5b075", "value": 24750565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751264778, "uuid": "051da98e-466b-4819-8760-9c557d4c9ea8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751264778, "uuid": "332534eb-cadf-44c7-a703-c6810e6fd237", "value": "SecuriteInfo.com.Win32.Evo-gen.7096.14419", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "585fb4dc-55e2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RevengeRAT)", "timestamp": 1751309108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309108, "uuid": "b2f71b66-5137-489a-a7a9-2c9546685398", "comment": "Malware payload (RevengeRAT)", "value": "940946e310aedb47743b623901ab79ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309108, "uuid": "a8d3e8fb-661b-472c-acad-925f593f89cf", "comment": "Malware payload (RevengeRAT)", "value": "d095c56acd5ed2cecf9e33329586cb8e7caa2d7de9cf5fe79dccc92f50d94887", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309108, "uuid": "84605271-c9f2-49cb-b7cb-9800cad2d838", "comment": "Malware payload (RevengeRAT)", "value": "f55a82da36b95b7cf1818751ce90441864a0e6b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751309108, "uuid": "96ae2d4c-fa5a-4b72-b38b-1ee48005b53b", "comment": "Malware payload (RevengeRAT)", "value": "eb56be988480011cac39454cdf90ee592d7cc39411932d55a6197f38520a20b05cc6e79e21c223839bff8edaa74994f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309108, "uuid": "65ddc4c3-70ae-44dc-9a0d-dcb065cdffaf", "value": "T1A8622A09B3EC0339C1BD07BC0DB242356371E5A79A62D71F1DD890FA8992BD55B60BE8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309108, "uuid": "59788a4c-17e7-498d-b693-4195b396d6d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309108, "uuid": "c5c8fca3-0d2b-4dcb-855a-8a55c84babb4", "value": "192:X+8C+EKS0O9ejYTDG8bcp4Llh12nieXubWyD9JEBkGxVXxqoNZRJ8:XNVjYTDG8gp811eXTyD3Enx+oNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751309108, "uuid": "46fdafea-db8b-45bb-b2e5-519ca0f72201", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751309108, "uuid": "b377f401-6d85-46ec-a654-6bf31ae4284b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751309108, "uuid": "3119f7c7-99f0-423b-b97d-96fb5a53c732", "value": "940946E310AEDB47743B623901AB79AB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a0086d3-5580-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1751266966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266966, "uuid": "6d9b1e52-2a8b-4f51-bef5-78a74c781175", "comment": "Malware payload (SnakeKeylogger)", "value": "5c440644d649bc9937b25ec71dc87bd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266966, "uuid": "70568d4f-040a-4000-8558-0d689c16dc90", "comment": "Malware payload (SnakeKeylogger)", "value": "d1e18980917201d86490954ecbbf3adcdfb888ef57d00ecdfbf1b103eee93421", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266966, "uuid": "05e89f06-e509-4cc0-9ae3-063eca6e6d8d", "comment": "Malware payload (SnakeKeylogger)", "value": "8a32c72900ac889fc573d615ac0e306a5262075b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266966, "uuid": "db5e188d-1ab1-4378-a4b8-6d3a630a3c9e", "comment": "Malware payload (SnakeKeylogger)", "value": "992a7aa70c1f763bc3d863151a02c484907cd433fc98934fec89579af8748635cb009dd216d130c971c744cd9f0e0088", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266966, "uuid": "2948f18a-1eeb-4bfa-9dc7-c9d76d54bcbd", "value": "T165E4015137A5DD12C5DA0FB08E71E27252B2DEACB420C30BDDD9AEEB389D75824423D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266966, "uuid": "3bd85ab6-99c5-44f7-8f9a-72fc3a98c011", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266966, "uuid": "66e921b7-bc3b-4a64-9c01-ffaa0b1366f6", "value": "12288:XwGfZejAXfCV4nFnRjpHZfiXlSMdODRLtQ9Yf/VQ1pVrkeIDaOC5rVKb:XZf8884hlpHZsSMdODZ6YATfIDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751266966, "uuid": "0123cbed-ba6c-40a3-b60e-597e79d9bb10", "value": 669696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751266966, "uuid": "20438ece-97a5-485c-b0bf-481fe5c2bebb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266966, "uuid": "291a6586-9ae6-4cfb-a759-536bcd1b5e26", "value": "Contract June 2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ef2a69-5554-11f0-8bd0-42010a9c0005", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1751248092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751248092, "uuid": "a7a3b42b-d143-41fb-97ef-3def3b6d957d", "comment": "Malware payload (VIPKeylogger)", "value": "df0ae3ba9082494f021020c75db6b033", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751248092, "uuid": "a36a443f-70aa-4922-aa99-646bbaf164db", "comment": "Malware payload (VIPKeylogger)", "value": "d2313ef1f45b7418fe9d3df134801f5fdfced3da2e626551ac13a7a37f19648d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751248092, "uuid": "5fe05b8a-7174-4247-9da7-4563f798661e", "comment": "Malware payload (VIPKeylogger)", "value": "59f49891cb60685741e0fa06eb0c01c46dfe8fd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751248092, "uuid": "2b30e008-b570-44c1-ad46-c08dee764276", "comment": "Malware payload (VIPKeylogger)", "value": "d106826ae49c943605fbbb055dea711824b4c46db0d754405469d52dfa3f4e8fcc02bac105f919845c683c7fbdf20bf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751248092, "uuid": "b04de36e-fb71-49ba-a24d-3f505321bc71", "value": "T1F5F40191D643DD12D0AB1BBC2B6AC2762A361FCE542AC70E5EC63CF7B9B33411595B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751248092, "uuid": "5734b953-45df-4df0-83ad-9712e65cebf3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751248092, "uuid": "c723c84f-f275-4b58-8ba0-23e18df5cd6e", "value": "12288:VjbyNsm5ZT9PqJUoHsRdqREi1pXtkp66ob2UMRt8ugsolifmG5:VjbyNsm5ZT9PoHkZwpO6puJol8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751248092, "uuid": "c52342bc-d637-4117-9ad7-e1bbb1311533", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751248092, "uuid": "0fad35eb-6e4c-460c-bbcb-f2df639a7152", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751248092, "uuid": "3292befe-eef7-4bc7-b759-fcd9eb7e4d1c", "value": "\u88fd\u54c1\u304a\u898b\u7a4d\u308a\u4f9d\u983c 27062025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c214aa6a-559d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751279650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279650, "uuid": "09f46a94-a73a-4d01-b358-d3b2622c44b2", "comment": "Malware payload", "value": "b85d030c4a1461eca1d16dff1a67a78a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279650, "uuid": "1e41b87e-4726-49db-8e7f-c350379ec599", "comment": "Malware payload", "value": "d36b11b8798a2a1560b53f20c6ef79a5ccb98b84a4daeea53ae07a561100202f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279650, "uuid": "c1a90a0b-e4c2-4649-adc8-18a999c61023", "comment": "Malware payload", "value": "67fe487a6064a180ef71128bbbdfed76fab8d6db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279650, "uuid": "ee17fcdd-f9ba-4e0c-a2ce-b02f58e235f5", "comment": "Malware payload", "value": "357f314b9a08ecca433d0781466a9335a594de736ac7e04a67cd6b8db3156a8b30ac8522ffb6bf70beb70fff9d642324", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279650, "uuid": "45575f59-1732-4f56-a4d2-69b89120fe31", "value": "T1C1A41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279650, "uuid": "9325fd1b-27f9-43bb-ae79-37f743c7d394", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751279650, "uuid": "15f3fa42-85b2-47d4-aef2-7ad45bc7f610", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751279650, "uuid": "699bd67d-516c-4520-83c7-0b17a2909b8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279650, "uuid": "ffc7e0c2-f74b-4b0f-bcbd-6531804d44a1", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b142759-55f0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751315018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315018, "uuid": "7ac124f4-1e49-4ccc-9cef-f266ffeb4758", "comment": "Malware payload (Mirai)", "value": "33e218006c15d7f3c66974cac7ed2d7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315018, "uuid": "bda2a6a4-4939-4ee2-8aac-e4c7a60600c0", "comment": "Malware payload (Mirai)", "value": "d527b788c2c81c60be8f705bfb6becde1b10efeae616dd71312df6ddf3ac1101", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315018, "uuid": "5944585a-9f12-44ec-be77-f2d3b9c7af94", "comment": "Malware payload (Mirai)", "value": "b501029d38ce9258c8eb940086cc6e52f18bc703", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751315018, "uuid": "55292cb6-4809-47e9-90e5-ce005699a901", "comment": "Malware payload (Mirai)", "value": "e3941445c9fcfb37c6816a22ee00b484c1715c5b0b614cf70fbca876a2ed8301341e03331ab25dda126be083c3f87cd8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315018, "uuid": "f37b3e8d-a7f7-426d-83ed-4ec3cda2a1fd", "value": "T18BF2E1FBE073F6F7E426CD78002C0840E17AB5853B4A112BB1E6B5FE5E53A062B14B94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315018, "uuid": "fd83c2ff-ef7e-425f-950e-451b677304b7", "value": "768:Z+yOwmfKGYbK6sQ6E1I5YQWrMWhiSGvSBJ5vC7iAItJFx09b:ZfOwFGYu7O7hTLBJ5vC7RqDcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751315018, "uuid": "a7595dff-3135-4630-9a1a-420a1065e04f", "value": 37536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751315018, "uuid": "f5bbd3f8-7941-4922-85bd-ef5314746ad5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751315018, "uuid": "18d1a519-0585-40d2-8f8d-c106a7b1426d", "value": "SecuriteInfo.com.Linux.Siggen.9999.12634.1211", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5bd991-5590-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751273820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273820, "uuid": "48a57230-811d-4484-a5cf-a6515a70a25b", "comment": "Malware payload", "value": "a4067c07a7d172825c16771f678eda77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273820, "uuid": "5fe6df39-29a0-45b8-a5df-69abda374f4d", "comment": "Malware payload", "value": "d55969dfa1071954d85888dd1debaab54404074af912b49e178d3d4c909f767f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273820, "uuid": "45ce1143-3c12-40e9-b179-39819b824974", "comment": "Malware payload", "value": "bfaadd6ea1b164b3eb7883c6542df0b071d1a46f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273820, "uuid": "4c3a1d14-d195-4c05-bd7f-e258d1947420", "comment": "Malware payload", "value": "8947328a66b5ab276a6fdd8dda3842f76ba6d58ac2785d4bcb6694cf372d1ad9e84f78af2a2bcce2cd950a70fe997e89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273820, "uuid": "c57d4407-a7ac-474c-8831-f1d34ef24533", "value": "T160A40294E9819B62C2C801BFFF0F45BC77A31F69E1EA71068D16EB1662D745A4F7E800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273820, "uuid": "0c1fd77c-0259-45e6-8fca-973a9b6a8898", "value": "12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751273820, "uuid": "2d585be8-dcb8-4346-b6d8-0f47bf6306d2", "value": 480792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751273820, "uuid": "bee7d089-8bf7-48d9-8f5b-2122185970fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273820, "uuid": "ba95c4cf-9123-47db-ba61-14dfe64e2710", "value": "arm926t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d0e2ca7-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751243832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243832, "uuid": "ed625978-1c55-444d-b34c-9f20ed62da40", "comment": "Malware payload (Mirai)", "value": "90d6389b8d7cefd2a6fe651cc6bb9844", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243832, "uuid": "58b70ea3-bbc7-44ea-849b-178cb5cdf3fb", "comment": "Malware payload (Mirai)", "value": "d583e06c5d3609ee641197361fc6183d70610f685769e70603e0251b5c3cd502", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243832, "uuid": "d960cf5f-ebfe-4847-94b2-2cb08a658fff", "comment": "Malware payload (Mirai)", "value": "29f457e67e7e5860fa9f7c92f117f528f694b049", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243832, "uuid": "72a41df6-bbb1-40a0-a163-a7ce28340db7", "comment": "Malware payload (Mirai)", "value": "acba95f274bc5bbe2f0ac0e9c9dcfa73284954bea836c1ed2c2a7fe0d97bbc87bd36df2b1956325b7458c4cd20fc5d82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243832, "uuid": "b62107c7-595c-4226-b4f7-46079de7d89a", "value": "T1892302B1140BDCE2CE601635FAAD528330E7257AA1E7343B5D1088BC7F289A51D9EF87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243832, "uuid": "7e78a3cc-25c2-4ee5-aac7-867e659a9640", "value": "768:5/TYCoIxdEQk4S6nZdgUsZta0O2JI9q3UELbUXfi6nVMQHI4vcGpvL:5ECFDpS6Zd/sZc2JxLRQZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243832, "uuid": "2d98c6b1-9676-4862-9d08-6ae65cb554cf", "value": 46632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243832, "uuid": "2cd2721c-75ea-4699-bc76-dd7545e038a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243832, "uuid": "c9d9cdbc-6e90-476e-a864-14685c47dafe", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac7769e-559b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751278752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278752, "uuid": "d6f2422e-ff82-4ec6-896c-7366f52d14e0", "comment": "Malware payload (Mirai)", "value": "faedadefde0a04b567605af3d5fa6ccf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278752, "uuid": "7c00c842-c4d1-4151-a77f-66950dfaa60c", "comment": "Malware payload (Mirai)", "value": "d5a3f32567d026b8af40102db17912a6e8638304377edcb9dd6ed3972b3d158e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278752, "uuid": "7c4f8ef4-0654-4ab1-be13-6512b78ee2ac", "comment": "Malware payload (Mirai)", "value": "d14e0be45e2bb950c808afdc54e5c8cf70ea42ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278752, "uuid": "775e1a86-e9e2-4160-8994-0e15d4a89008", "comment": "Malware payload (Mirai)", "value": "0a6600827004c665521b7440fe708088e5ca6e897ef1f13452653f2177e91041af85ff5cd32d5a73e42099d8b896acc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278752, "uuid": "545ed8ad-8a86-48b0-bfa1-64568a278714", "value": "T182D34A17B4C1C0FDC8EAC1784FABF5379933B5AC1238B21A27D4AA361E59E215F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278752, "uuid": "ae65e039-ab40-4b6c-a359-1d496e3731f2", "value": "3072:NQJyuPNMZaPc/ahSeR4wgjKwSa/j5Zy1yKox:NQJ3lMl3TDv7XKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751278752, "uuid": "63fe589a-0f31-4aff-8e1e-f587655499c3", "value": 130360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751278752, "uuid": "289bcd10-c093-4044-b525-0d156e6612d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278752, "uuid": "e53a1dd4-dc33-4446-88c7-13d57343fc4a", "value": "cutex86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb9db1a-555d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751251883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751251883, "uuid": "ddcaf32c-da81-4b00-89a5-d0b876bc8de1", "comment": "Malware payload", "value": "e2d7d65a347b3638f81939192294eb13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSpire", "colour": "#1B04B3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751251883, "uuid": "0e87a9a4-9574-49f3-9fd4-4e56b0357def", "comment": "Malware payload", "value": "d5f9595abb54947a6b0f8a55428ca95e6402d2aeb72cbc109beca457555a99a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSpire", "colour": "#1B04B3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751251883, "uuid": "dbf13110-26be-4186-9c8d-a6f65311ba54", "comment": "Malware payload", "value": "989daab910436b48f422fe60daa17a95a486e87d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSpire", "colour": "#1B04B3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751251883, "uuid": "30c7a587-4306-4097-8494-c23fbd926775", "comment": "Malware payload", "value": "5686fd6b2884c69d8b602a1bd0211b84e65e0f02a93934be109ce5d049ac738da48ecfdba4fc76fee993a1d78c56170b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSpire", "colour": "#1B04B3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751251883, "uuid": "339e0628-2cee-4fc9-b626-4570cf2a9197", "value": "T19BD54B17FC9669E6C0AAF231896291527B61BC483F3123D32B90F7782F72BD059B9750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751251883, "uuid": "362eb406-ba03-4716-b16a-491b4e92333a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751251883, "uuid": "140e419e-ec62-42e8-996f-144c53ebf6de", "value": "49152:NkYhuVAFd4dDrNhLSZ8dmQeKuL21KxK9Kxt5E:NvY/GjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751251883, "uuid": "a1688e99-1675-4511-9711-1584dcbe7320", "value": 2989568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751251883, "uuid": "f7b9f324-aec1-4b2f-a814-38b1d8fa6102", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751251883, "uuid": "db911acf-4c61-45f2-9aac-94266850ac4a", "value": "d5f9595abb54947a6b0f8a55428ca95e6402d2aeb72cbc109beca457555a99a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3215601-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751243950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243950, "uuid": "f2c0b8f9-1be9-47a0-b664-2425a2218ade", "comment": "Malware payload (Mirai)", "value": "4f699f474e3edc51e780f78d47db3a8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243950, "uuid": "33db16a0-f611-475f-af83-1eb97ebf9ea9", "comment": "Malware payload (Mirai)", "value": "d6c1d2c26841bc91e75ae3d79f7a0fd52c496dc9e0d770db48a13d170b05d3e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243950, "uuid": "d5f65ffe-59c1-4c6e-90f8-f2c5fadc568c", "comment": "Malware payload (Mirai)", "value": "e86aea21c2dba45f21a4b571400ed2c0fe694e57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243950, "uuid": "47291d0e-0dce-4cf2-b084-cd26322a954c", "comment": "Malware payload (Mirai)", "value": "18a054db3129ef3a70a10e769656e74004770d4bbb2502e851e77528488bfb2a63c032ec0c41145f337ef93e436a33a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243950, "uuid": "02b49090-5c56-4d69-a43b-7f9e5fdcdb48", "value": "T10A2359C8AA83E9FAF84710B25577F7769773E12E102ACA47C76CDD36D852D00E25628C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243950, "uuid": "dd783398-39b1-46a3-b59a-7457a64a5b45", "value": "768:SNKY9wjVd99kWq4afskOABjgM4ZHBrJqrl+gfWbvWGMo8WBmBIVcW:SNKY9wjV5fG4AB0DKl+gOuGMemBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243950, "uuid": "ed3ba607-c2b4-4d58-8ba0-a3fc98402c68", "value": 47696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243950, "uuid": "bc2f1baf-b67c-46b6-8afe-b7b299245e52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243950, "uuid": "dc4f99fa-22c5-4348-b5d6-57edfc863ecd", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5442943d-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751243817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243817, "uuid": "8a21f638-4350-409b-8b29-f40748331ae9", "comment": "Malware payload (Mirai)", "value": "21e519bd2d18c2abf0729a769ba7ea14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243817, "uuid": "49538d7e-af84-45ad-b78e-b0b09e592aad", "comment": "Malware payload (Mirai)", "value": "d6e084273f56aa1c33b76b1b3ed265ffaca1b888a607e117325a9e2c65c19148", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243817, "uuid": "5d27afdf-3248-49a9-9387-9ac169a5a9b7", "comment": "Malware payload (Mirai)", "value": "46fcac101321aed9572c0005086b7e778eb94642", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243817, "uuid": "118339f8-eed8-4b96-a5a9-abb4b96c4999", "comment": "Malware payload (Mirai)", "value": "4b061bd8a9da463bb0e014a95ff0e1fee43826fb897201028e0266958db1d6c76a26bfb3367a3145d7668e21576d59d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243817, "uuid": "047361a8-f3cb-4255-b81e-64eedfbb1a18", "value": "T1D6C2CFB273367E31C5202DB6E5BC0ECB2D860B3C60BF787356154464ADDA98A7B70297", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243817, "uuid": "092f7068-98ac-45c3-992e-f1af3dc8bec5", "value": "768:4MKyhegCCMqfVuPhme7FFwfr4mwG9q3UELur:PKy4qfYjEfsmwrLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243817, "uuid": "1fcba74e-161c-4a98-bcea-cca4918a89d3", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243817, "uuid": "150a78c8-5a0f-4887-8664-75838fc33b66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243817, "uuid": "b88b735a-1d96-467b-9c29-7d437d16ef07", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a55fe7e-556a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751257491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257491, "uuid": "772d9c7e-5d61-4d87-8136-39193e1b507f", "comment": "Malware payload (Mirai)", "value": "c7b43ef42faf3c776b578079cce1001d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257491, "uuid": "9fc68507-ecac-4fba-bead-fe471a7421f3", "comment": "Malware payload (Mirai)", "value": "d8307e926f92c19d71a188722c7527b48d1e5d4d291a820c0aa82c7aff61994f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257491, "uuid": "539eccd7-a2ea-446b-8208-d769c22758a9", "comment": "Malware payload (Mirai)", "value": "93bebb00a6f0f25d5f491eff11e110f2a386c8a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257491, "uuid": "5b85863a-d062-4241-93ad-f7b1c4327150", "comment": "Malware payload (Mirai)", "value": "f6f5a5263a115e529bbfec31ddc1a2eb5150ad1ee685877ff356b8789eb7225e0e640536f1ca1adc605e92a1ea555e71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257491, "uuid": "abb34e63-d99a-44f6-a295-50175463cd06", "value": "T119E32906B30C0943D1632DB03A3F6BE197EFE6C121E4FA41255FAA9A9172D331949EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257491, "uuid": "14195cf0-20e5-4dc5-8256-6b70c287b7a9", "value": "1536:2wuHpJvyg2iRsxBwkLQuwyrbl0MnP9PnuKCFgvAi5zbfgkqkkiqRgzjB7a:W9exfQcbnP1nmli3jBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751257491, "uuid": "6d9bf987-ee4d-4405-b472-d295c8d0b2f6", "value": 146940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751257491, "uuid": "54a7ea2c-ca69-4421-92d9-2ae8369c2cd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257491, "uuid": "ff38e3b1-a1f1-4e1f-8fcf-cbc488db588d", "value": "neon.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a937be25-55a2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751281756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281756, "uuid": "a3ac6fcb-f18e-418b-bd24-6ee6848ea29d", "comment": "Malware payload (Mirai)", "value": "6c9398757226b1444a5880df56c5ef03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281756, "uuid": "e139cf3d-5371-434d-8d7b-a956b80c6a84", "comment": "Malware payload (Mirai)", "value": "d836d1d93240cc43ac733dcfc366d114204131635995209840920e7b28916021", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281756, "uuid": "5f69ec2d-4073-423a-9640-5896d3ac4bb0", "comment": "Malware payload (Mirai)", "value": "38f2b07d6c948d22d0819d473dd828eb60df11b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281756, "uuid": "b5614d61-fdba-4749-a16f-a6b19a42751f", "comment": "Malware payload (Mirai)", "value": "9a20afae9001fb37c8ee9a990198b5fabbcbc2a437e3637f95db641b80d6d5bec921f7a6789973ffe3e7d78423244b58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281756, "uuid": "bd511011-061a-4ee7-bbb8-88d003126ab9", "value": "T1C6A4B71A6B215FB7D81ECE3306DA4701108DA29A52ED2F6BB2B4C61CF74B90F45E3D94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281756, "uuid": "1d20a32b-883b-43e6-8406-dab10e38c874", "value": "12288:WRNcVro5U5w+twUoSrCPCHh1Wr7c5PgzdOK3b:WrcVrL5w+twDSrCPCHh1Wr7c5PgzdOKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751281756, "uuid": "2981a447-19f2-4fa8-ad7e-98d2b48f8912", "value": 472357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751281756, "uuid": "a0f6b4db-3ccc-472d-8554-7e2ebece48aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281756, "uuid": "848c7b43-eb8a-4bb2-89df-4975b57dda20", "value": "m-p.s-l.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702f1e0f-55ab-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751285525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751285525, "uuid": "9c2e47dd-b145-47f0-994c-829a705569c0", "comment": "Malware payload", "value": "d26bddbbed0816f0ae9de325ce8fbb49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751285525, "uuid": "6c1f5c2f-42b8-4862-a82e-95b5794fe6db", "comment": "Malware payload", "value": "d85deefa11ad8a4549965fae741a813179bd29f6402f419c7b0193873e79ea67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751285525, "uuid": "3312ae6b-1f3a-4dc5-872a-a67c6d8bcc04", "comment": "Malware payload", "value": "017b61c38a670a261823d54cebe66c265fced3f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751285525, "uuid": "b4ac76dd-df73-47b8-97b3-82cebdbfda31", "comment": "Malware payload", "value": "cb72f0dc9de81b627233d75fca55f515ab154e77a92b1844527da41ffc243322e1bbe2d4f726c18018c04840c8b87260", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751285525, "uuid": "241fe20f-3815-4282-9455-d8bcabf624ec", "value": "T1D984B0A68FEFEC39D1469C7C49E2754580F8CC1819168793EB597CBACC30BD97A0D2A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751285525, "uuid": "96a60c5e-abd5-482f-badf-ca4a87c418dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751285525, "uuid": "d20ab7e7-419b-4bd4-b03e-53142862c2b8", "value": "6144:MglPVtCVrWuqn8G4zcLbkohLCZeXlynOTH5tTy:Hb0Er4zEHx6OTHvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751285525, "uuid": "1c904f80-c1b9-4b6a-b1e0-f08fccba6b1e", "value": 380928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751285525, "uuid": "fba251bd-59dd-47e6-94e7-6878939c84d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751285525, "uuid": "0f262425-7be5-4a65-bc60-4139dde8c927", "value": "DOCUMENT1.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a94c7480-559b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751278749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278749, "uuid": "8dc3e51e-0c0f-401c-9369-a415473a67c9", "comment": "Malware payload (Mirai)", "value": "1903db52624b7392b08783116dfb8135", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278749, "uuid": "c8fffca0-aea3-4e3c-b4cc-3c943285faff", "comment": "Malware payload (Mirai)", "value": "d8717b8a5f8d0f7c818f725464e455c758e8949911b9519ce2aea0b0b0b59a06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278749, "uuid": "906e1fc9-a49b-4bb6-bcf7-6d8db2c4268d", "comment": "Malware payload (Mirai)", "value": "e4a640b4bdc0fb7701ec9cd4b9b942ae43a17d0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278749, "uuid": "f054cc1f-dd3e-474c-b699-23b9f513a0ef", "comment": "Malware payload (Mirai)", "value": "1c07dd0df7ec118cc3e698fcf9e9ff3ee61681c0265be5b52f44cc701c1b26a9affc77824d3575d50a88c1f8feb90160", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278749, "uuid": "5fdcacc2-1c29-4163-a125-92bed2d75171", "value": "T1B5A32A59F991CA12C6D215B7FE1E828D7B275398D3EF310B8E254F21679B92B0E7B040", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278749, "uuid": "140495b5-ab00-4d3a-8438-900732125386", "value": "3072:FKha1kyrWiYlqljClSSlHl3lkHDldlplLplilJlKlrlRlZlw/l3Jl0lVlplolOle:FKha1kyrWvc5CMSJ1SHD7npp4vMJXXSH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751278749, "uuid": "a62c9aff-582b-42d9-9779-e71e2b005e5f", "value": 105536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751278749, "uuid": "e7eab993-abb8-41ca-b163-636c11d1c818", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278749, "uuid": "aca4e4e5-6fc4-4634-b82d-b2b658578c51", "value": "rondo.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd372215-5605-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751324417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324417, "uuid": "6122be4c-bac6-4739-8c90-87ca8be7d1e4", "comment": "Malware payload (Mirai)", "value": "a7504b085c409bb5a09ee87b6f8f32cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324417, "uuid": "ea28eea7-da5a-4bba-b327-9418895f2253", "comment": "Malware payload (Mirai)", "value": "d8d2020d30da8952a0323dabaa72a2c8d9d5c86bc6fb3ad117881cf66058561b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324417, "uuid": "9a953178-5795-4a5d-98e9-03796b14425b", "comment": "Malware payload (Mirai)", "value": "2804dff2952de015cfa55abb25e83a2bb12c39d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751324417, "uuid": "3b7f6729-2f6f-4964-b5db-9ab12dbb6e85", "comment": "Malware payload (Mirai)", "value": "fc857e8ba83a4639da0f9ccfa7ae86ea015a6efebce1973c3e700b54ed6b5c993f9e718195af9ceae80e07134dbe329c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324417, "uuid": "ab66faa5-e07a-4892-bbfd-3eb11ed99621", "value": "T196A3C84D6E218FBCFB98C23447B39E25A75933D636E1C684D2ACD6011E7064E245FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324417, "uuid": "ea7d08fd-9d9e-4bd0-941e-4e5312072348", "value": "1536:ExvENPhx5PJOwkLyCUnH7m9mX3xbF99uuRReIVNcPw:WENPhxewqyCUbm9mXBbBuO7N9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751324417, "uuid": "41d27d0e-1b16-4e5a-8f80-bbd02fbb8436", "value": 101712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751324417, "uuid": "b4929dbd-18a3-4e30-a5a4-11a40d9cdc21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751324417, "uuid": "96e3de82-6a87-48a8-8c6b-e6cc3039e09e", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90242652-559c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751279137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279137, "uuid": "eabbe8a4-fddf-4c5c-a951-b6aa5301edf0", "comment": "Malware payload (Mirai)", "value": "471717eaee570611ff554294637b5c3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279137, "uuid": "f04b4028-961c-411e-b8a2-842f53121a72", "comment": "Malware payload (Mirai)", "value": "d94c14e9241c0c918726b5b10a3dfc5fc3d55baadbe91688fa2f7be3ed7b2ad3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279137, "uuid": "94bf7930-0d2b-4140-8436-a24d91e2455d", "comment": "Malware payload (Mirai)", "value": "9fb2d8bf7193b20b4b4feea3657ebce812cc32ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279137, "uuid": "b1653541-f241-4a4e-aa70-d74a79eb2dcc", "comment": "Malware payload (Mirai)", "value": "d83b95d8ed6ddecbeef0d96475e6779a9f5c6701f98dc1171d824942dce58667ba6ddecbe14b1b3c0a0c25c36faa00bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279137, "uuid": "5e25378f-a0af-488d-9006-9a6823fa6f67", "value": "T1A6F3C91AAB550FBBCCAFDD3702E90B0239CC555722A43B753678D528F54B90B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279137, "uuid": "21f89588-919f-49dc-947d-8f6fe942a2dd", "value": "1536:y/uEbNDohJuBcZJuh2gNhxF3TsakjXTCWFPv/TsUsHZk+kLe0UDi7pAmagCdaotH:8uLPuOUNx23ANHP5DilHaX1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751279137, "uuid": "1e869aab-84e4-4864-a50d-934ce77c5b1b", "value": 165428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751279137, "uuid": "8a800bf7-7e0d-4ee9-a705-4b7750368885", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279137, "uuid": "0ee21736-ce11-4673-9143-19e0cf234616", "value": "cutempsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65cb0461-5603-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751323304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751323304, "uuid": "4ff5aacf-66ee-4612-8c01-bc4fc241fc25", "comment": "Malware payload", "value": "04a2d1b7cfc8e9b60ba0dc796a1a1687", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751323304, "uuid": "1a7bb449-7448-44b6-974b-d7319356c459", "comment": "Malware payload", "value": "d9a76d2436f74255b1211e65c95cdb75671af011469c14f21dc4a9ce588aa65c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751323304, "uuid": "94dac5d7-7135-41ec-aacf-f0e91ba88e01", "comment": "Malware payload", "value": "7c7dfc9012619fb9f9a5111ce6f3b335e7115d25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751323304, "uuid": "5dce56fc-0ba5-4f68-85d1-ee84dd65703d", "comment": "Malware payload", "value": "79ad00c64ef1c02c4ace29e125fe636848efa4a07efaf28d1102bc53870c50187f1009bfd760ca0a3f9728ba1977cce5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751323304, "uuid": "1688a65c-b58b-4a19-86eb-cd78fe227e12", "value": "T1E4B41228EE4E3881F3D1E3B8DA0A4BB1B05B7DD0D166C1B2BA41E25D95EDDDEC5D0212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751323304, "uuid": "715278ae-6c01-49ad-a6ac-13dd9e5378be", "value": "6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751323304, "uuid": "15be4d79-af76-4ffc-9a33-c9c917ae2fa0", "value": 509896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751323304, "uuid": "12828858-11df-42f1-a1b8-49af1fe87d04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751323304, "uuid": "36e6eac8-48d6-4d92-8129-e47d8765f702", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a559232d-5589-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751271012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271012, "uuid": "8cf458c9-3b44-49c2-99fb-4600a29cb432", "comment": "Malware payload", "value": "53a927b2e40fb779bf756d19d9842494", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271012, "uuid": "acadf881-5eb2-4286-86ef-4a75f7d541c5", "comment": "Malware payload", "value": "da3a33b212b1bddc125a7f60cab01081288600f08c97c89d41a7fc75b608dc22", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271012, "uuid": "426a79b8-9312-43f6-b850-e9ad2bed8d75", "comment": "Malware payload", "value": "3051423959525e067e029b7c8981da496ac7662b", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271012, "uuid": "05572cff-f256-4066-bfb6-916a8630d537", "comment": "Malware payload", "value": "cd5362926ac316137540271152612af92c909498d6d5ec8a6b568045f4cd476b46adb1339b60a63cb5168402e2a56e99", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271012, "uuid": "3bd38ffc-87b8-463d-9ead-4683c51d25f6", "value": "T1C4B533EE54C36475C5E2E8F1C3142B5D8536782D93AC42BA1034344BBBD9A9EC5BF8E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271012, "uuid": "23991d22-7d78-4ddc-bfd2-ef375bf3c104", "value": "49152:6DmD4xw5E5O3nX83aMXu4GdZaQ1T9V/60hnzEgb+qzuU8WpihJ:6DI5E58l6lGdZaQ1RJ60hnzEcpij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751271012, "uuid": "6ab9d65e-4adc-4771-b6a5-75c69ebff5de", "value": 2348135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751271012, "uuid": "bc072987-28a8-4c88-b060-d490c28af776", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271012, "uuid": "a9692352-6a06-4e79-bd4f-96035cbaa334", "value": "\u0424\u043e\u0440\u043c\u0438_\u043e\u0431\u043b\u0456\u043a\u0443_\u0456_\u043f\u043e\u0434\u0430\u043d\u043d\u044f_\u0456\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0456\u0457_27100.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "536dfb76-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751291061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291061, "uuid": "b9f934cc-a384-420c-9819-fc6d9799eb9f", "comment": "Malware payload (Mirai)", "value": "e18971ed43a878e13a7b2534ad5d29ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291061, "uuid": "ab667a4a-1aaa-4e9e-9ab9-c2873958c252", "comment": "Malware payload (Mirai)", "value": "da8be4da208b9a63f41c71031d2d3a81e0901340badc5581eaeb2f670f597c8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291061, "uuid": "ca96f32f-922d-4580-9381-0b824d89c62f", "comment": "Malware payload (Mirai)", "value": "ff40eb5e1206071b8f2e308fa0a8a2559de19eda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291061, "uuid": "5ff8d245-1a1c-4253-abdd-236d6d799a3f", "comment": "Malware payload (Mirai)", "value": "578a7859545837beff9eed1c055e07cad235ddca8f3a1d3e6266d872288717d6b4f9d0e8bc382c039d17cfd9dfa3c02f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291061, "uuid": "664fe09f-b176-4ff1-b3c7-f02a4466f4a9", "value": "T119537C20ADBA2E17C0E4A47B22F78339F2F2074E21A4CA1D7D761E8EFF2455055576B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291061, "uuid": "9cdb48a1-5f3e-4837-a1e0-78b03c09165a", "value": "1536:6O33IBYzS1c/Q58C6E/yDm5LclnRcnr9U:6Qgz5/TaDkLc8u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291061, "uuid": "2c9ca84b-5ea2-4a12-b146-f41558d7e1fd", "value": 64148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291061, "uuid": "db748295-6d29-43dd-b614-be6abfed1561", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291061, "uuid": "40a5ef21-0df2-489d-b384-04c6e83a270f", "value": "mirai.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b45add5a-55df-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751307974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307974, "uuid": "904f0d38-3487-4cf7-ad99-9b7302ad7e40", "comment": "Malware payload", "value": "21726491d7b5e0a032dd8c4559e518e5", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "Hibtc", "colour": "#707D1A", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307974, "uuid": "f954cca6-c858-43df-8483-6c59bf28d419", "comment": "Malware payload", "value": "db64f31937f624668b0a0c488aa3c5a85062a526ab76861d5d8d79122c1347c6", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "Hibtc", "colour": "#707D1A", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307974, "uuid": "8b30fcf2-bf77-4e6e-9b4f-921e9f894ec4", "comment": "Malware payload", "value": "0846a06934465cfc670ccfa420a1d93e39dee10f", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "Hibtc", "colour": "#707D1A", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307974, "uuid": "7f19f8ea-4ac7-481b-a041-65191efcf0ad", "comment": "Malware payload", "value": "3fb59ef0f221838ee25106fb7d64a96e7da4ee9ac38f5db8ef2fd3f1120e3507142d009360cc9672bb28e317adebc408", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "Hibtc", "colour": "#707D1A", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307974, "uuid": "c83789fc-9973-490d-846b-4337487264c1", "value": "T19FB50245EBC9AC23CDB7843643B64B6612514C858607D36329ADB22C9FBFDD04A94FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307974, "uuid": "655b3da1-f84a-4d44-9cc0-0755c6de157b", "value": "49152:rjLxYOjdRuAeSm0a20oQtvOUILlG6JLVzo3eRlW2Hm/0RdU/enLr3pl5+lgoFr:rxYOTHep0uxIhzB0WW2Hm/0SenLjp3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751307974, "uuid": "0b95ab99-e0d1-4f7e-8715-db7f4c60974f", "value": 2456790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751307974, "uuid": "70bd1b46-94c2-44b9-bf0c-8c3310cb6da2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307974, "uuid": "1f106381-cf31-462e-878a-580905fbce8a", "value": "HitBTC.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "807d0679-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1751291995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291995, "uuid": "24770665-6318-47a4-a2ea-7f1e1ba39440", "comment": "Malware payload (Formbook)", "value": "00fd601f639d6c3d1943caeabb92701f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291995, "uuid": "31abd483-78ff-4c27-ae22-90c0e6b54867", "comment": "Malware payload (Formbook)", "value": "db7d73f8445077239e22e47f0da77ba8f9d9e8130e915dff2d0403045c61e3f8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291995, "uuid": "013cffd1-6eb3-47d8-8094-a57b7c866b10", "comment": "Malware payload (Formbook)", "value": "7d46a025f447ff933dc19beb4ec46eb2f1ae4c68", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291995, "uuid": "039df43d-e2a2-436a-adc8-141b50b4629c", "comment": "Malware payload (Formbook)", "value": "2a7281c9f4f5cc5182452582e88f962ed436116160a985d5c868ea2b106d45ec236f029747fdabe295cfc9039e9f4c66", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291995, "uuid": "a1152979-b3a2-4c12-bd20-f8775fef5982", "value": "T1E485D09C84B09CD26024FE74EA85FBC7CCEA43852B2B07520FE595867352C43FEA7665", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291995, "uuid": "d67cde0a-5623-4af4-bf83-291b95816276", "value": "12288:tQz80bBCpsDt3MSipiQhzbCuDP96yKSVyzpu4JrhZquWM5irIp7JVXhvW8HP808O:tuFC+Upi8V6XSwzaqXp2llgZ/oHYj9GC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291995, "uuid": "c8c7638a-8db7-4766-9c0f-325248c63af4", "value": 1782602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291995, "uuid": "9ea65c8c-fc69-4d97-b145-ece863bf6903", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291995, "uuid": "0c3db3c4-7fdc-4d49-9530-25a6b581f7c0", "value": "\u0395\u03b9\u03b4\u03bf\u03c0\u03bf\u03af\u03b7\u03c3\u03b7 \u03c0\u03bb\u03b7\u03c1\u03c9\u03bc\u03ae\u03c2_33 270261.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e96a0afd-55dd-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751307204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307204, "uuid": "5f965f92-808c-4621-9ef5-4bb3277c0301", "comment": "Malware payload", "value": "4d8fd8e875d4e5379fdac97b4088a1e2", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307204, "uuid": "6aa4727d-d127-4059-8ab0-c7fcb804bd9c", "comment": "Malware payload", "value": "dbb1e32c62ab33822baeb4f35744075831f17af8a0b6303c1dcd389d41dc5eaa", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307204, "uuid": "137cfac8-87a2-4e0e-b454-b4fb7b4d06a0", "comment": "Malware payload", "value": "6427f1b20fdb667d340cf1672669db5c72d7a223", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307204, "uuid": "81df970a-cd54-488e-be87-a8e0b7968cfa", "comment": "Malware payload", "value": "02d05bcbd8ae8a141b8b8f809f428fdff6fe6e03abaf87e2a2d74c99c99667fefe7d38f49b396840ec11fdda2f429416", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307204, "uuid": "82c9f553-68ff-44d7-9474-4cb7ba1f9f43", "value": "T1FBE63387EB5AE963E1A7D63743BE415B56198C84C753F3831B94B12C1DB3AC08786EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307204, "uuid": "6e52a4b9-1ea8-4d77-888a-8cd5ffbbe3f2", "value": "393216:iMtGgA+E2etAByjHMR9/rfz2gpDn7BvuC9OUWli5hxZ34ay3aT:ioJE2etYyAR9/pjOJKzKad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751307204, "uuid": "dc969f39-dfd7-4929-a7b5-30aa37be35e4", "value": 14260167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751307204, "uuid": "f52c3d75-5d56-4d26-b910-ae586bc7bb35", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307204, "uuid": "f08ab6e7-5bf3-47fa-88ad-9e042ee7c1ed", "value": "app (10).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18238c1f-554b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751244146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244146, "uuid": "fa5709ba-213d-4995-8fb4-cefea5847d4e", "comment": "Malware payload (Mirai)", "value": "36d955729be12ae15388e0784897dc9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244146, "uuid": "ce19ec31-6e53-45b6-a64c-93fd1147db5c", "comment": "Malware payload (Mirai)", "value": "ddf91a1afdc5b209a80bde948d6ea01b7ebb3a7b226f7023f882eb053bb70409", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244146, "uuid": "204779f6-843e-43b2-9bc1-cb831d81aa7d", "comment": "Malware payload (Mirai)", "value": "c012dc38045263e4e0046dcb44ab792a47d41b9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244146, "uuid": "4cd9b916-e3d8-4733-a975-8ea8f356c18a", "comment": "Malware payload (Mirai)", "value": "5f3df81b006064e203b2034afa77639786c5e121130478d608f9ec513d03a59661fd34516ede192839a6b440a907d164", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244146, "uuid": "2fd2b251-3f07-4fc1-8741-412258bb5143", "value": "T134C35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244146, "uuid": "0e401f3f-de38-475b-b984-9257cdf2072c", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHoirScVM/9OAvjik:cowpuQyNSG24a1styKdlTuIirSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751244146, "uuid": "219878ee-1c9b-4869-8f2e-5a122de9ec28", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751244146, "uuid": "9b2cd7b2-5fd6-4321-86b5-f69eb6dfd825", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244146, "uuid": "105da752-6e46-4450-9ffb-8abbe05748af", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de6570e-5601-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751322405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322405, "uuid": "fe14c9f1-aa0c-404f-b07a-03a8d61551f7", "comment": "Malware payload", "value": "50c432ee27a1f7b42dd650833335174f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322405, "uuid": "91a1f992-e1a0-41f3-bcd9-dc6aa3479e3b", "comment": "Malware payload", "value": "de5f5451fb5b46171499eaeb8345858590592af49e82ce484c0e47d1bac2e843", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322405, "uuid": "21ac16ae-ce35-4922-bd6a-cec1c2773e6a", "comment": "Malware payload", "value": "e41a5ef2b7b0503f060bc9ccb23f9e0cbcd65776", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322405, "uuid": "14651623-54fd-459d-857f-08b1a123d9b7", "comment": "Malware payload", "value": "02ee945cee3ee78461f8838c464bf0362319fed4ca0feb86731fb67a9f7e6316bdab8040c7bc32ae81d2e5392eeb2b01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322405, "uuid": "eb0b00b6-eec8-4802-986e-0f862ed72ca9", "value": "T104C42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6D742F661EDB1B42469E66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322405, "uuid": "67a4946f-7696-49e3-b96a-8f4795e542db", "value": "12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751322405, "uuid": "6134826b-bd5b-4712-a1fb-299569c9d395", "value": 587764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751322405, "uuid": "2a916490-124e-4cc2-8715-4c8100c584f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322405, "uuid": "71e7ae8a-875d-4214-8f54-eb927548361c", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8da378-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751291213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291213, "uuid": "bf16f73b-cd5c-4405-a5cd-a562a8b8c1e2", "comment": "Malware payload (Mirai)", "value": "8dd4bdd321db069eb67cf6bb929f52ac", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291213, "uuid": "293bb5dc-7321-49c9-ae36-43f906302eda", "comment": "Malware payload (Mirai)", "value": "de81d31e56200af8133739473833f75a85e1bdf71e07fdd77185a1394a252b78", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291213, "uuid": "0422f1dd-488c-40ee-be4b-6c4cd4c33a8f", "comment": "Malware payload (Mirai)", "value": "59866314c384f4d0cbd0638e3786fd3026ac5c4f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291213, "uuid": "08acf992-4caa-403d-ae5b-72410e9874fe", "comment": "Malware payload (Mirai)", "value": "13e7a9cd231c742e4345f8a248a24d0ef97daea15cbf112038d296393854ac2dbb3b5a6f5f53327fd9e5186257db7685", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291213, "uuid": "34e266f9-5c01-496c-a813-76918c127f53", "value": "T1E541188A10A229B83DA79D5332BE4AD17281EEDA40D65F5ED8DC7CF440DDE087060AB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291213, "uuid": "8f4a7e58-aa70-4279-bfe4-762ad5cd8ec4", "value": "24:v9svmvUns5sja9aUEFs2NQf3sxNoxAeJaTq3NNIt3Ceks5K3m61JoitUawlN:vmvmvUsyja9aU8smbyaTqYJ5gm6TSaON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291213, "uuid": "f79dfc92-2334-4d5f-8063-ad5886a9f702", "value": 2428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291213, "uuid": "91da034c-ee3c-44bc-bd5b-c5b26330cdda", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291213, "uuid": "5d8b4fb3-0774-40a4-9560-ee0bc32f95d3", "value": "toto.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf546c4-5571-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751260609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260609, "uuid": "b46f8262-04b8-486a-b80f-9b5199378d5b", "comment": "Malware payload", "value": "c8f04f85fe87848a1eb30c39c1804fc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260609, "uuid": "5939a86c-acde-41c7-8581-01e66b8c89ab", "comment": "Malware payload", "value": "df5b9f21a22876035afe961e25bc42e5c4bd23e06a42b9f7e7a958e40bb8fc83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260609, "uuid": "817ab93f-3d94-4afc-b437-56790624e83f", "comment": "Malware payload", "value": "98832bdf20f42204a49be25211399902ec0c5364", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260609, "uuid": "7d8acdee-fd62-4817-99f4-3da9631f4b58", "comment": "Malware payload", "value": "dc890651a18beef8365e3d99a7fe770759141c5b752a7012a4a93b1f919dd554f4d09499eccecb3d78bb4786e847e051", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751260609, "uuid": "92ebe2c3-6be5-4c8a-80e6-8eeda92d5a67", "value": "T10CB41228EE4E38D1F3D1E3B8DA0A4BB1B05B79D0C166C1B2BA41E25D95EDDDEC5D0212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751260609, "uuid": "4977df17-68ee-4447-a4af-977d0185f6dd", "value": "6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751260609, "uuid": "ce2a9889-5d6d-4558-b1dc-866ed697ca98", "value": 509896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751260609, "uuid": "18387a1f-da41-42f1-93ad-2396f2f9b106", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751260609, "uuid": "2ae5e223-8238-4f2f-8636-4def47b2f468", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02028f92-55cf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751300802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300802, "uuid": "a5387f92-4c45-4a81-9071-710be61442e6", "comment": "Malware payload (Mirai)", "value": "ef3e1c973ad30acc2a39b40469508cfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300802, "uuid": "b86c57b2-9413-4d71-aa59-baaaf4b7ae57", "comment": "Malware payload (Mirai)", "value": "e1cb2eee5c69a0c80198336de508ca901a9e70678f9b2ae291d7781a6bdee794", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300802, "uuid": "a646c29b-d681-4b1e-8a3b-6478051d895d", "comment": "Malware payload (Mirai)", "value": "40f3f7e1bfaced0ab3762bbb717b637f79df1292", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300802, "uuid": "2f2b54da-294f-489d-80de-e907fb807f24", "comment": "Malware payload (Mirai)", "value": "6dbbeace676bb1ded3f6f3861e2db91b6c0ff5f348bbd4802d0ae93dab7e18c488537a2da0fc0eeceb982edec55b44eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300802, "uuid": "498451c7-2701-4398-bf95-f7cdc3d8f558", "value": "T17303F1F62F0A9813C476C4369F7A8487736D566C92553D213AA9003EE2DF5472CFC2D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300802, "uuid": "64c2f630-9ce6-46a7-84a3-45b0d4f75fbc", "value": "768:3L+7MfD7wgtq2j5ln9+P5UbzJXSrMPyJQfTUy7tmRChaOEfyNqpas3Uoz1:CInR9wBU34CyJE3xmgMOMCaz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751300802, "uuid": "a31fda2c-b512-486b-8b40-ba28f29ac19b", "value": 40472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751300802, "uuid": "6ffee3bd-7615-4704-aa2a-3537d7a1fe3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300802, "uuid": "09fb5661-7ac7-4f57-add7-69edb4920a2d", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f800ad15-55a1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1751281458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281458, "uuid": "1f1b7125-22c4-4426-b8df-48633c99168c", "comment": "Malware payload (Gafgyt)", "value": "5609e7c3b992bbff08737bdc39135e52", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281458, "uuid": "01703d7b-d426-4ef8-896a-2aa35b801475", "comment": "Malware payload (Gafgyt)", "value": "e1dd050e68d412730ca5409cf90ce273e8f93e5e73cb08770fbe00a1be5def5d", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281458, "uuid": "6705460d-3711-45d2-ab11-0db84c4133dd", "comment": "Malware payload (Gafgyt)", "value": "1d72a597a39c08fdb30d8ab761fa8a31bde767e6", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281458, "uuid": "33e11055-bc6e-4f60-9334-5f7fa2c40271", "comment": "Malware payload (Gafgyt)", "value": "fbeaf6f27b9b82b36e175fe6a45fa0742242b7f940b2f709f64d9eeb8260ddc572693f7142ecc285cf1326ded319a5b2", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281458, "uuid": "80c4efca-6b5f-4f9f-8009-11ce9d9ffac2", "value": "T18F4141D790510AF32CD0D87773698480F9E1A29995D65F076DDC3CE64CBEEEC68046CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281458, "uuid": "6ddf03b4-0b10-4342-93ab-6729abf3a223", "value": "48:vCd8j1ttQdMfxeAR7ICTRaT6PL1GQUIMYt5a:vCd8j1ttQdMfxeAR7ICTRaT6PBGQUIMr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751281458, "uuid": "d6ebebcb-c061-4fd4-8e6b-1c52c2c7d7ea", "value": 2063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751281458, "uuid": "572809c2-46a9-49ff-8f83-f779d6a14301", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281458, "uuid": "6bfe3779-abe4-4878-9b0d-50e2e0817e0d", "value": "Sakura.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed57b7b-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751292019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292019, "uuid": "242d6d58-1765-4e31-a215-06f4cdd3801a", "comment": "Malware payload", "value": "7459923c1d4319a4f68096b170d86bdf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292019, "uuid": "c8bba8e4-0929-4ac4-973c-c39111181a1c", "comment": "Malware payload", "value": "e1f67b2e269a00882694738075e8d2b28c344f9010656cc2a41e121a63640777", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292019, "uuid": "740cce7e-9ff4-4b6a-b183-aff45f250794", "comment": "Malware payload", "value": "746e6ef9541a6f843501b4c2ab0c33a114510cd6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292019, "uuid": "ae7e718b-0149-461c-9c6a-03f38b250084", "comment": "Malware payload", "value": "63573c9bac949f8a4ee1b1065d7e15cc2525af515b88fc69f8344d97dce912d1caf12f272776ade912652cfd7b6ca998", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292019, "uuid": "80f03e84-6c57-4b70-b458-5cb631370f4d", "value": "T191F2D884B520E56143E31E50051E2C04EDA8A9375CB8B068E2DEDAD135B5693CBFBB7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292019, "uuid": "44a57583-43f4-4801-a847-46aee0e6ebed", "value": "384:94C1dDg3q494JfrG9f6RUJ2Dmtkuxf2Fa23yzLEacHbs+TC0ym00TY8FfHyAmqkP:94Cdaq494JfrOzQ5sVsY8VSp522Ke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751292019, "uuid": "bcc56109-289c-424d-bc15-3336333ebc57", "value": 36306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751292019, "uuid": "bbeb297f-438a-4251-89da-e9274410ee08", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292019, "uuid": "884fe7e9-43b4-4d08-9c34-a93610839e0c", "value": "RFQ -PUR 20-039302025.docx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcee38cb-555c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (NightSpire)", "timestamp": 1751251831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751251831, "uuid": "88eab9da-adac-43b9-9333-2791b42f13ae", "comment": "Malware payload (NightSpire)", "value": "2e07a4de9e6ba84728fbdf27384ea0b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSpire", "colour": "#1B04B3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751251831, "uuid": "0a86cf59-279c-4d9e-84e3-a14febc0f989", "comment": "Malware payload (NightSpire)", "value": "e275b8a02bf23b565bdaabadb220b39409eddc6b8253eb04e0f092d697e3b53d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSpire", "colour": "#1B04B3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751251831, "uuid": "13ed66e7-3247-4150-9888-8953d62d795d", "comment": "Malware payload (NightSpire)", "value": "0e31379dcb838b619ec1b44dda3fc4cc20596764", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSpire", "colour": "#1B04B3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751251831, "uuid": "6abfcb8c-2e0a-4421-a4c1-193044fab63e", "comment": "Malware payload (NightSpire)", "value": "7aa68ce5224d75bdf395d58a2f329641fa7b506748d5ff4214b2d319e757d286131da04e03fdcfffc063c6247531f9f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSpire", "colour": "#1B04B3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751251831, "uuid": "debfe387-02b3-4638-bf2a-86b25d33d4dc", "value": "T1A9F58B03FC96A5B4C5EAE23089725252BB317C881B2067D32F61B7B92F73BD45A39354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751251831, "uuid": "c7cf5340-a005-4351-bc36-d67c00b2efc1", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751251831, "uuid": "4991d07a-56b3-48e8-8c34-78e032ba1efd", "value": "49152:JpW2YOTDH3PGQ/rb/TsvO90d7HjmAFd4A64nsfJ2gQOFRS5E32utg1GyI1y0z1aI:/3PkzOEEd9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751251831, "uuid": "e1125f14-af61-4f09-80f4-ea2440af473a", "value": 3504640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751251831, "uuid": "6e093040-b1c3-4d89-8a3c-9d86027cbcfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751251831, "uuid": "63def8fd-d96b-4652-b05e-0b285d513841", "value": "e275b8a02bf23b565bdaabadb220b39409eddc6b8253eb04e0f092d697e3b53d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9779943d-5607-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751325105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751325105, "uuid": "e3872da8-54f7-4c66-bd9c-0ab3af5922ad", "comment": "Malware payload (Mirai)", "value": "c20f573973a8a629057b42d64868a53b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751325105, "uuid": "3259c2a9-c2d7-4669-8b25-5d4ba9c2b34e", "comment": "Malware payload (Mirai)", "value": "e283b3319bdd755a22c892ae2ab04fa5fa44c5fe5bf3d37c7a3ebd52e7533aa9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751325105, "uuid": "94961f9c-1ccf-4efd-948a-13fdd16942fb", "comment": "Malware payload (Mirai)", "value": "5f5e9c49d9c5dc4d2adbf1b380a20b206f726d9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751325105, "uuid": "453a5e82-ce35-496f-bf2d-01d938a7b5c5", "comment": "Malware payload (Mirai)", "value": "f7cd7ce8937a1bdddb8241f0c7907221db3fd4683d50446aecb39b342ce3b124587a057ad6017d69545687aa9272ac80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751325105, "uuid": "09f36418-3383-43ea-b464-b32dfe89b89c", "value": "T12AF2022925C2BD64C5F2523F987689C47E4F1BB8D57BB1EE32209875B3C10472639693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751325105, "uuid": "fd33d702-451b-4da1-accc-8ddda8707aef", "value": "768:j3XUtnE+Hk7bO0mVZ1G/pikEy8V2LILhHss3Uoz9:jHuYbO0EHk37LaJz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751325105, "uuid": "60717c87-90fb-4425-88b2-b48c5a7c7e08", "value": 37044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751325105, "uuid": "8763021b-fb62-4677-a8f8-32f3a380abf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751325105, "uuid": "0931e44d-cd7c-40ab-b0c0-c908eb3c2b98", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba39cda8-55b6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1751290374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290374, "uuid": "52ac8b1a-6f4c-4a3d-adc0-aa1ba2d8441c", "comment": "Malware payload (LummaStealer)", "value": "1faced578472bab5215197a12e247699", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290374, "uuid": "1e089f17-9f17-44f4-8e64-294d85bb6db4", "comment": "Malware payload (LummaStealer)", "value": "e28b2cd73a75e581236982fc3804a6e0a6f47080230e2d9ac3478332016d2ddc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290374, "uuid": "d1ba0790-51b8-470c-b07a-5566851ac4a4", "comment": "Malware payload (LummaStealer)", "value": "149dff2eae3d3ea43cf85ebb62626e24a0f6aa8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290374, "uuid": "9b0ee056-24d1-4228-bb25-54e0d6a08f2e", "comment": "Malware payload (LummaStealer)", "value": "8b6e7a638e751c881fd5018bf92eda90f119eb8e562c546ab3abe988f762a00d297eddf98328a0a507a40be518f2240c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290374, "uuid": "297b9705-7665-40b4-a32f-19e8b4c7a4d1", "value": "T1AE8533E28DA2E217E819EEB905FF438A3678590884E10C1A391DCF139717B5F1B7D798", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290374, "uuid": "b071405b-5e84-4538-a33b-61a3ab36aa14", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290374, "uuid": "894eeb44-1627-4d93-a723-ede2649853d3", "value": "49152:E8+ZNjPpWwUTvgfkVuRoS8NYYTbyBgbS5:EloTI8VOopBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751290374, "uuid": "437df82b-0225-430b-afb1-33f6b2dda9b6", "value": 1843200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751290374, "uuid": "86d3f199-4563-4ed7-9a29-200b5c9c586b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290374, "uuid": "32447356-21e3-4392-8f2f-d0f3d86dd4dd", "value": "1faced578472bab5215197a12e247699.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bc557f7-55ce-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751300443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300443, "uuid": "c10a9aec-f84f-477a-95e4-98cff0ea15fb", "comment": "Malware payload (Mirai)", "value": "b8fe1eccacd0c43d673866196fd74c38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300443, "uuid": "5fed8e72-f5d2-4575-8f4f-daeebbcbd948", "comment": "Malware payload (Mirai)", "value": "e28b4a608313570071e74495580493ec59567e4971c44e8e44c11b6b4f49dc06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300443, "uuid": "f224fe09-2ffb-4de4-8d68-d7c170dc495a", "comment": "Malware payload (Mirai)", "value": "8726283c994b9e6a92608980709be9e54b0d12ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300443, "uuid": "a4a06b62-802a-4473-a501-cc219c141ede", "comment": "Malware payload (Mirai)", "value": "f4813430c239e6292de3a1c574e8dfdd0eb8c1e29bd39e3169e3a7642ba477e57d951526668582347c0aede5043bde5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300443, "uuid": "40c45543-94b1-40b0-bf87-856178b371b5", "value": "T1F2B2D034328DF871C3D0193AF92D4752A8C78ABCF2D6316229F442B8AFE54995AB3157", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300443, "uuid": "1250817f-818e-46e3-9102-4ff09b885c7b", "value": "384:D1RoecJOUDb4hxIWor+HXRdW9/vfDuWABULHoqQqgT4qMwO6hymdGUop5hb6:hlcJHboOrvvscHoqTC4IO6s3Uozg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751300443, "uuid": "0eeef292-ec0a-443e-b8a3-141e9cc26d41", "value": 23708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751300443, "uuid": "f525e598-d5cb-4ae3-bc63-6459a0f65881", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300443, "uuid": "84c34730-2597-4a08-a90c-1a1b3ece02f1", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf00397-5590-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751274059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751274059, "uuid": "8c666899-3d56-4697-a86a-e78ce364e53b", "comment": "Malware payload (Mirai)", "value": "190b4f371936faf8d94a068494c88bf5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751274059, "uuid": "f2886605-c256-4fcb-b43e-1668865b694c", "comment": "Malware payload (Mirai)", "value": "e2ace9290d0bcd48cebea92235c21fe088d70968bb4a89499a66600493571d35", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751274059, "uuid": "1a28821e-0721-447c-bd56-90cbcee852a9", "comment": "Malware payload (Mirai)", "value": "6ab6d6bfe60ade04e81dff89bdbf02b4c6c1f2da", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751274059, "uuid": "20fde061-3c70-4b06-8ab6-1401a3b8dcf9", "comment": "Malware payload (Mirai)", "value": "7656a78861511871fd7f9befc875abe29a60ecd7e1bc048652389f241bb3c3f5179ba0a352494365572025f61e746760", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751274059, "uuid": "e3190c3c-b61e-47fd-9ed7-505cbfa00aa0", "value": "T1675173C3FBB54CB55DD22B9AB31A32546189801D9CFD2FA4C4D465F902DFE2C5184B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751274059, "uuid": "889954fb-7f1e-4bc0-923d-8469cf722028", "value": "48:vjp6Y7Ap6Y7Z7sjp6YJp6YAfjp6YgRp6YLejp6Y5p6YQvjp6Yvp6YCRjp6Y7vp66:vjp6Y7Ap6Y7Z7sjp6YJp6YAfjp6YgRpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751274059, "uuid": "657bd605-d7bf-4900-a676-723e2fc8ace4", "value": 3044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751274059, "uuid": "689df36d-815a-42e9-b64e-cc187ef10cc6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751274059, "uuid": "b5a95d19-8989-4ff3-9004-92c3b634cca9", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2747d3d-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751243948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243948, "uuid": "8589273e-c5af-408c-8634-fd3f66201b83", "comment": "Malware payload (Mirai)", "value": "0c5b52eaa423fc37abd71b51a5958b93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243948, "uuid": "e1b850b4-7c92-4c8e-8d01-1dce389fd67e", "comment": "Malware payload (Mirai)", "value": "e2cbf2132e35fe886c89d302c4a92c4dba6805f65e9d5d90c2b240c6cba3f3cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243948, "uuid": "b0b873bc-d701-4f3b-aea3-b5e6ff2263e0", "comment": "Malware payload (Mirai)", "value": "41d46af1e8f632a52e9922162ab2a2e6c15308bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243948, "uuid": "95d64a3a-9c07-43a1-a55e-4be7891d3787", "comment": "Malware payload (Mirai)", "value": "b7717d80c198a8d2a126969f9459cf1e210cee2cd9437d8a6042847bc1f476a5cbf36b65710306ee3e41c057f4040ac8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243948, "uuid": "3cceeca6-3760-4b84-946e-658416f21ac6", "value": "T187330A8EB8029D3CF90BE6BE54164E0DBA3177C152830B2757BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243948, "uuid": "dcdee04a-7c6d-419e-b7a5-4680b93c1de8", "value": "768:gduPBFnHooqR8qOCKq2gH4Y3e+TK806MMUVjzMfQXOtHud2oG2:r/hqaJA53eqK806MHdMfQXoHuC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243948, "uuid": "32448d57-fef1-4104-8c8f-826b2b49ac08", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243948, "uuid": "94fcb28d-560c-4a4e-838a-d1a0401d4ddf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243948, "uuid": "a04fd82d-c848-4f0e-b03d-fc267f61e157", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3b05e72-55b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751291222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291222, "uuid": "7683a585-d920-46de-bf76-166483e27f7d", "comment": "Malware payload (Mirai)", "value": "4a129c6a950b85ba0727211e613bf54d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291222, "uuid": "8a1ad92b-b3c7-45e4-b2a3-3b417a0c15c1", "comment": "Malware payload (Mirai)", "value": "e353bc35c7ace6f84d9de08e70a778e149da397b39122e8de6f22155d3dfe6c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291222, "uuid": "292275d7-0942-42e1-b6ea-cd7d948449ba", "comment": "Malware payload (Mirai)", "value": "155e0c83f208fa12de3b3eb4ceb6b2899a98c2d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291222, "uuid": "bd7a6ebe-833d-48ad-b4e4-9df46925578a", "comment": "Malware payload (Mirai)", "value": "83dfaa4394c3a63f7fe92b76afe41fe1b26c128dd85794770763465f88e238b2f94a6044b55baa0443d120d6514ec8dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291222, "uuid": "fd8b060b-6a93-49b5-ac65-76d02b37b952", "value": "T19423F746BD82DA66C6C023B6FAAE518D3322B3ECC1DE3697CC105B1077C995F4D67A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291222, "uuid": "5990fa66-b4bf-4e70-aef9-c4de0af22368", "value": "768:X+LJ7eCcjicjoVdaVpa6RWi0drywKC4SCbX4e5bIo2VKE3NDE2j:utrcufVdaVo6+vKvHbX4edh0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291222, "uuid": "da483e88-3e5a-4bc2-bbcf-7dd7c3a26400", "value": 48416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291222, "uuid": "d2bb0582-e216-45a1-80b0-46aab8db3367", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291222, "uuid": "ea43dc6c-945c-4329-b09d-f89e7e036205", "value": "miraint.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81de8ea1-55b7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751290709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290709, "uuid": "da74dfa8-f3aa-4c65-aad4-5d09d21425fc", "comment": "Malware payload", "value": "59db3c542139e7d33e2d94635ff0fdb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290709, "uuid": "86a0fc89-6fa8-40de-8e70-4284df107bca", "comment": "Malware payload", "value": "e36e6102f1f14185b827a1042ec91a776048ed908863af21a8d46910777d786f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290709, "uuid": "f0f471c9-da56-4d3c-8a97-2b7cdcfb0ee1", "comment": "Malware payload", "value": "15ee43b7d279c90827d16b0a11b35723152d66f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290709, "uuid": "d228464e-6eca-426a-bbda-1c04a4c26892", "comment": "Malware payload", "value": "6eb666be84185cd7d9338e266d427fb51dba5dc73d9735722a693632f9a30783185bc0f89440678432a9cffa1f3c8310", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290709, "uuid": "656142db-ae72-4b3e-9d2d-d605b76718cb", "value": "T1C2553CE2B54972CFD48E37B8557BCD81796E03F842204803AF6DB6BE7D63C85558AC28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290709, "uuid": "9970c853-72d7-4c56-b7d6-c1e3d3b99cbf", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290709, "uuid": "b8defe49-70b6-43e4-900a-1ba9a0aa7650", "value": "24576:9KBnoz2YadJuLwNSD/lxg+ESJJlJKYTKzD781Bx4di:kOaygSZxhESJJQ3qb4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751290709, "uuid": "f3282714-2091-4149-8099-95c21e297a8b", "value": 1402475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751290709, "uuid": "fe9fd419-bf45-4e4c-b759-dd4ec8dab9cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290709, "uuid": "f3e85ae0-dbe4-47c7-a8fc-f850c4b5f251", "value": "59db3c542139e7d33e2d94635ff0fdb7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20e8efc5-55d1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751301713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301713, "uuid": "034c09b8-b8e8-4efd-b8f7-2b1c58440b59", "comment": "Malware payload (Mirai)", "value": "cac80d7bfb97cd17d1fcd94819d2015c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301713, "uuid": "67868f9e-9ff1-464b-a064-58db7e0cdfba", "comment": "Malware payload (Mirai)", "value": "e389a22f9b3afb0c931166ee35ed4668519b21fb82040c5def34e6da01918b43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301713, "uuid": "ef2400fe-68ab-47a1-bc10-820745fbc175", "comment": "Malware payload (Mirai)", "value": "d76bb72def15579d176bc9ad4a93e5d36ffd2bc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301713, "uuid": "0308cbcc-f345-4f7d-8d40-b87ed5435b27", "comment": "Malware payload (Mirai)", "value": "01c8d99db6e250fcaa2cfd91984bd2996a6bc6c04e02680ef24cd2cb30fb42b5d59166f1f119c0ca8cacb16db5a8cc2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301713, "uuid": "ede9e56e-97fa-4c1f-b557-565972299cd4", "value": "T1C8F3C71AAF510FBBDCAFDD3706E90B0138CDA54722A53B363674D528F54A50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301713, "uuid": "5c73d785-a167-4319-a4b4-31cb26885e84", "value": "1536:BquZISgKN+q9EEOGBPlYIhwcSukjv+d1dHAZ1fEQx4Si/4IJnx3ywn9B/zn/Fx:BquZIStIqS/kPIGTgFzi/4Qn15Bbnz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751301713, "uuid": "8b1b55b3-d9ec-4f9d-a41b-1e9143f589ba", "value": 170060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751301713, "uuid": "bff9ff8c-5933-421c-8323-676247b5973a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301713, "uuid": "bc259b96-8665-40ba-a353-03c7b54b65c1", "value": "cutempsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a463d74b-55a3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751282177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751282177, "uuid": "3541568c-f405-4c72-808d-8d1ea54fb7bc", "comment": "Malware payload (Mirai)", "value": "96ed3890a7d022d7bfa175a5543b9ec6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751282177, "uuid": "495751cc-bc2c-476d-8e80-ac5acc018097", "comment": "Malware payload (Mirai)", "value": "e497492dd5df48d4a4d63aeda5b4838b9d8ff99cf5ac82dadc8dfd479315d879", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751282177, "uuid": "5d670889-1d05-41fc-9ff6-f1cdf762ae18", "comment": "Malware payload (Mirai)", "value": "86a6761a0a66a02118377b7fa1706631eebd3ae9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751282177, "uuid": "ee5afe2b-3bac-47d2-8e9d-2b216795e3de", "comment": "Malware payload (Mirai)", "value": "49eecd5e5b4c7cc226df5d399167b7a04aa630c27d6fea1ad32c2195fe7d9cd28617af5498efbd3dbf9461e3f62a621d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751282177, "uuid": "dd89b310-1c2f-42af-a76a-3787b5a0ff17", "value": "T14F743A05EC104F6BC6D16BBAFB9A03CE763A5BA897DB32129E355D7033C2B49223D550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751282177, "uuid": "dbb1e499-2862-4847-856b-859888d1169a", "value": "6144:Em5e9rtoyJoSL4cqDowrTaUrs3w044U5w+twifIF8a3RS9jjhhJsmqdToI1q98gd:Z5e9rhL4f9KPA04T5w+twdTRS9jjhhJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751282177, "uuid": "7f75b7fd-0e3d-427b-a321-1a7f9d6b3386", "value": 363047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751282177, "uuid": "9c583927-156b-463e-89f4-cee1c4193964", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751282177, "uuid": "42b6e9aa-6063-4b8c-aaab-84db06ead048", "value": "a-r.m-5.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21b45b79-55d1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751301715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301715, "uuid": "5adfedbc-d7c1-4800-a2ba-ce5a16520f41", "comment": "Malware payload (Mirai)", "value": "fb9bfa2d4ec3bff520b5f1f84255c0bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301715, "uuid": "53f951e4-900a-4e64-9b18-047ac7963318", "comment": "Malware payload (Mirai)", "value": "e577e2fba99280a6bfb5abd75048d8371d2ab9637d1c2a74b95155e906677817", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301715, "uuid": "f4fa7e14-66af-4fd1-9941-e93d1e5f3020", "comment": "Malware payload (Mirai)", "value": "93d82984307d11fe47265d02b0c1a63f440dd9df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301715, "uuid": "7fe4cb41-5b37-4410-8539-97dd77d35f46", "comment": "Malware payload (Mirai)", "value": "fb5b31cbd22e8daf669abc1637fa9d0f52f0f8e56a33afa352d0aac5c01072ff993856ef30485e883fc458992fee1908", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301715, "uuid": "4fa14052-f92e-423b-a477-0fd3e9587c97", "value": "T13603F1CBB611E97DD5336171061A29C8F4AF2C69829F53A9C8FCB1FE8F1A5300E16754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301715, "uuid": "6f89323c-9a21-44f6-8a36-f280eb801adf", "value": "768:ciIsTzJ4fMrEivtdPZoYOE5cFmyGhCdrpApq6gNqE49Gx0rV9:ciIsTz2fMgedPZdJyGhCd1ApAqrMy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751301715, "uuid": "9bc7f36d-5405-4d6a-9fbc-7e3a69d0a145", "value": 41020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751301715, "uuid": "7d12717f-df93-4dd6-995e-3c87ad83a88b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301715, "uuid": "9370707f-b0f9-44a9-933a-e7f5f54e572a", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d34744b-55d9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751305277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751305277, "uuid": "a6e6e1b6-07ed-4e54-8af6-daadcd56538b", "comment": "Malware payload", "value": "fb39daecc665d83d11abaee4a7b90d6b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751305277, "uuid": "de86312a-22b1-4e52-a80a-52d838b2a7cd", "comment": "Malware payload", "value": "e68f1830cdf51af53e7aea6df03541d67e128ee82b2ef7c4346882d29452aef7", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751305277, "uuid": "5254a03d-3aa6-4759-931c-9f18d6365c8f", "comment": "Malware payload", "value": "3df4cdcf33355c706b666fa66cd9c1773aa19dc4", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751305277, "uuid": "b1c0a064-1979-4db5-8075-831489a9a6ac", "comment": "Malware payload", "value": "76e8fa13b80a47b979300c16dd8546b61b5388f7855a96aa94b823936f5603c262794a1b597561f9e5e9add7c8682d89", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751305277, "uuid": "9b96ec82-54ac-488d-aca5-ceb68cbdf3fb", "value": "T10236E11675CA8732EA3E8530A5AAD73664FA3FE00BB154DF63D4593A0EB05C242B1F17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751305277, "uuid": "c0c08199-d525-4900-bfd5-cfded960188e", "value": "98304:wxMvAtKknz5vquNsRe4frUMXjcYJDP3/8ApPMo4cQqrPGvzoNeVooX5lxw4301:wbYuNsRVjhcqPMoOqrsjoQTN01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751305277, "uuid": "a57747f0-b7f7-4b21-9e09-18d6de3399ad", "value": 5251619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751305277, "uuid": "aa309973-8322-41cc-922f-8527195c5a5f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751305277, "uuid": "9dc935b6-d046-4490-830a-6e97eb65ce90", "value": "6fn50.3no33Ta49NT59.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d78f66f6-55b3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1751289135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751289135, "uuid": "fed53bd8-a29f-4aa5-88b7-36eac23b7e9d", "comment": "Malware payload (SnakeKeylogger)", "value": "60bef301c683e83cc5618fc3785b95d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751289135, "uuid": "8e6975ca-59de-497d-8504-2563f11a81d8", "comment": "Malware payload (SnakeKeylogger)", "value": "e6955c6feb002c426cd1fac9174ca3ac8bfc32d2956fa355e6a82d7ec6b0994d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751289135, "uuid": "794f2e25-1c68-438f-83bb-eaaffe8b7845", "comment": "Malware payload (SnakeKeylogger)", "value": "a7e7c3839891417b5a39f7d0c4ad70f986734977", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751289135, "uuid": "053b678d-941c-474a-8935-460491beea43", "comment": "Malware payload (SnakeKeylogger)", "value": "9d16ccad7749858449f34fa56a280fe0702aa1f31db64d7085f85bbf2cb4cd0b681d38bed73bb618b13f00047afb6570", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751289135, "uuid": "5449afa6-8e08-4ab5-ae45-86e97127ee29", "value": "T16535AE0273D1D062FFAB91334B5AF6115BBC79260123AA2F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751289135, "uuid": "fafc3dd0-2b52-4545-bdb8-d25dd358ae26", "value": "0b768923437678ce375719e30b21693e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751289135, "uuid": "ca56b4f4-21bb-49e3-b27c-eaa4b8a4a658", "value": "24576:h5EmXFtKaL4/oFe5T9yyXYfP1ijXdaJbPX5cCcmzdx:hPVt/LZeJbInQRaJbPpcCcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751289135, "uuid": "fa3346b5-cd0b-4681-9101-b98cb39a904c", "value": 1101312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751289135, "uuid": "61b87d37-a1d2-4ad8-ad31-e79f6b6255be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751289135, "uuid": "2b7fad66-a07c-4bea-9269-df895cb86cf0", "value": "PO#809203.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53942deb-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751243816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243816, "uuid": "bde81d1b-5524-426c-a0fd-6ade4933e937", "comment": "Malware payload (Mirai)", "value": "e96aebd149325e8512493e634c888aac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243816, "uuid": "ca66f725-12b7-43e5-8856-08a4e17c0ed2", "comment": "Malware payload (Mirai)", "value": "e6b751e4c1c2d8f0011a41acd826849fbb3dd88005950831c5b469d8682c0825", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243816, "uuid": "11198e41-5be7-4002-80db-445594c8c393", "comment": "Malware payload (Mirai)", "value": "d2cf6063d2d84a21b4ef401ba20dcf1eb3b5efa3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243816, "uuid": "b7da0c31-0492-48a0-b00b-84878d35edd3", "comment": "Malware payload (Mirai)", "value": "8c4ac8a76dddbee7d0b5c2fec17ffe6b6c4f9e7ec1794474e3ba16d526abe6a6024f5b1499a1715cb2b9a30af0ae3875", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243816, "uuid": "5516bca4-e2a9-4707-9ec9-254795aef50b", "value": "T12FB39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8905F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243816, "uuid": "5f6b24ea-db80-4583-902a-dbc56b8b4c3e", "value": "1536:Nu27gBY9FSSpj3z5Qxw6YaWWgg1F/LWy:E9sSyzz36YaWWgg1Fq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243816, "uuid": "50083d8e-a157-47df-b020-a5685ada8f1b", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243816, "uuid": "bdd6705d-d726-472c-a4b1-bf3ae1f113e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243816, "uuid": "204167d3-5b3c-4e36-92ae-454ddb2af8fe", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2738ca2d-558b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751271659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271659, "uuid": "e6587457-b9c4-461c-ba18-6cafe3c4923c", "comment": "Malware payload (Mirai)", "value": "7a13d938f0f1b59c6c16ef8de14ea351", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271659, "uuid": "25807d0a-80e0-4a80-bc32-1251d93fd2d2", "comment": "Malware payload (Mirai)", "value": "e6c7f7799fff67f2464a74eb3e78a4cfb46368fe16792d83855eb2896c4d95ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271659, "uuid": "9ced7fe8-408f-46ed-83ac-761269fad26c", "comment": "Malware payload (Mirai)", "value": "e3da06a626857a12540c752b1a4b20472e858103", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271659, "uuid": "f4945753-5a38-41da-9775-5ee4ed0a7ef1", "comment": "Malware payload (Mirai)", "value": "f450b9ff9410edd27ff6726bf576ce0491d2ef28501cecf4dad55102a77fd37697d954afd3cdef6bad55239204436c0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271659, "uuid": "e348f89f-b940-41ef-b50d-32acc3181c08", "value": "T13AE3785D2E228FAEF66CC73047F74A25975D23DA27E1D684D2ACC1141F2029E641FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271659, "uuid": "510acd84-2a24-43c8-8a8c-871a40deee63", "value": "3072:6CdkTReRpilw2cXtNTpE/nqZYsjpnrIXU:6Cdkd4puc9nESZYsjJrIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751271659, "uuid": "3551962c-fd9f-4032-bcfd-bc88a15836a4", "value": 156788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751271659, "uuid": "ea1c3039-95d2-4da0-a178-5e8edcb5d199", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271659, "uuid": "36157872-5bf9-4fe9-87bd-6f6f6e9ee2ae", "value": "cutemips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75fb7f29-559d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751279522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279522, "uuid": "ed47b5cb-9e5f-4e21-9070-d98a4746810e", "comment": "Malware payload", "value": "3b3eac16198a9aaf30cbe88a42a505dd", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Matrix", "colour": "#38EE5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279522, "uuid": "90d4990c-a141-474a-914f-63488b214002", "comment": "Malware payload", "value": "e6d6b9e74cf656e0f7b248b757b7c3793756db671035d4592d7cea078473669b", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Matrix", "colour": "#38EE5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279522, "uuid": "8e5d7c54-05b6-4c18-9d4f-b9b18b9cdfae", "comment": "Malware payload", "value": "5913720c3d5aef9f6913a282f2f913c2f1e80cb6", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Matrix", "colour": "#38EE5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279522, "uuid": "a6524af7-4646-40a4-b2e7-2774a4959b28", "comment": "Malware payload", "value": "e2369ea61de47c6df49d1ac40c9d6cd20823e5f6c0eaf5305024e64df137f8859c5575f526e39cce2e754c3406ae4f23", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Matrix", "colour": "#38EE5A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279522, "uuid": "9839e192-377d-4037-9005-e4cb4a80ad57", "value": "T129E5E08AFB05D86AC4F7C236667646669117CC558A43E7934A66F13C0CB7DC08B8BECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279522, "uuid": "14effae8-13c2-48cf-8c59-a241fe079f58", "value": "49152:TaaRQuAzuERQqucc5plvMQW4xEKpzdXMtlR0AA7ko6EjKpO4:TaaRQuCRQic5plEJtKf83K7kpEjKpO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751279522, "uuid": "ae329ece-078d-4fd6-8d31-bcc39cd977f1", "value": 3106406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751279522, "uuid": "7ce70d1f-4e17-4a26-9893-5b3e75e7fccb", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279522, "uuid": "2b02fa51-b92d-4093-97e8-df6aebeced7e", "value": "app (5).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "894022ea-55de-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751307472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307472, "uuid": "3fd688e5-08eb-4896-b99e-efb8b7d4d260", "comment": "Malware payload", "value": "68a04f7dc1106051f4948d23ac4df6b5", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307472, "uuid": "b912bcf1-7ff7-4834-8670-26a6c1b0cc15", "comment": "Malware payload", "value": "e7b14dc10f5d1bbc6eb931a5095e92d8d39fc8b559a3780685d9b0829ab7d373", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307472, "uuid": "e81d371f-17f3-4ed0-a0f1-cbcebe2bf5b2", "comment": "Malware payload", "value": "a6b6b5c5b26736c37a0f4d48128b6452b312ef71", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307472, "uuid": "7ab0d088-3470-4b7f-bafc-65e5066cc975", "comment": "Malware payload", "value": "c46d5b6f12625bcd5a25b2f4155be3474c6b168383e88f00e88caab5c4ba3587776a834c95747eb09b4e35887630128d", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307472, "uuid": "1204345d-9bea-4fd5-b2c3-150c0b461878", "value": "T1F441AE26FD28D58C217118A724DBA045F0F442E39D599C28398DCC766F35BCF56D2DCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307472, "uuid": "9d30d82c-198f-40c7-b60f-b359d07d8a28", "value": "48:tgCcqS/4jC7HMy/FtTa7X33c+xkbmDLCO:3E/UC7sWtTaz33c+xk6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751307472, "uuid": "5a4409a7-af11-4468-982f-8e30773d3717", "value": 2062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751307472, "uuid": "33f785a7-a21a-462c-8c66-e7b3acad0f99", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307472, "uuid": "f83d4380-1f9f-426d-9fe0-f05d5d387561", "value": "weseethebestthingswithbetterfuturegoodfor.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada190a7-5598-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1751277468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277468, "uuid": "ab342d1b-9513-42ff-a7b2-023e912c8239", "comment": "Malware payload (AgentTesla)", "value": "ed5438d70d63783277ba23406140d73f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277468, "uuid": "96161929-433e-4fd8-8cfa-f655fa11d173", "comment": "Malware payload (AgentTesla)", "value": "e7c5cce820c2e60c95cf102cdf63939c15c8841af4092630ff8eaa58e4a0e7d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277468, "uuid": "dc654f7e-e3a0-4918-a6f3-bdb89653a63d", "comment": "Malware payload (AgentTesla)", "value": "fb83b106f2cdecea075db39bdffcd30ef2ace6a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277468, "uuid": "ecc7620c-19c2-44f0-9cb3-452f4fb5ff12", "comment": "Malware payload (AgentTesla)", "value": "e1661f2de57e41a4a069237aa6760800435230bd38713beb8c5df3c02f5ecf4a7542ec4b5798d7035d8f4bad911c9637", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277468, "uuid": "7326b71b-3531-4232-a6e0-61cc2ac98933", "value": "T197D53377E7335939A5A22E7E3897A72438A8150AC11F27F8DB8D339E465D3335A0B0D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277468, "uuid": "c2b35ab0-352b-4978-b9cc-5f18037e6ef5", "value": "49152:OVF/BANo3cyh5SM+eAZ80oa3Mtby7RvEIL3/Jb60bbeLQlggmw3iEKIBZDrYkhj2:+/BR3cynStVGtbY3L3/p6EeLQl7NKIri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751277468, "uuid": "b3e2dd4c-c681-4301-a90e-35d2b6fcd339", "value": 2833042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751277468, "uuid": "c53dae86-8ba5-47ea-943f-cad16513a73d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277468, "uuid": "ebd977da-c729-4202-a983-82fffab66a92", "value": "Bpl New Po-2000023038.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8057414-55de-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751307658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307658, "uuid": "b225b350-82d4-4100-a5fb-b66e174f2f47", "comment": "Malware payload", "value": "cafe3a630d4e1a8adc48dba8585eb44f", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WorldCoin", "colour": "#9A1133", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307658, "uuid": "b70568eb-2706-4cda-ad19-1326b88dd745", "comment": "Malware payload", "value": "e7d52900e476307555505252c4e0a63d4be4ce04b45dbb734c7d4c1bc80872bf", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WorldCoin", "colour": "#9A1133", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307658, "uuid": "7518d0dd-793b-412b-b289-528578c510c5", "comment": "Malware payload", "value": "bec714dfab7c8391451dfd5257782cf26d92d0b6", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WorldCoin", "colour": "#9A1133", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751307658, "uuid": "f6986bd6-895f-4d0e-9a46-095728dd2c0b", "comment": "Malware payload", "value": "986bfdfae6fbf9a232e40821df2182cdbf69b8a084d52fa94a064c8faea27aec85e0dbb5598bc8be4d91b970b5d60654", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WorldCoin", "colour": "#9A1133", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307658, "uuid": "3c22e398-3274-4a1b-a173-80ba79ad6082", "value": "T171D5CF8AF745D8BAC0E7D2328276426A5917CC568A43D2975E69F13C4CB7DC08B87ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307658, "uuid": "ddd37f28-3191-4507-a418-7a09113fe8d8", "value": "49152:mqcpxGx9r+M8H/0Xutm/t4nIYQ0fiZes/ON07R0AI7ku/uEjIL2b:YpxGxDO/Qutm/t4Ib3/W0O7kNEjILm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751307658, "uuid": "f8747e20-7cbb-4f78-9337-aef0becb4df0", "value": 2918600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751307658, "uuid": "87e5647d-9083-4dee-88cd-aae7aacc2453", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751307658, "uuid": "94385392-9544-49ee-91ea-58f1a267a957", "value": "app (12).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22aae182-55d6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751303864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303864, "uuid": "3c398b97-eb51-4f3b-aa88-5e69fe411cdd", "comment": "Malware payload (Mirai)", "value": "4bd82b1fd31fea854f8e8c357f85a239", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303864, "uuid": "c9515b65-5568-4bd7-85b0-e2a96efcf972", "comment": "Malware payload (Mirai)", "value": "e7ed00ebd7a3124bf74c3a1e5de27d55daeba1a6c6dd9b507a5c4435eb87e78c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303864, "uuid": "d2aba3d7-87eb-43f3-8caa-7d9a93e05d58", "comment": "Malware payload (Mirai)", "value": "9c62fabe1c88c5f61bb25d2ce715cf18025d10eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751303864, "uuid": "0d5aaf52-0140-4d5a-b87e-106bad6f7186", "comment": "Malware payload (Mirai)", "value": "4161234bf63dc162397ccc541aada7fdfaf5ea82ca39689bded01e6c6649a95a3d49afac078791f08452b348ef824d75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751303864, "uuid": "13c7f254-e92a-49fc-b96c-8c8e315cb8a4", "value": "T104D30A46F8819B11D5C111BAFE1E124E37131BB8E3DE7212AD246F747B8B87B0E3A915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751303864, "uuid": "4fd1fb69-4552-44f8-8f0d-1a3f254c10c3", "value": "3072:8OzwDVF1WxFXaOug4a71oLuctCjzhEBpa:8SwD18X7uRa+BqzhEBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751303864, "uuid": "fe88b83e-d30f-4f75-b01a-9ed6d17c3ca3", "value": 138780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751303864, "uuid": "3db6d58f-62cc-4b7b-a028-475860806490", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751303864, "uuid": "43c50af5-7f57-4521-bb6d-93e1ae82785d", "value": "cutearm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53a098b1-559e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751279894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279894, "uuid": "8a368274-04d4-4af9-a7c4-030a808aded0", "comment": "Malware payload (Mirai)", "value": "19ef9869aea33788bf2128c97f3aa66f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279894, "uuid": "196037f1-e31b-4e40-9236-3706b861658b", "comment": "Malware payload (Mirai)", "value": "e8a2007f726373f3ab9c26fbd0da9a0ab9432de9657b0e9d21963ca255ef649c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279894, "uuid": "bf1b9f20-2e4a-4cf5-bbaa-a7d18e21d258", "comment": "Malware payload (Mirai)", "value": "b28424232a52ff08a097a8eb71c54a74e5b4073b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279894, "uuid": "e532434e-3bb3-4b05-be0f-26ebb9e334ff", "comment": "Malware payload (Mirai)", "value": "2c2b47291d103d6ee0e37114413a2481ac0c1a47da4876471b6062648c6d1489140aec9daf6bc9e76f9a3283b34347b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279894, "uuid": "fae1be9a-f4c0-46a6-a155-3d8224bd6c30", "value": "T11CC30A45F8414B13C6C612B7FB4E428D7B2A17E8E3EE720399256F60379B46B0E37546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279894, "uuid": "d1768cc4-6324-4e40-98d9-333464262070", "value": "1536:pupQTPfQNvfB4Bmxu233g4VIk3JTqw1WJEp3JUgBVG3ccuxCBlLgwywpR+lDCN/4:puDH+mgB4FZJ1WJEjUqM+x78LBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751279894, "uuid": "2a3799af-e1ca-4f8a-aaa3-d4d18161bce1", "value": 121632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751279894, "uuid": "2fcb56bb-71d3-4054-af29-e6cba41afa9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279894, "uuid": "e107330d-12e4-470a-908f-8cfdc0d625d7", "value": "cutearm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cebb63b-5584-11f0-8bd0-42010a9c0005", "comment": "Malware payload (QuantLoader)", "timestamp": 1751268823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751268823, "uuid": "58d8a6e3-6fa3-44bb-ab91-df4064cb6bf7", "comment": "Malware payload (QuantLoader)", "value": "7f20218c0115ffa2436030e7bf13dc74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuantLoader", "colour": "#016BC9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751268823, "uuid": "75e47d2b-6aef-43fe-b54c-7a5103f6f288", "comment": "Malware payload (QuantLoader)", "value": "e8f80abcf626e470cdf8619fd461d1d33c3dad26917b9eb712faabb0380954ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuantLoader", "colour": "#016BC9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751268823, "uuid": "4e7bd4c5-7b75-4de8-9daa-318313cd00e8", "comment": "Malware payload (QuantLoader)", "value": "159bce48427eb72b6077db0ad661ea282ed8d947", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuantLoader", "colour": "#016BC9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751268823, "uuid": "d888966d-5980-43db-9aa2-02eb2a907cc7", "comment": "Malware payload (QuantLoader)", "value": "d68fd728ad5f04bf3936e1b222bd658f1c6fbdfd758d972551357c21bdbebde32009d6534510ec3155e99029b1631cf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuantLoader", "colour": "#016BC9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751268823, "uuid": "78a22c72-a7a2-43a5-85c8-75eadb7b2304", "value": "T1288612717D4044ADD04385BADD7D9A98868F348E0A33264D7D7B2B2705D32C1BF2AA6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751268823, "uuid": "6be0978c-b771-4a3a-a3bb-097b34d3387c", "value": "965e162fe6366ee377aa9bc80bdd5c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751268823, "uuid": "a8fe8291-f897-4774-a718-94e2dc67ae5b", "value": "98304:q3QE9jGQ0nuaZeWxmHuZhCMYkcaPt5FkOwSrIcUsLXRLDwTwbfQp8FPg6XwwKibL:q3Q2kuoevurH1xP/XRLDnP2wKYFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751268823, "uuid": "ef2c21dd-f79d-46bb-b42d-480294913c3c", "value": 8053652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751268823, "uuid": "7504b675-dfa5-4c7a-b472-a2b6a7ed0f98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751268823, "uuid": "e1e90ef0-0fbb-414f-adf2-a20dbe325411", "value": "QuantixIO Host Core.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa0d04a4-559b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751278750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278750, "uuid": "4702fdc5-c788-463e-9c32-9f5061c4206d", "comment": "Malware payload", "value": "4fcee21e7ea3c53a685a5cdffce4897f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278750, "uuid": "e0ac8ae5-12c1-402e-a257-0d881ba6bf42", "comment": "Malware payload", "value": "e90be00651be3262dbc852bb63d11fa1007c7b64ef3e98a38547714d99cd2cdb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278750, "uuid": "9b8c188f-dcc2-4a32-bde4-5094fb40c0ec", "comment": "Malware payload", "value": "fb426757bd0ecd117041cc9c9a11f223592ef2b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751278750, "uuid": "3d1ad7c2-5125-40fb-93bd-cb9ebbade463", "comment": "Malware payload", "value": "4ffc22db0d63c14a451d89c8025d80485a16e69f9a1375bd158d7862080cdd2dc5612c99adefe39d7d280af4c363dde7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278750, "uuid": "fc18342f-3823-405e-8246-1f42cd6bdda9", "value": "T15FE412017F152032C9D21AF0A8B747B4EB914CD650B4D6777749EB222BF36362C8BB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278750, "uuid": "5bd5affc-6c8e-4fdf-aad2-03644a2b35a0", "value": "12288:XeBWVNQiXY8aap1qXG2YmzwcyxDKsFM+t9j+9+X:uQQAYLapnLmzwhtLy+t9j+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751278750, "uuid": "863007d3-b194-4f51-80b9-cfb28de9411d", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751278750, "uuid": "b1e801f2-a491-4e29-b927-bd5634c35fa0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751278750, "uuid": "1abf3d19-de40-447b-9198-309a9587e12f", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "046c614c-554b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751244113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244113, "uuid": "1fdac168-0cac-4821-8019-d4e486ac77bb", "comment": "Malware payload (Mirai)", "value": "9e9e88282cc9008f666156863505b243", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244113, "uuid": "fa95c0d3-b477-46d1-8a46-ca66c4cc834e", "comment": "Malware payload (Mirai)", "value": "e9459714e6653d62252ee9c2b8f58df07914f52de0db79addc2b29a0a0d9a487", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244113, "uuid": "dec3e7f8-ad87-409e-8bca-e01f4d601384", "comment": "Malware payload (Mirai)", "value": "f6af0a44f6575bd57573ad8bc8fbc71dff6f8cfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244113, "uuid": "863b9987-07bf-476a-9097-4f8250b183f3", "comment": "Malware payload (Mirai)", "value": "ccd340d4ad58ca81b648bc0e7b793b9093c39a1cc96dc4244ab725dc3e9e185a5f468e806bdc42f67613584a3aa9a676", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244113, "uuid": "521e2e85-09f5-4b91-91ee-7deb0b1b3516", "value": "T143630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244113, "uuid": "839f29f3-f532-4bf7-8166-21071afbe2ce", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751244113, "uuid": "350de334-669c-479e-9ad9-e5f9c3d9d2ea", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751244113, "uuid": "fab4373c-dab7-4dac-b264-d59f8847d394", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244113, "uuid": "3da6e176-3c64-4fa1-aa9c-a47581a0109a", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d050c4c-55bf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1751294029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751294029, "uuid": "08d573e3-e639-4f88-9849-276603b0e365", "comment": "Malware payload (Formbook)", "value": "cef1e86f5c8e0068cdcec6f0150110b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751294029, "uuid": "92d61984-6f6a-481a-8518-527c639e2018", "comment": "Malware payload (Formbook)", "value": "e96a2b993722bee3393df92be9f4ec233673a7057c4fc8d31c5463f28368994b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751294029, "uuid": "d3a097bb-ec37-4a3a-870c-88c112c95c61", "comment": "Malware payload (Formbook)", "value": "4130875c4257297b9cc734740d6de7cbff2a79e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751294029, "uuid": "9b7e8b5b-1a5a-4ebd-81bd-e587144a9060", "comment": "Malware payload (Formbook)", "value": "b2753b2ad3b3e38c678d55bd0b7b9aa251f4785949da9d3a5e83d3eba8c4dc434477e85d700e900bf7a3168779adb75e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751294029, "uuid": "bb15c6c8-4ace-4e8f-b7bf-64d7638bcb1a", "value": "T1E475BFC6638F863DD13606347CFAA7AC582D7EEA3B1476CD1DA26D0C8E292D1E5191C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751294029, "uuid": "daf8bbcc-bdd6-44bc-8d36-da04ca2ca1eb", "value": "e2abca3a680b21f6252a3cf4bb41e3d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751294029, "uuid": "674af5c2-1129-40b4-b12b-3012477ed632", "value": "24576:WEXBExG0rr/P6w031o1ogt3ZxJebXLLJP1d3JDFlMu9h9G:WEruSwSzgt3ZxJeDvMu9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751294029, "uuid": "37da9f76-2b70-4f1c-b9bc-0459c7faab11", "value": 1701376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751294029, "uuid": "63d66283-69fd-4700-a880-f210e5904538", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751294029, "uuid": "86b26cbf-98ad-4fa2-89b4-fec343ce8124", "value": "90087261762132.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8efd159-55a4-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751282721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751282721, "uuid": "cdb204ba-2fad-4774-b1f4-bf30f80d0cfa", "comment": "Malware payload", "value": "634167d455f5a35acdc48c92f4e501e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751282721, "uuid": "0dd98baa-1d42-40e4-996e-5d7e76ceaf99", "comment": "Malware payload", "value": "e99d6002c57f789a91d7688c1881bac031925a9a9ccfdefd34bae386ebbae880", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751282721, "uuid": "ef563b90-d902-4b61-a4bb-a592aa9b6027", "comment": "Malware payload", "value": "42be794bde4cfec09dc2b05dd0936246ad146128", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751282721, "uuid": "d04d6dae-4961-4761-8012-61234378af8e", "comment": "Malware payload", "value": "ae6551851bc70073662c1f153cb9f6d5315f1a3da668f5f1f0ef066271b993fe4e438ef677b3323c6cb7080e0bbaec6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751282721, "uuid": "96abbd2b-8fcb-4b19-bd34-62c3adbb8701", "value": "T134E401037308A756DF4BA83A82CBFD31B7C2799113D096667A80E29F8775726CF0D649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751282721, "uuid": "4c0072f3-d784-4754-95d1-0623c3f86b9e", "value": "12288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751282721, "uuid": "4d2c7e14-40cb-4d14-a970-2b57a7a973dd", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751282721, "uuid": "3aff80dd-67a0-46da-950a-e99eb07980e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751282721, "uuid": "3412d365-8a9a-44c1-93b7-1d8c4186abc2", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fff75d4-5580-11f0-8bd0-42010a9c0005", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1751267003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751267003, "uuid": "c03d0fa4-2632-4e30-bdd2-ed39cc958b08", "comment": "Malware payload (VIPKeylogger)", "value": "9418812e88c44284f54abebaa693e96a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751267003, "uuid": "75877147-97e5-49ce-98f1-59b110d84c4f", "comment": "Malware payload (VIPKeylogger)", "value": "e9b560e26d141a71c603e367817a82ce1f1a7df671200f21749ba9908c66ea60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751267003, "uuid": "8ce667fd-bc39-48a4-b714-ab18ac24bc38", "comment": "Malware payload (VIPKeylogger)", "value": "8acd4748656e2053227e7d01bdd998cc4155ac0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751267003, "uuid": "0090bf8e-519d-4ead-bdef-ea291dccaf09", "comment": "Malware payload (VIPKeylogger)", "value": "371334bb4c913f7c3f77921e319becaad42016f9fc98cf9b8f26d3e5d42b2f051e26a665b5623ac251b02b9103acc71d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751267003, "uuid": "ca635fcf-4394-4abf-8224-705a703e3e35", "value": "T13E1512A63738D422D2D94E748AE5C6B2373FBC10651791277778FF4B39B6AD38A08106", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751267003, "uuid": "f1b9c20c-9582-4e04-9fe0-a3686380d9fb", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751267003, "uuid": "04a77455-2c5c-4e99-bd42-7ffaf93e8fb7", "value": "12288:kXu+Y3lDh1x7hCwTYFHYQOJ9lx29FF3PgccQwjxboIx+RJm7Ivg:kXu+Y3lt1x7hfMeN9l8jF/il4O76g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751267003, "uuid": "ac4f120d-1f36-4217-b2ba-3273c77001f4", "value": 900792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751267003, "uuid": "c2d97981-1805-4989-a9c3-b1e8d47c5e2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751267003, "uuid": "d67ba5c8-da2b-432b-b7c7-8ec43e247848", "value": "transferencia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19c995fa-5588-11f0-8bd0-42010a9c0005", "comment": "Malware payload (NetSupport)", "timestamp": 1751270348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751270348, "uuid": "e7152647-2f3f-4819-9bcc-25bd28732258", "comment": "Malware payload (NetSupport)", "value": "ae093d65271e552d466150483a154926", "object_relation": "md5", "Tag": [ { "name": "5-181-157-50", "colour": "#26357D", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751270348, "uuid": "78808be0-071a-4f79-92e1-ae3fee174364", "comment": "Malware payload (NetSupport)", "value": "ea08ca22043e06d218a0dc4f2c204f692afbe17e03e2df162e6302a983e905de", "object_relation": "sha256", "Tag": [ { "name": "5-181-157-50", "colour": "#26357D", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751270348, "uuid": "b810824d-d2d4-4876-b899-0d780ddef4f3", "comment": "Malware payload (NetSupport)", "value": "c02dc326a84812443cd3289c1b666971941d53de", "object_relation": "sha1", "Tag": [ { "name": "5-181-157-50", "colour": "#26357D", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751270348, "uuid": "f1848f27-7af6-4fe4-9646-b1672b198f0c", "comment": "Malware payload (NetSupport)", "value": "9be3eb8160d2aa86b4c02b387a32b1c89724f05bbf103ffd75395591dcb91ea413da439e3b57a095bb80966357b36977", "object_relation": "sha3-384", "Tag": [ { "name": "5-181-157-50", "colour": "#26357D", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751270348, "uuid": "4002306c-c2c2-42c0-8ee0-548861791013", "value": "T131A633485CAB201E080DCCA1CFCD63BA75EBA4CB7E2A35B30A90655CD1D57A8B4B457E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751270348, "uuid": "60f383d9-6526-4de3-9888-699189236d09", "value": "196608:Ur6GPDBYOsp3hvqmBcuBai3Kv2KlcuBai3avCeNcuBai3svw0fcuBai3jvjV2cuT:Ur6e6OsphCmRahOK9aF6ela/o0Ta8rVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751270348, "uuid": "632bbd1b-01dc-4455-bca5-d2dd10010225", "value": 9952018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751270348, "uuid": "e2d25af1-d39e-49db-b7d5-a82f7b8238a3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751270348, "uuid": "dfcb1a33-bc09-40b2-9da4-3d64be16e7f2", "value": "ea08ca22043e06d218a0dc4f2c204f692afbe17e03e2df162e6302a983e905de.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31930b77-559d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751279407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279407, "uuid": "a70b17b3-1afa-49b1-b9d4-3abffb953c78", "comment": "Malware payload (Mirai)", "value": "0d6cfc7d3437d799eeb6da9f087980a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279407, "uuid": "4f9cd58f-ba37-4d86-a419-814f4c651184", "comment": "Malware payload (Mirai)", "value": "ea13bba39dde5c7cf26a15447061d0b153d6c3b6f1b0c6684f3df55b6e46b700", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279407, "uuid": "f0de7583-312f-4f5f-b16c-c0ca9cd8f640", "comment": "Malware payload (Mirai)", "value": "e5a0bdeee9ea3d90f1e059c9ba79cf34f9156b37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279407, "uuid": "fd9fe329-6161-479c-ab1b-995be26158e8", "comment": "Malware payload (Mirai)", "value": "8750548c84213b3fad47aa0a0c9e873b5a12fa671f38e32894324453d84175121eac31a453430303222f6d49ad7db004", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279407, "uuid": "6d4827c1-b067-451f-b88a-a0a7bd03aba4", "value": "T1DBA4D63E7E11AF3EE26886310BF76B70D79621D232E1D385E16CC7181EA064D585FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279407, "uuid": "9d2ba94f-4d5f-40d4-9034-765d2718a619", "value": "12288:9v6pc8RmS+pvP5w+twPXPFSHCPCHh1Wr7c5PgzdOK3b:9TH5w+twnFSHCPCHh1Wr7c5PgzdOK3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751279407, "uuid": "378fd467-4baa-478f-b642-9a3d274868bf", "value": 471506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751279407, "uuid": "9e737f01-7017-43a7-8fc7-eaa7bcbf9453", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279407, "uuid": "caf02c0b-9c18-420a-9bb3-ede91421f450", "value": "m-i.p-s.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84fdbca7-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XWorm)", "timestamp": 1751292003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292003, "uuid": "ab829324-ab69-4c00-a476-49eafd577192", "comment": "Malware payload (XWorm)", "value": "9958ce306d13872e1e7bb477c867c524", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292003, "uuid": "fa918dad-6c21-486b-b121-a92f906cc5af", "comment": "Malware payload (XWorm)", "value": "ea2202c4b0c1249b69feae8f54620de216873ced23bb957931fcf943f73e8ef9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292003, "uuid": "300e12ae-e9aa-468d-b822-1ab32cfb086e", "comment": "Malware payload (XWorm)", "value": "9c284a5c26d1ffc4718c97ae634f54c4c6c69ff5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292003, "uuid": "9ba12216-96c3-4916-b618-57c23badab8e", "comment": "Malware payload (XWorm)", "value": "407734320929bfe45cd2dd98e7623f8fc36990399c1cb60a5439d014be96a6038e934e77b5e5eb47686a9d76a66cf384", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292003, "uuid": "a4c491f0-943a-479b-8b51-f3c7f76b2d1e", "value": "T11D664F9E8D0BF7833142DFE0BA88AD9AE07B96C317027A7070DC5D09B35DD6629DC658", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292003, "uuid": "f20f29de-a50a-4dbd-8e4d-fb513aaf5d00", "value": "6144:GfHofoVqiiAeUyZ+TRNYPUJISd3Zy1nYAF8gVXVFRfjvnx3BhIz/VmhCoqEuOhHJ:Gfq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751292003, "uuid": "886909b1-6b59-4d83-b504-cefc0151c9fc", "value": 6887919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751292003, "uuid": "4cf2ccac-067b-4216-8952-bcdbf44f92fc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292003, "uuid": "99c96241-5dd8-416f-9b0f-36f6dea9642a", "value": "H09876567890009.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8852d68-55a0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751281003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281003, "uuid": "1c9aec16-d85a-4f5a-a5b1-3a7a28b0fc55", "comment": "Malware payload", "value": "45751c3f219487d91593d0c2bea7866a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281003, "uuid": "966f0ab4-eb87-4fa5-b144-b16ff5a4a669", "comment": "Malware payload", "value": "ea660d2d6ae3439608ba7c3e7fb9ca83daf8bf54ba93a2e96b4a0ffd320f71ed", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281003, "uuid": "64dcc53c-d71b-4d63-b31e-6de81b062fdd", "comment": "Malware payload", "value": "2ce9f648e164124133aad49f0e4b2ae92c479138", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281003, "uuid": "4e9d55e5-23c3-4a0c-81d2-73165d42dfba", "comment": "Malware payload", "value": "9c6f46e1618fbc592292fd6776826d06a98a4699b9e8f757e5f0947e7976cd2a942b817d2dc9185d91772249e1f78354", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281003, "uuid": "f02e08b9-1e3d-4746-9215-aa3119aa3833", "value": "T15A653368040EF63F6C680ECA190776305778A637B9373D9D0F2D8159A9642A3C9F9BB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281003, "uuid": "b77f8ea3-8d3d-40ab-8fc9-6319852feda3", "value": "24576:lIbBaYszq3E46cZQ7mjmeRNhIr7m9EXzgXBEiuKkPA:YBmCZQ7nOC7pdir6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751281003, "uuid": "1c6af04d-2f89-426c-bff1-0d53ccdad006", "value": 1483335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751281003, "uuid": "48fd806c-5e4f-49ee-b4be-4fdaa652b347", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281003, "uuid": "ae675c50-23f9-42e8-855e-41d48f0850de", "value": "AdobeRdrCEF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb039842-55dc-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1751306777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306777, "uuid": "01032378-5ba6-4692-a56e-47b8c1bf9989", "comment": "Malware payload (LummaStealer)", "value": "517735da69f918bddeab9f1aadf47c42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306777, "uuid": "a627045c-722c-4a6c-8ff6-c36d1f228990", "comment": "Malware payload (LummaStealer)", "value": "eae4aa0f083a86a6b40dd4d5451129411f549fd9f736737b9364450ad4fb3690", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306777, "uuid": "ddcbfd0e-8638-4d93-a353-f512b874cc8e", "comment": "Malware payload (LummaStealer)", "value": "bc76a04f3efd8da6c77d6488b6a28e8f2ee8d187", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306777, "uuid": "6f73b07d-aada-4ca1-b74c-2c05a0443f07", "comment": "Malware payload (LummaStealer)", "value": "25d4ca4a8dbfbef865a80cb779a81f16e020cb5ac09d3d9a9069539f874c201f9827b65c8cf9e3ff560fcc4df14e8326", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306777, "uuid": "0e1575d9-057d-43f5-b2b7-ab2f42af2460", "value": "T1BB853319AE6CAE7EC14DC3354A9FF21437E87C2262C21D153864E277CF9B782247616E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306777, "uuid": "298a3933-fd33-4742-9d95-8fa777a0dfd8", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306777, "uuid": "8def67ac-a1cc-4d83-a773-2010ec452414", "value": "49152:0BhZW92dD1yMr/e0gcIXNPcDVcpFHVwLOM+JjFWbyKJ3:8ZNr/OmDVcpF3Wua3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751306777, "uuid": "9805b938-2710-43d3-b80d-39d970a6ed52", "value": 1843200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751306777, "uuid": "86ae50ed-1378-4f42-8ee5-035e821303b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306777, "uuid": "aefc612a-ba6b-474a-a3fe-6d44dc8e346e", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f768c2e0-55dc-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LClipper)", "timestamp": 1751306798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306798, "uuid": "80d4a22a-5cfe-42a4-a857-5d5736b8d9df", "comment": "Malware payload (LClipper)", "value": "fe46ad00fe28992efc2e48903ba65fac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LClipper", "colour": "#DBF740", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306798, "uuid": "2982a1c5-67b0-4b8f-8c2e-605cf7dfc4eb", "comment": "Malware payload (LClipper)", "value": "eb6cc7f058daf5a6aefc5e6239b7fb043e9c92f98224e44c24ad8bb7e568f149", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LClipper", "colour": "#DBF740", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306798, "uuid": "0ce28c6e-f7ad-4a03-82ba-f03c86ad7292", "comment": "Malware payload (LClipper)", "value": "c53294eaa6986983b58fc5823fec21b65765d579", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LClipper", "colour": "#DBF740", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306798, "uuid": "49532c09-53a9-4a8c-a6d3-1d0670dfc161", "comment": "Malware payload (LClipper)", "value": "12aa2ae6f0e889a6f1810337e50298184abbb3c06260c6aa60a894dc228638a4d7d84efb41163e69c44878af067fdfc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LClipper", "colour": "#DBF740", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306798, "uuid": "7c61718f-f74a-4c63-bba8-d9a67a69546d", "value": "T1E52633778A242FAFE5DD04F990E0DB27E89754481CE009BB136D2DEAB3133476257627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306798, "uuid": "b51b8158-13ef-4392-851d-6173f0f5c43e", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306798, "uuid": "8312c299-28c0-41c5-a6a9-b6f62912ce06", "value": "98304:TnKTOX1BlX/LOm7ZEQV6BQD63yvsC1GnbaJN03f1mM5QURLLI:7rfd/Lf9V6BQD6U7Gnu3QLLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751306798, "uuid": "75416762-5378-4500-8c0e-03c40ce22eff", "value": 4726784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751306798, "uuid": "7d4d3d69-220f-4abf-8f55-82397b85ecc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306798, "uuid": "d6fbe93b-4dd2-489f-ba82-a222126a5a94", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f8e4a88-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1751292047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292047, "uuid": "ceb16eed-4d05-407b-aecf-982effb891c6", "comment": "Malware payload (SnakeKeylogger)", "value": "494ff9dd49ad6adaf5311211433596a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292047, "uuid": "4c8d9e78-fa8d-442b-ba40-5cab4ad906e0", "comment": "Malware payload (SnakeKeylogger)", "value": "ebacd47d8d9c76fbc8e7f1c2d4768f5db3911ce8374ac2a704223c7c302b6998", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292047, "uuid": "2a1b7267-029f-48ad-905a-ac98e35d558d", "comment": "Malware payload (SnakeKeylogger)", "value": "e80d0dde6967f2a367da42d3518a5123bce5cba9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292047, "uuid": "fcb86c22-d14c-4340-9311-b50550834adc", "comment": "Malware payload (SnakeKeylogger)", "value": "3ec31c3ac62e6074d89ec638219586c6fa289a0a9b6601861dcd204da2d62e7ec4ffa0c58e57207ea96e9aba6ad2b73f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292047, "uuid": "0afd8c3e-e215-4598-816d-99c00f14c41d", "value": "T106F4024936359C23D4AA4BF54960C27947B98DECA921E3C70FCA3DDB78E5B611981F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292047, "uuid": "638d9d8c-69a5-4c43-b8cb-adba0611aabb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292047, "uuid": "eb1f3036-4e56-4e0f-9492-58d3db8d97d2", "value": "12288:nndOVNxOCeHmZWFdT89XOAM8LrQFUwcbq/wLOEjFUh+J9QdX5Vj4jb:UdOTfj4VYYFOwUEJ2dLj4jb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751292047, "uuid": "8842b409-beb2-4983-b0f2-79b12d54a2c9", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751292047, "uuid": "19ecae5c-179e-419b-b48c-24b42213d0c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292047, "uuid": "f8324713-830e-49a8-bedf-c361e2db216c", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4639c677-55a2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751281589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281589, "uuid": "89da7379-6950-47fd-821c-0dd6b990edd5", "comment": "Malware payload (Mirai)", "value": "a089d05dcb9e3e81a2b548416a771222", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281589, "uuid": "c09d5497-6d04-443d-b7af-e5de3f8cc5ab", "comment": "Malware payload (Mirai)", "value": "ec02712198ce96ad1f6dab706022df739102e7c4df407773fc07f47f5f1882a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281589, "uuid": "16127b5e-c2fb-4772-b7d6-9f7ec94ca27a", "comment": "Malware payload (Mirai)", "value": "0cd6959838bcff11ac7fb44a260d3e3c8548cdbe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751281589, "uuid": "360f7175-5531-40b1-af2a-72c9916b3412", "comment": "Malware payload (Mirai)", "value": "0c81c4c958f7261b2fdc0a63a62f5dd07ca9cac71430ba910564968db27447abffc17fe6240bef4b37eb48b1ffadf458", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281589, "uuid": "318232d2-1853-42a0-a47a-d3f8e5b13287", "value": "T143B3BEDBF74720A1C86247F007C78B9E3E6322119E57A9E76C0E6A7B1A390DB1917391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281589, "uuid": "68bda57c-ca09-4c10-b5ec-154a352fca57", "value": "1536:QkrlzMRnc5g3vT0vwya4WqYjteoJ84m24X2siyTxZJr+sg//LWF:Hrlom6YvwyRt4tfCGsikpg/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751281589, "uuid": "6d50ae09-7609-4650-98da-1b5f1dcb0507", "value": 116160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751281589, "uuid": "a2f71f02-e96b-47f5-9f45-f8d92b7904f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751281589, "uuid": "4dd8f2d6-2cb8-4408-9b7b-f773cbb9c111", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b72f38fb-5601-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751322581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322581, "uuid": "16a25db2-5718-4de3-a764-a940b3ccf190", "comment": "Malware payload", "value": "e598aec40e650946806eb590ab235f41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322581, "uuid": "4a896550-405f-435a-ad5b-c86b01db83f7", "comment": "Malware payload", "value": "ecc06d114b765af50b0007a5943845177a86e5a84ac2de36e9af8a585544c140", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322581, "uuid": "74175c08-55e4-4b5f-8712-cf6104d2d796", "comment": "Malware payload", "value": "aa40ac0c89e49b2d0eb343b3ba5064157ff9263c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322581, "uuid": "3386c102-e031-48fa-8de4-26b6d0aa2fb8", "comment": "Malware payload", "value": "8c62d92de94c13b4ce24701770c985004de16acf5ed1350e679365c07ec81fd9cb65aa4beecb2cdb8082a2fdc96fc613", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322581, "uuid": "e76c9787-bcde-4ef0-af73-74a8199881ca", "value": "T1C7A41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322581, "uuid": "64e03801-86fe-47de-851a-8fbc67e05626", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751322581, "uuid": "f368854a-86d1-4793-96b2-57ada5baf4bf", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751322581, "uuid": "7e0c50a3-d339-4544-9754-b4c2b5834445", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322581, "uuid": "b37a026c-8caa-4d28-8caa-e8c7da78ab79", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adfda04f-55d0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751301520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301520, "uuid": "fc7f5b60-5c77-4315-bed0-d0d894e26365", "comment": "Malware payload", "value": "b28dff80d6623e009af0c86a355d86f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301520, "uuid": "56bda16b-b039-4749-8070-890ab7a43459", "comment": "Malware payload", "value": "ece077a83be54eb875582dde93d2f0eef410c9819eb85d0c370d0a7a3f0d4510", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301520, "uuid": "46fdb166-848f-4a12-8a98-3c0bf96a0e6c", "comment": "Malware payload", "value": "9c5b0ded7627df35eaf5ecc19d2ae1801593ceb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301520, "uuid": "525f4a5a-2688-4309-bcf5-d1e0774ca037", "comment": "Malware payload", "value": "ad7726db8aa8ac62d29067dafdbc7f282d5896ee2c7a5a4527771973c44c26c73fee0d43652a8b7f022383c3faa044e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301520, "uuid": "eda3ebb0-ab01-4ad4-bdc4-8b16a0fc4d35", "value": "T176B41228EE4E38C1F3D1E3B8DA0A4BB1B05B79D0D166C1B2BA41E25D95EDDDEC5D0212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301520, "uuid": "c458bf4a-f8fe-4b75-af63-23cb4d1255a0", "value": "6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751301520, "uuid": "df8e7918-d141-491d-878c-ff55ad037224", "value": 509896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751301520, "uuid": "787f2f22-754d-4822-b58a-385d7b69c621", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301520, "uuid": "bdd976c4-6dc1-4979-8835-0171e6280b4c", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8512868e-5562-11f0-8bd0-42010a9c0005", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1751254207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751254207, "uuid": "81073217-d230-4046-96e6-3bf7b1e9f77e", "comment": "Malware payload (VIPKeylogger)", "value": "b4a96bfd57061788ee3af443b7bba2c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751254207, "uuid": "233a1c98-6dc0-4b53-b584-ef62a3b319a9", "comment": "Malware payload (VIPKeylogger)", "value": "ed4f18fab683cee330fdf69f975f732f4c494f33c3a8e917febc443cd99a1c28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751254207, "uuid": "3c8cc388-cf63-4586-bff4-6ac4638d10fb", "comment": "Malware payload (VIPKeylogger)", "value": "a0b1b8e5549af9adf3e3376ae8e89d3e262c0f4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751254207, "uuid": "90c338bf-527c-445f-818c-16141f6eb9c3", "comment": "Malware payload (VIPKeylogger)", "value": "f1ecee77e49617ded938f042338f0de3f12dd0edc34626ff4a1df8e6affd5d63e0e27df6512c1ddb5f59e7d029140618", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751254207, "uuid": "192a23b9-c842-4fdc-b0b8-96017a755b9d", "value": "T168D401123655C18BE5D1DFB305ABE536B5F0BDFD25A4869F32807B9DA9B0380C83E258", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751254207, "uuid": "398dc100-2409-4beb-a370-9ee89928a499", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751254207, "uuid": "c001b02c-6aa1-4f09-a789-2a7de83ad219", "value": "12288:BUooOvyxhFpgZ+sFXQbgX3Sui1vPtk0I10yoF0N:BL/aXfgZ+sdont410yM0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751254207, "uuid": "3c55101c-f026-4c4c-9245-364987c9959d", "value": 621696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751254207, "uuid": "9c51ce53-aa2b-4d1d-b403-db0c9e5fb815", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751254207, "uuid": "668c5675-ddfc-41f6-8c56-25a535ddcee6", "value": "rFACTURA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61138f54-55e1-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751308693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308693, "uuid": "1c9453eb-bec7-4ba1-9fdc-c3ac6f1ad21d", "comment": "Malware payload", "value": "b3d1cbd9c3683ab7383b5234c1b24406", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308693, "uuid": "bc3a3a52-3dd8-404f-a73d-b3e79b47513e", "comment": "Malware payload", "value": "edfd075428d8c9642cfc074c6a4fae10314576851990f028e6af1ef769f930c9", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308693, "uuid": "852c7340-13e7-4474-86fc-8539cb814c75", "comment": "Malware payload", "value": "a76c0a8de1e97011d6a4e71af6a7ddb190dca7f1", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751308693, "uuid": "8a74fcde-31c3-4dcf-849c-276d11e0cbf1", "comment": "Malware payload", "value": "c1440320f5e56ddc7b97f03c4080e311321416772c711fe5dfcc5dd2700ee9eaf6a9354b57cef499036552ba59c91163", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751308693, "uuid": "e974ce8b-fd29-4510-8f21-3af9d51be62a", "value": "T10406DFCAF7D85D2FC8771072C96E52B2665B4C028A838F47AD44361C79BB2D40F99BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751308693, "uuid": "2dea1c13-19a4-4011-b3f1-94408d6375b7", "value": "98304:0SQURYw8JbaiLuc8sqbXm3B25a8N6Soo/KrjV1q:0SQUb8JWi6PbAB25a8N6t1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751308693, "uuid": "68a3dff7-cee1-4569-b292-fa09e44b3f6a", "value": 3948195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751308693, "uuid": "41cd43c4-dbba-47ff-9863-4d1c0d142092", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751308693, "uuid": "97025b72-1258-48ae-86e7-3d7588d27c29", "value": "app (5).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f785d7f2-55b7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751290906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290906, "uuid": "652c980d-7175-4ab3-8d91-ac8f15e638a3", "comment": "Malware payload (Mirai)", "value": "fd09242955ef786658ab034d533b0efb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290906, "uuid": "64f16680-6ea1-4f4c-b549-0deb7ad510c1", "comment": "Malware payload (Mirai)", "value": "ef9c0de09235754f26b66ec4bbec3cc000a6425a96da85df92bc10764ba73880", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290906, "uuid": "a8531d06-fda6-4705-b3c1-35b35e6ded62", "comment": "Malware payload (Mirai)", "value": "8d96536a98ea6384894799503328c0c45c4762b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290906, "uuid": "a51bf974-2435-46b1-a82b-2c9fe29ce554", "comment": "Malware payload (Mirai)", "value": "98404df6f9707b25f3fdc2e5bd57ec240bd97028b51bdd7ae887a3a68912e3c48476b8e6b24baa9fba764145978e1067", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290906, "uuid": "35b0c0a7-69e5-45f6-be48-cec8a30a79c5", "value": "T158431746BC929B5AD6C063B6FA6E509D332163ECC2DE3257CD205B10778A81F0E77B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290906, "uuid": "7a8d8cc2-9e27-4a55-8ca8-9e960015d3bf", "value": "1536:+jt9CY/jCaEyN/cuB36PWZ8n/Jd4LghYGj:U9hLCaVNB36eOELgWGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751290906, "uuid": "09ac91a2-0127-4488-9998-9b506aa122c9", "value": 55164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751290906, "uuid": "6289a9be-100b-4916-9467-7d00429698f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290906, "uuid": "fe963465-26c0-4009-b448-1bfb9648d166", "value": "mirai.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acb33f3d-55ae-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Stealc)", "timestamp": 1751286915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751286915, "uuid": "dd411d02-5ff6-402b-9749-751b220cf7f8", "comment": "Malware payload (Stealc)", "value": "1d5e3f788b49aa2513a347010659da63", "object_relation": "md5", "Tag": [ { "name": "45-156-87-219", "colour": "#ADBF13", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751286915, "uuid": "cf2e75c4-1fe0-4500-85ec-ef306ebb6dd4", "comment": "Malware payload (Stealc)", "value": "efa447ade4609e699508ffd2e38d913d9e3bb21ac92c165aa2299ea9a6faf571", "object_relation": "sha256", "Tag": [ { "name": "45-156-87-219", "colour": "#ADBF13", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751286915, "uuid": "5d50df90-2f39-4f1e-a129-6ab32fb24656", "comment": "Malware payload (Stealc)", "value": "a3336790d7acb7b720406fa9029656cbd04d46ab", "object_relation": "sha1", "Tag": [ { "name": "45-156-87-219", "colour": "#ADBF13", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751286915, "uuid": "bc700c97-ee46-4de1-956e-5451dffed64a", "comment": "Malware payload (Stealc)", "value": "e62925f91c5e6da608c2d208dcd9ee0cfa6f393f4b5747368437108f8a9513127b5e7bc8102600440c77fb1a432521b8", "object_relation": "sha3-384", "Tag": [ { "name": "45-156-87-219", "colour": "#ADBF13", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751286915, "uuid": "3ec64d2b-58f6-4a4d-bc60-9335bacc9547", "value": "T104552386AF18AC13CA3F5D7154E023714F78B51768FA8B0F9796C904AC7A397AF1D284", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751286915, "uuid": "ac9e7e42-ed86-4ebc-b092-5ea354392ec3", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751286915, "uuid": "49e57cde-e537-402c-85d3-eede754a890e", "value": "24576:M0aYNpxhlON0cSs/v/5eniQhuFnEPTBKvXlgoshmeCyNAy7j3d7fQDHgR:MeNtYNH7/peiQhuNEPT66osARyNJX3dB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751286915, "uuid": "994b535f-2c76-4287-9095-9d09527fc38b", "value": 1372567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751286915, "uuid": "68778c5a-ad3a-4ec2-a0a4-09d679af94a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751286915, "uuid": "bbaff11f-0ff1-4be7-97ad-399a9e1ee022", "value": "\ud835\ude4e\ud835\ude5a\ud835\ude69\ud835\ude6a\ud835\ude65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba9bdb7-5580-11f0-8bd0-42010a9c0005", "comment": "Malware payload (PureCrypter)", "timestamp": 1751266996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266996, "uuid": "7fc7c655-e8df-469b-900f-0fba3fa532cf", "comment": "Malware payload (PureCrypter)", "value": "f5af71245e37b77e68f172ef3885f896", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266996, "uuid": "cf2b93a7-4d2b-44aa-8049-e61ab5c676f9", "comment": "Malware payload (PureCrypter)", "value": "efea6142ec625e09c0d569a540b975de8759026741cc5eb4b3ab716b18a71f3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266996, "uuid": "6efddd2c-7bd9-4dad-9e65-7197a7f097a0", "comment": "Malware payload (PureCrypter)", "value": "eca43ad7af2360c55a48080e68f2e82f20e811c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266996, "uuid": "4854a7ec-353e-4977-9680-1da5f39b7f1d", "comment": "Malware payload (PureCrypter)", "value": "4b2c1fba5fc120fc5e170a7ae703a474d622084234354218631f19ef0d82af94a284858ec5c08f93e646043b497f6e92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266996, "uuid": "648ac50b-ef65-4f73-8aca-afda2c93d391", "value": "T16344E6766BFC952EE29D0270F461971A47B4AC8AA352CB5E5604B0DA0C73F50BE83377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266996, "uuid": "4dd1a581-c4d3-4adb-a913-15011a30ea99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266996, "uuid": "67f9dc48-15ef-4aa3-81b3-70383aa4ae2b", "value": "3072:5GE3T5pDHv8FlLY+1mvVPbCp9758sscE6j2l5RRO876pDoAkLOojapitwGE1QWgS:5GczDP8z7mVbC775tnQ2ksH00", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751266996, "uuid": "a839da31-218c-4602-a83f-5ba0ef9f245c", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751266996, "uuid": "e48732b8-d21a-4d8f-9bab-829be09a4326", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266996, "uuid": "af10d10f-295e-4046-beb4-229fe2dfad89", "value": "PVM S\u0104SKAITA FAKT\u016aRA SERIJA HRX NR 3146684.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32143dcc-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751291864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291864, "uuid": "390e51dd-035f-41f8-891d-44752703ea60", "comment": "Malware payload", "value": "1fcc3822f771cb0d6a242e73c6a015eb", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291864, "uuid": "f4fc08db-bdc4-40b3-a6bf-096fce85deab", "comment": "Malware payload", "value": "eff61b61847c41e4067f748e082c025416cb91891a3de7c99bd3f7e7a7e656d2", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291864, "uuid": "cd21c756-235e-4291-9dc3-1e75e4f327d4", "comment": "Malware payload", "value": "b5a10d36fc367e3a3d16f4bc75299180e2ad56ee", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751291864, "uuid": "c2083b21-7b0f-4984-af48-bc1ec09bbff5", "comment": "Malware payload", "value": "56bf34a0fe5e89c9f99c77d764e12ab7acff4b192fa7e495e9d1f7d1667844e3bc305e0e3444484cb624d2a328aa7c27", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291864, "uuid": "0d2a4077-62db-4a9a-9825-4ba4048d3370", "value": "T105167D21B9CBC132E67D4172A968EB6B6079BFF20B3144D767E43EAE49B44C15231F12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291864, "uuid": "c38c0473-c4b5-4846-8295-c944b9552f22", "value": "49152:UKSOmJH6g7sJzM+C5ZC3L3TLKTf025ENZ4Xh1Vz53sWIGvZ9bY2bP5DHLr/yDWq2:tjJzMELTLuv1VVbYIDyvXk/nJEYsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751291864, "uuid": "8fd1cacd-5c97-44e8-a072-45749c5b018c", "value": 4388352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751291864, "uuid": "2ab27ec3-7ff7-40b6-876e-9ae8b71ed69e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751291864, "uuid": "377664a3-f5b3-4e40-b856-44517f2cd147", "value": "CURP_pdf.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1720f97a-558f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1751273350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273350, "uuid": "5d96bfd7-df9d-4774-b72d-ccd4a02268f6", "comment": "Malware payload (Formbook)", "value": "2d1e4ee926a2afd06353d3aec169d92d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273350, "uuid": "155cabb4-a6e0-4101-b8a5-875f0d131e05", "comment": "Malware payload (Formbook)", "value": "f0b9b0fcc5688be094fe596b2c69681a8e37206d82e551844d7dbcb6c6118d84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273350, "uuid": "00104eff-9e32-42a3-af5d-b7bcc38aef83", "comment": "Malware payload (Formbook)", "value": "4df7b1836b73ca87bef6880a8201ce84ea4657a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751273350, "uuid": "3cb0e921-90be-48cc-9952-0878deb764b9", "comment": "Malware payload (Formbook)", "value": "1a3278ed7e3acfc7377375d459174e0aae958789ab43b5390b7b876671caed24c579ee880d9dae3e48827fdf1734f2d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273350, "uuid": "074a131a-aa8e-4284-a918-b6af82b050fe", "value": "T110E41255392DDC03D0BA0EF50E91C57923B99D8DA622C7D2AFCA2DEBF1E17912841363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273350, "uuid": "245aa43f-e4f8-4c90-8608-07e0b8f134ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273350, "uuid": "8cc1b5e8-b892-4c5a-bc69-f237e396926e", "value": "12288:Y81q04aHnAOaCyKPnppduuKjGfJedcVfvZ0r8omqlYvSdjb:vq09nRxycpEJjG9dv7gjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751273350, "uuid": "c67dcbbb-21b0-4e78-98c0-d70cc0d164f6", "value": 688640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751273350, "uuid": "747dea89-f141-4fae-91d6-c4465598e2a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751273350, "uuid": "24bb53fe-eda7-4e85-a29c-f93f52194023", "value": "dekont_2673726726336363.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de7735d7-55dc-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1751306756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306756, "uuid": "6603da7b-d5fd-485a-8e25-6de0ea2e1dee", "comment": "Malware payload (LummaStealer)", "value": "fc2baaa895b41c1ae7dd3a48c39d3f0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306756, "uuid": "3bd2f209-6a5d-41cf-8cfb-b1a89f1c0172", "comment": "Malware payload (LummaStealer)", "value": "f0e261b72e77b25d687144f96606809f6ec6fedad389cc33a3f887aa6326ed41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306756, "uuid": "a18e1502-65b2-40e0-a032-da53d4a3c28c", "comment": "Malware payload (LummaStealer)", "value": "309b007589c7668fb953751791982163b74acea2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306756, "uuid": "1a3941ad-4444-4731-8533-07365c9cb805", "comment": "Malware payload (LummaStealer)", "value": "276c7b226e718dc4d94b911c90b98761fc79fc4e2cdc2491aa77e3d094814cd67297cef84479071eb96013bee79ddf4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306756, "uuid": "a532c457-6917-4ba0-9fe1-50575f62216f", "value": "T17A8533217F86A038D7B78C35323BCF21BBC08D0DAD568B967A29925D97DA2D586434F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306756, "uuid": "92bd5352-35fc-4ed2-b2b6-0d10b9129e66", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306756, "uuid": "e17b9275-4aad-409b-8d65-33e36e96a6da", "value": "49152:7MiBGyKfSTNANjzKiOW8+51jzFFdy8we2:hn1oRVFdrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751306756, "uuid": "92ab7f08-6c43-4e02-844d-24067e84093d", "value": 1872384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751306756, "uuid": "90d03141-849f-4f78-adfc-ec5c209217d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306756, "uuid": "208a8269-3767-4db6-ad87-9a475b2ba6c9", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f83a3a95-55b7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751290908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290908, "uuid": "30be5732-9ff9-4580-abac-c445fe4955b0", "comment": "Malware payload (Mirai)", "value": "9fbc88f2985d618bcccd1ff4322005b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290908, "uuid": "a61f9f5b-7141-4bba-bb2f-42ebefebb2dc", "comment": "Malware payload (Mirai)", "value": "f130d3442a9eccdb25ef1f3ddb7daf8e5700960cfb2cc1bc5eb848620b3c13da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290908, "uuid": "2cfbace4-236a-4c46-9482-d3f9c41f6150", "comment": "Malware payload (Mirai)", "value": "9bf756073fb8786a3907a138fa56a238f3990604", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751290908, "uuid": "d37e9804-067e-455d-86c4-6e71482277e2", "comment": "Malware payload (Mirai)", "value": "59944e5926f796dcd0bd4cc7c40d97a733bc128b3a5e9524b8ac2608514b9b92913c6e80d6e560853bc1e0de73f8d897", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290908, "uuid": "3e3183fa-5067-4a8a-b833-65b2d3b75103", "value": "T129435BC1A683E9F5EC151A713077EB339A77E57E101CED97D3A8A832ED52A02910739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290908, "uuid": "409e3544-ce1c-430a-8eb4-c08f07bdb2e4", "value": "1536:4jDVcJB8XMpOW9VtyE79AQILsYONWMuNU6BWdmT:Ucv8XaOYtyu90sY3MWU6QET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751290908, "uuid": "871314f2-2457-4df5-bacf-720c3fb88beb", "value": 57952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751290908, "uuid": "283874f3-ef5b-44e3-a31b-e36e111fe6ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751290908, "uuid": "1b7335ca-1f51-46a8-8f98-1d1d44a004cf", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b128d500-5598-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1751277474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277474, "uuid": "c0d689fd-a26f-4dd5-804f-85f6a8417189", "comment": "Malware payload (AgentTesla)", "value": "8ddfb79d368a01d371cfdf475eeacfe5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277474, "uuid": "1c20531e-3e86-4197-9b28-8edb02944c42", "comment": "Malware payload (AgentTesla)", "value": "f20ba040b3b4e680fd4b4ca3850055f9d4b317308634bcae58aa06e681ff2576", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277474, "uuid": "39f630f2-da61-435a-963e-da58f05396d4", "comment": "Malware payload (AgentTesla)", "value": "b917057017accaf8ab91550b92539fa75431bc5b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277474, "uuid": "812b8833-449d-4e31-be30-882dc156fee3", "comment": "Malware payload (AgentTesla)", "value": "04e509336432aed4f6f0bbda745f35173826110a1266e9ebed1a8eb221b4479953b18e9f5fdc6bec1d836ad2a6146e6d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277474, "uuid": "410b83e1-331d-4559-bde3-ef34dd8aab61", "value": "T188340E037E88EB15D5A87E3782EF2C2413B2B4C71633C60B6F49AF6618516425D7EB2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277474, "uuid": "5cede7fd-d87e-464b-8ef2-460199a8caef", "value": "3072:4KwmyuyGsrCzYbCAQvzufMRLnPvcxJ55FkM1ti:4KwmyuyGsrCUbCju0RrPvc1kMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751277474, "uuid": "566d9d60-2849-446e-8503-6fa626d55873", "value": 240141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751277474, "uuid": "9b39f474-92e0-4646-81c1-73f8f61f6918", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277474, "uuid": "ad2f609c-530e-4ede-a7d7-43c787e7df39", "value": "concrt141.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a6f8d1-556b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751258092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751258092, "uuid": "65c8d218-5b23-4eb7-a627-a5d5630a7ab2", "comment": "Malware payload", "value": "d6a201262a8aa1d560a49b1f0d56ef4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751258092, "uuid": "62487f96-4dfa-4668-9e67-a08917287fbb", "comment": "Malware payload", "value": "f20f82977cd32992d5fed489c628a48dbcc56af738317be6096aebba719e1923", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751258092, "uuid": "d271abae-2d80-4856-9c27-d6e254e9f369", "comment": "Malware payload", "value": "4110bee3c7ac5b492236106f551d4d3557382f98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751258092, "uuid": "21c96861-9e92-4344-a4b5-0093c3062ac7", "comment": "Malware payload", "value": "03a4484f204eb4dc2259129d9e5b5a76fb75e2e6e66206b472cec52a107e344be3612f5c442bac6b9e9adf86743d762c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751258092, "uuid": "220e4387-19b3-4e5d-8fa0-98bb7e046183", "value": "T1BDB401CE9520D295C4B02D33C57BA2F282AB6D3609596E1CDDD8FF6B2CF67450638B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751258092, "uuid": "362dce75-d4a0-4b4d-914e-ff477aef6553", "value": "12288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751258092, "uuid": "95bb89d1-e490-443c-bee0-dc8eb625cb36", "value": 502120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751258092, "uuid": "3e612d9f-e52e-41fe-91d2-551012e991e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751258092, "uuid": "65df704b-220d-46da-b419-53bc4501f456", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74b56e6-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751244064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244064, "uuid": "28281d53-5ee1-4795-a628-8cf5f1a14293", "comment": "Malware payload (Mirai)", "value": "b0f4986dc96cd35ec97452264ee5a792", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244064, "uuid": "0a116760-c19a-4af1-b4c6-78563589887b", "comment": "Malware payload (Mirai)", "value": "f2463a26fc42a12ed4244fb4267962ea251956c678aeb77eb15300087f12bb56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244064, "uuid": "2ac32b97-0584-4a5a-bbe8-793183666329", "comment": "Malware payload (Mirai)", "value": "566b9248763b2c41e7af1730b93c820c1463ed12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751244064, "uuid": "150c738e-a2ae-47a3-b869-72c7b2b24a30", "comment": "Malware payload (Mirai)", "value": "265b3cd271ad50a919176b105990b580ef00be893f31c5c24ded240e37c8cbc9a13cd8a23879fbcaf1922b4f66a34d6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244064, "uuid": "d8d12660-97ac-4c48-a1ed-ec041eafc529", "value": "T16B431891BC819A23C5D4137AF56E56CD372433E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244064, "uuid": "b29e4d8c-2e1e-4e0c-9fb1-d4667d847a04", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751244064, "uuid": "ae4b05e6-0bfe-4dc6-a7df-e6c569a4412a", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751244064, "uuid": "88fa3488-d0a4-4e2f-be8f-b63379bc9fed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751244064, "uuid": "94656798-a0ff-4fcf-a60f-ea154f43088f", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e3459f-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751243815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243815, "uuid": "5eb2cb8b-19c6-4b27-9712-163e4695d293", "comment": "Malware payload (Mirai)", "value": "279bbc98e27587c0db2e6fdd659f08a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243815, "uuid": "d2d1cef2-654b-4112-b65e-90ecabd3744c", "comment": "Malware payload (Mirai)", "value": "f2787ad42ddaf5647761471e79505c9e49b4c94757fa2e90304180e3f55b50f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243815, "uuid": "58efba88-35a4-4d24-a09a-535bddb2965a", "comment": "Malware payload (Mirai)", "value": "1ea5846ac1553d61844b67dffd11c1c3df11a6ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243815, "uuid": "13c28f31-70ca-4fb2-bc28-4329f2f81721", "comment": "Malware payload (Mirai)", "value": "5b7e706b5dcdb00fe2bbf944b8c26a3f4519dd0f6689dbb39bbbe73e8f9cb5a24280f3f5f74744cd5be706e87f6092e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243815, "uuid": "93021388-a252-454e-ab64-133aba9059e2", "value": "T122C2E1E07726FE31C420AC3DE52A4C8A3A51067C91FF383664558D399EC168B67F84F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243815, "uuid": "7b34e7e7-e87a-40a9-8d89-8cb4c6f153e8", "value": "768:JMKyhegCCMqfizjoNpd2vJdX6vwrR9q3UELuL:OKy4qfqoeJdXWgELO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243815, "uuid": "f0ab79bc-599a-4247-a55e-9eb82f915e07", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243815, "uuid": "66b8bbb2-baac-4261-8571-4d36daa5382e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243815, "uuid": "0e40e2a7-66b6-45ec-8334-7799815ac376", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a94d31-55a4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751282723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751282723, "uuid": "83536d06-1140-4aab-80b9-0c1fa7aaee0a", "comment": "Malware payload (Mirai)", "value": "e77430cf142b63bb18161e6a61fc4573", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751282723, "uuid": "6973effc-9bd7-4d4b-8717-c2f148b0930b", "comment": "Malware payload (Mirai)", "value": "f280fce42e51b6c8786413edfb9619437ae6ce3a985779e564c354ea664ebcab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751282723, "uuid": "37872a1c-624b-40a1-9f1e-9e82fb4cb86b", "comment": "Malware payload (Mirai)", "value": "1ef334fb77bf233ca6aa45f8e9076e2e2da79a76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751282723, "uuid": "f316bf5a-b14a-48b7-a0ba-78f4d29eb3cd", "comment": "Malware payload (Mirai)", "value": "421424b46c6383f6d4a512672432a6e004303bed67e0af3513b8a0ff63a5af73ea1ed7dcef854c76185c0d9714a052d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751282723, "uuid": "0d95679b-1459-43ce-99d6-2c1450f4bb1c", "value": "T19D13F229A4120D70EBF225B71AD11B87354D66BCD4DF34D336A15EACC28BA4327BD8C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751282723, "uuid": "db1b1bb7-1b01-41cd-a75c-d70c515b3739", "value": "768:B6gkthTDgIhaMeloF7gxTYz0DJTP74DmNCimYvTQbz3c/LVe9q3UEL+D:BypTelLIs0imYB/JLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751282723, "uuid": "1a578bd4-72a7-4557-b395-028029434ffe", "value": 42860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751282723, "uuid": "003da7be-62e9-42ec-8716-ec1d0c9f93ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751282723, "uuid": "90ce6ad9-00e9-42b3-85a3-efd65186de83", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0acdd1b2-559e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751279772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279772, "uuid": "eababeff-2e7d-4b82-8456-af4296789c6b", "comment": "Malware payload", "value": "58030b19533eb0bae34b10a7a817fce8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279772, "uuid": "f39546df-3e21-4eca-bab4-09df9e991e65", "comment": "Malware payload", "value": "f2992e642297283ce5045a7a159fbe70421e920cdaeeb1924f24974642369cc0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279772, "uuid": "4458c1d1-bd77-4e65-884b-af9ab1f02920", "comment": "Malware payload", "value": "3cdc4ae90d16a13954077e3e6dee1b8858544e00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279772, "uuid": "4407434f-4b1f-4372-8c0c-6e580644aaa5", "comment": "Malware payload", "value": "a8f18d1d9f02fc6f43f08040bb35071f66b1c378507504eabebac0f92b9a53b06b18a4f2949a0b22c4eefe163f2c6a3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279772, "uuid": "f115a027-ce24-4618-bd1a-036cc620a91b", "value": "T122A41294E9819B62C2C801BFFF0F45BC77A31F69E1EA71068D16EB1662D745A4F7E800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279772, "uuid": "58f24508-3432-42d9-9f8d-254c5a9ff506", "value": "12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751279772, "uuid": "dc628041-54c8-4db7-8de2-d020050754b7", "value": 480792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751279772, "uuid": "4abdf02d-db52-4b8b-ab08-aa8d6515239e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279772, "uuid": "e6e618dd-78dd-4e35-b97d-770d0fcab01e", "value": "arm926t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57b3d6ca-554a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751243823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243823, "uuid": "5f1dee6f-4f8d-4387-8e6c-dbfe55d56227", "comment": "Malware payload (Mirai)", "value": "1d3659c2826db74554a287246ba010f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243823, "uuid": "ae2cbf8e-8c1a-441d-97e2-71139e671f0e", "comment": "Malware payload (Mirai)", "value": "f34869faf114ece530256e6776748253df98d0f6b72f38a6c2eb86d93a445cfb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243823, "uuid": "caa0302f-bc8a-46ab-a3f7-edae8c34399c", "comment": "Malware payload (Mirai)", "value": "3edbce6bf9561557eca741b72144ef98d4c0835c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751243823, "uuid": "36b6755d-1e5b-4f45-97f9-b7c94aba28e3", "comment": "Malware payload (Mirai)", "value": "1767e608256c01e6820481c4f8c810cb85c2778d51c5507281242c0bfd485909f455040c68a22d69d35f90aeeda4a4f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243823, "uuid": "feba99c9-1c8b-4c5e-bf1f-19e920e1f663", "value": "T1C1A2E159BF1882CBC832293445E9E6D21393FC61F3EDCD492540C15BF5A37A96834F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243823, "uuid": "3380f7f8-3bed-493f-916d-bf033aabf04c", "value": "384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaHhib+502F2vwA9dWuMW21bAK1oTi:x98o08kxofBE+ZkXaEbp2F2TWul0c5Q/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751243823, "uuid": "4e85f2f0-7413-40ce-bb61-f7942c6a0119", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751243823, "uuid": "ffb6052c-ee7e-489d-acdd-8e8bd18bca8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751243823, "uuid": "bc2e53cb-fd51-4173-8576-bc8604462a01", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426cdb2d-55dd-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751306923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306923, "uuid": "fa5e3695-2122-4090-a0aa-c90206fec868", "comment": "Malware payload", "value": "f5b192da63b4c70aefa0409f1c1485e9", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smartshop", "colour": "#53E204", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306923, "uuid": "0d7eabf2-71da-47c3-9e1e-091826e800ed", "comment": "Malware payload", "value": "f466c7fe6b2c58489f85078f19b9b69b3835ad4c9eb425820f5abe8a164ef994", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smartshop", "colour": "#53E204", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306923, "uuid": "9d426e33-1253-46d0-987a-1e34b9cb8844", "comment": "Malware payload", "value": "c00bce6fda1c1747db47de3bb63c69ced5e445fe", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smartshop", "colour": "#53E204", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306923, "uuid": "7e79f49f-dd57-40b7-8354-c775f242958e", "comment": "Malware payload", "value": "5898b84d856eacf550109c6dbbedc8d7c5682378d38da1382cb3aff53d6101ddc03a94cf5cd635aebc9364d725af8f5e", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "chinese", "colour": "#43E9E3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smartshop", "colour": "#53E204", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306923, "uuid": "94050789-9390-44a0-b3d3-9ae554ddd1ff", "value": "T1CE36E04BFB48A86AC4F753B2553A536251474C268B43DBD3AD48723C19BB6C02F5AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306923, "uuid": "21719d75-e9c6-423b-a32e-ffd02f18ea78", "value": "98304:QKH5ArpBskXJOXt0QfvOiBVEsOX+kAwdf9ZUzXm/qCdVEIKUpwT5MuWIgLCrF4bT:QKZGOtB2iBiNX+Hwo2//dGI9/uWVRfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751306923, "uuid": "ee30cfae-2072-47a5-96de-f6d4b449cb2d", "value": 5333517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751306923, "uuid": "c3d92521-c62a-4cb7-9614-af2f67994d3d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306923, "uuid": "87214cec-f785-4ad4-8c0a-e6e8b2873663", "value": "SmartShop.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20998fa1-55f5-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751317175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751317175, "uuid": "b377f1a7-fc6e-4496-aec6-1a2ff1fd12a2", "comment": "Malware payload", "value": "4aa05ec47b08fa02c906dc1900851287", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751317175, "uuid": "a2ade1c8-5cc0-4836-8fbe-4caf0c03942d", "comment": "Malware payload", "value": "f46a72d601869762f8f07abe6767c929fe3ce23d77481bb2fb1064b98671448b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751317175, "uuid": "7e90954d-5577-4abe-9cb5-7990b1160600", "comment": "Malware payload", "value": "fd8edcfab6a51d0670659a8a6c326ff0172758c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751317175, "uuid": "dbea0a7e-4d10-417e-8458-3f0dce8ddb06", "comment": "Malware payload", "value": "954704e6742d2c9463d746f913386b8ba545f9205c93414c8e20980a473308a746277a741e8cbf92b1a904101376f8a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751317175, "uuid": "8c6fd68b-76bc-4f67-bdb1-7f873ddfde2b", "value": "T128A40294E9819B62C2C801BFFF0F45BC77A31F69E1EA71068D16EB1662D745A4F7E800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751317175, "uuid": "87cb5004-36c9-44dd-8e9e-e9fd2ed695fe", "value": "12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751317175, "uuid": "7681c502-0f6d-44a8-ae63-fbdae2b262e5", "value": 480792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751317175, "uuid": "c58c5f47-ff99-4ac5-bb2c-b7c0ed208c69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751317175, "uuid": "7bde5267-ded3-480f-8504-7e48dbf4cefb", "value": "arm926t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96955cdf-55ce-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751300622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300622, "uuid": "a1f2f344-9415-48e2-9e64-1283398a9fee", "comment": "Malware payload", "value": "5e7d5a4d783f4ca50693f841279fb4b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300622, "uuid": "4be3bb32-22ba-4fe2-90c0-5f55af12cb40", "comment": "Malware payload", "value": "f493246f738d6ebcb8650a0c9bf319e43a24cd542f9d5ac4bb8cc903a15e9dc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300622, "uuid": "5738b156-76dc-406f-8b13-9ab44638a705", "comment": "Malware payload", "value": "e9aa57b51d8a134acd39c1693966b3d56b90d66a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300622, "uuid": "553216a4-acef-4d15-b206-8f67c314700b", "comment": "Malware payload", "value": "42a0d7c6e6a618f78923ba6d9353a6b3f9fdbb1497558e0625051811e0476c62581181d09ed59e1b9fc57c41a52656f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300622, "uuid": "3a747163-47a6-4900-a330-faf00173c211", "value": "T1F1C4F1A377204F91C35195B209F389335AF6199706F39982537DEE107F20A68386BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300622, "uuid": "05fef574-4172-4c3c-a98f-ca4c69ea33d2", "value": "12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7z+:W7v+mrY2xzf03yvZ/YIe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751300622, "uuid": "0299ef7c-a7a8-411b-91d8-c72efaf67f53", "value": 592688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751300622, "uuid": "1b578f6f-9c77-4f75-a383-1f83510d0a96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300622, "uuid": "b862b77a-3619-4231-97b6-525cef913f96", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32cff6cb-5582-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751267813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751267813, "uuid": "3c7b0589-c3ad-4bf1-b491-bfc74368f84b", "comment": "Malware payload (Mirai)", "value": "c6ca1a8835417e11497f6e7f882f48a6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751267813, "uuid": "03de97bb-7cdd-40f1-9f77-5bddfee7daca", "comment": "Malware payload (Mirai)", "value": "f5558d89ff5d4c7cfda2b725acc283e7ec4f460346c008d39b8e0b7a88ab59ff", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751267813, "uuid": "0a90135c-085a-49fd-b7da-da125eaf8b48", "comment": "Malware payload (Mirai)", "value": "696e478a8200d86df382595b2a2816f762dda354", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751267813, "uuid": "e774d66a-882b-4777-9f65-a0da47f392e1", "comment": "Malware payload (Mirai)", "value": "4ab3042e6fbfca86bf4a7db445bd69e41245de997c79ff17c5a6e45475562c3543bdf51b79bd6f32f2905fb1f4f1dbda", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751267813, "uuid": "7a37950a-13bf-44e1-b55c-78822c75b021", "value": "T10701267DA1A88A5244B5C9C7B5F08506C081808FA2AE57E5F38E09266F28CCE3C5360D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751267813, "uuid": "e454d4a7-27fa-4857-a265-ffd8ac2b015d", "value": "12:FH8ioNJAC7ukxGWi2jU30+0K5+A+MjR2p+VDChp+VDoBc5ZhG+E6:FH8j/wWi2jz8S+Ef+mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751267813, "uuid": "48da1ffd-4653-4dad-a5f7-2b15fe4bb055", "value": 757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751267813, "uuid": "36e623c1-c9a2-49e6-90b5-36418ef1f7f5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751267813, "uuid": "b3ed8f1a-8576-42bc-b3ed-1fc8c46cbe4e", "value": "o.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f2184c-5580-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1751266958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266958, "uuid": "4c8b7345-751b-41ad-9849-54b4fe44893b", "comment": "Malware payload (Formbook)", "value": "6237a2b6c13a1d57e473bd955a1752aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266958, "uuid": "c67890d0-ae7b-46af-b006-a2bae42ef28d", "comment": "Malware payload (Formbook)", "value": "f745db2b407ab57072397092b6354a1fafc1442753acf17119dd464595e5bdee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266958, "uuid": "733f0760-953b-4a84-8788-150f827d0ec6", "comment": "Malware payload (Formbook)", "value": "91f72003f2cfdc6850881dfe9d5bb0a481a15c6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266958, "uuid": "3cd4a4c8-4df1-4fc7-b900-ff655b6d50b7", "comment": "Malware payload (Formbook)", "value": "6e0148991b3ef7c80084d539151b777e010ba28788d68eeac2995818a7b91d8e8c14e476b4e62daa475bbb5f362e8691", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266958, "uuid": "1d7ca0f6-50e5-4415-80dd-9d3272e1ed74", "value": "T1A355CF0273D1C062FFAB91334B5AF6115BBD79260123A62F13981D7ABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266958, "uuid": "6436cab4-ecc4-4f9c-bef0-13a826f55d8b", "value": "0b768923437678ce375719e30b21693e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266958, "uuid": "7566d9b6-b23f-40bd-a898-72f6ec7ddd33", "value": "24576:c5EmXFtKaL4/oFe5T9yyXYfP1ijXda5klrLpYXYbrulQbh:cPVt/LZeJbInQRa5YXpYXTO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751266958, "uuid": "639187b6-119a-4abb-9d7f-63fe2c17bed7", "value": 1299968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751266958, "uuid": "392fd8f0-ae3c-4e3a-afae-d8238a1d28cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266958, "uuid": "df3e856e-37d1-43c4-b5f8-75117a2a1b8d", "value": "83093155460.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1489c9-556a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751257492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257492, "uuid": "f728a04d-e366-4b81-9587-0e872783c63b", "comment": "Malware payload (Mirai)", "value": "b0b1c169440d994090c85c11f29922bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257492, "uuid": "e578121b-d6f1-4917-896b-00d75fae30eb", "comment": "Malware payload (Mirai)", "value": "f77e4acbd6326bd6ebfed249313eb3f99069751a025f978e7e1a88e9c711a1f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257492, "uuid": "f21ec873-2e0a-48ea-a4e0-045fafa87204", "comment": "Malware payload (Mirai)", "value": "2de8f73a6d6c5c0a1e7e24fe8868a9f7897cd43d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751257492, "uuid": "e9fad221-a777-4d38-a85e-cfa73268d411", "comment": "Malware payload (Mirai)", "value": "15f1a73d198b20708da17165207994435b0a50e1ba57ff50cfeddcaffeafff2e228c4f9fca7625762b902521819092bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257492, "uuid": "c8791ca5-adcc-467f-98b8-2b6ba819672f", "value": "T18B14A81E6E228F7DF6A8863447F78E24975923D627E1D644D2BCC2101E6029E641FFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257492, "uuid": "6cad77e9-96ea-4e55-a507-f96269babfe5", "value": "3072:x81URIv/HG4MszMOD3qbpvqutaZUxNNJTis872DN2bGHq:e1U4/HG4PWyuFNJn872B8aq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751257492, "uuid": "c49920ef-20ec-459a-a88e-9ebb6cd9fca8", "value": 194288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751257492, "uuid": "3f435b22-0c05-4e37-81e0-2939905b75e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751257492, "uuid": "5b29523b-ef9a-4872-8e02-f50a5599cf4e", "value": "neon.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28cfc269-5601-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751322342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322342, "uuid": "4b20c2b7-0eba-4b97-8419-be8f9beaa2b4", "comment": "Malware payload", "value": "0950413055e8d37622565783c8fe3e4c", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322342, "uuid": "4e967e54-7312-4fbd-a4e1-d2792ced0051", "comment": "Malware payload", "value": "f7b315433002585a47e38fdfc3f39f8bf00e0d301ee46427781c6acd2193511f", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322342, "uuid": "b20862bc-f77c-4273-90cc-cbd246739a5f", "comment": "Malware payload", "value": "5e27b5c3bb58c615c90c4852d85c167b435985b5", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751322342, "uuid": "f4d832cb-56db-4bf3-bc84-9272e0f322a8", "comment": "Malware payload", "value": "f4c24e3d4dd07d16764ae993ed7f08022f4db0549262a2ab56985da01b6c424693d2b3ea54a0c5b3fd1635e0de72805d", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322342, "uuid": "6986cbcc-60ea-4f77-996d-d73b017089fa", "value": "T1E6A33B7319E0503A1A2751DEF8727FA8B9565967C9438408E0FDA39CABC2FD7B521B0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322342, "uuid": "7d6cb417-e783-4786-8645-7266c21fc27f", "value": "1536:tXlj6URXpvYReD7XKUweVUDDk+dZNzpqo/umx8sMkJn/CgH6uAadklQ+Wl4oB:tXlj1d1YS8twoGm9MkJ/TKadklQ+VoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751322342, "uuid": "1da0c425-bf8f-4eb9-87ae-9a1ae181afec", "value": 98798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751322342, "uuid": "ced26e3f-ed56-4c03-8abd-66752fc2e29b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751322342, "uuid": "e9c62767-c7e3-4263-a2e5-92e6119e7073", "value": "Free Download Mod APK Data Games Apps Full Android.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d8a6abb-5598-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RevengeRAT)", "timestamp": 1751277307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277307, "uuid": "730707f4-7db7-4015-ae1f-a6cab680e0c9", "comment": "Malware payload (RevengeRAT)", "value": "58e2fd89d57527b029a9f785fcca5b3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277307, "uuid": "603ffa91-ef24-40d2-9560-119ce8d1913c", "comment": "Malware payload (RevengeRAT)", "value": "f803be56a49787b0419631f5065b8bdbe7010937e76b3cd799af52fdda394f5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277307, "uuid": "d1209629-3465-4802-a0aa-9b836f73c081", "comment": "Malware payload (RevengeRAT)", "value": "117ff8cac3336465859d355daae5f22d74facb97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751277307, "uuid": "c45df462-caf1-464e-bdef-aa55212497c3", "comment": "Malware payload (RevengeRAT)", "value": "20a5fef84cf6341d9a2ea03d6573998f23dc4cff621fca8b83ef25d0da5119da813484dd67f7feadd13ebe11c545af6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277307, "uuid": "241c2d20-1bba-4780-bdc0-a2a55ffe2792", "value": "T14EE30FE16744C46AD8AB96798437DAA7B433B24E9C68490D2DD1FF0B7D7238700278DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277307, "uuid": "829372fc-a008-4be2-83e4-7c0b7f5eddbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277307, "uuid": "d6162140-a9b6-4e0d-98af-7afdf1855797", "value": "3072:Uo8OjH2DMh5Z9rIrRuw+mqv9j1MWLQlmsolWM+sQ7:U+jWDYuDA1+N7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751277307, "uuid": "f388f39f-6a63-43d0-a8fa-ba3c64d31460", "value": 149672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751277307, "uuid": "64fd6c8d-4291-42cc-9813-412fa5504f58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751277307, "uuid": "0cafda8d-3507-4dde-bcd4-1b09482d1170", "value": "auditpol.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac9630d9-5593-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751275319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751275319, "uuid": "0c92ad51-22a5-419c-b823-ef1475f32249", "comment": "Malware payload", "value": "51c4f13a3581b4047ca6c920bef3afff", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Scostar", "colour": "#FBDB4D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751275319, "uuid": "01bf0c7a-258f-42ba-a47b-5b30c8731ccf", "comment": "Malware payload", "value": "f987d24529dcbd158bc6fcececfd2b6755e86fcd3b1358353b5df1d9eb8b8830", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Scostar", "colour": "#FBDB4D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751275319, "uuid": "26dbe443-ab90-4b84-be5f-19d24376a137", "comment": "Malware payload", "value": "7380ef9369fd79e128cf7cca5151865761bfefd4", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Scostar", "colour": "#FBDB4D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751275319, "uuid": "f34810cd-ccbd-4df8-b8f3-2e4f522d5364", "comment": "Malware payload", "value": "f9d06571eeececb994ac53802e54b68654d6f718c3d0d7183cd569088fc5da806941239692ae60f1d72aa48e224cfccc", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Scostar", "colour": "#FBDB4D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751275319, "uuid": "803e9ea5-b20d-47a7-85a1-12f7d015cdec", "value": "T1C656019AFB09985AC0E7D73247B6412A9603CC968A83D653AA41F17C0DB7DC05F97ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751275319, "uuid": "a4f4cee3-29a3-45ca-a0eb-dd1666a94a44", "value": "98304:eOndCZgcUpzr2vXPXndCZgcUpzr2vXPqpVMQFtGyie40TrWRHZUuVj5ECdpyt7eX:fgpUJr8fgpUJr8GFtGyieFnWR9OCd3qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751275319, "uuid": "0a5f2b7e-fa1e-4b07-9af3-96b96be24506", "value": 5993983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751275319, "uuid": "5c079dd4-9376-4bc8-94a0-37d0db63415f", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751275319, "uuid": "a3f55128-0554-4214-8457-d7f7eb562981", "value": "SCOSTAR.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c2d997a-5608-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751325462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751325462, "uuid": "cbb00f77-ceee-4b52-9769-ccc713b5b2bc", "comment": "Malware payload", "value": "154c9fa6f4ffcdf1c81556a3786b454d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751325462, "uuid": "d3692bbe-db7f-4d01-a78e-b2b180a0abbb", "comment": "Malware payload", "value": "f9a3c9d888a045206ef7c06a44d37feff7a87a20494015463f8d177f571965a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751325462, "uuid": "3383ac39-7453-4721-8099-55f8601c261b", "comment": "Malware payload", "value": "f8aa372757c61c6dac026e6e0df66dc83250d1c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751325462, "uuid": "cd3374fd-762b-4679-b880-b14a779a84b6", "comment": "Malware payload", "value": "b3e297909eaad617fc073ba3283389613b66ad571ed468985b4ff4db0f544cebf273b03b411bc603bb460ae5dcd049e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751325462, "uuid": "82ec7d29-8c25-4b49-866b-9c32ba2ec0aa", "value": "T154E412017F152032C9D21AF0A8B747B4EB914CD650B4D6777749EB222BF36362C8BB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751325462, "uuid": "2bdcff4f-7446-4289-8047-1ba147da7cc4", "value": "12288:XeBWVNQiXY8aap1qXG2YmzwcyxDKsFM+t9j+9+X:uQQAYLapnLmzwhtLy+t9j+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751325462, "uuid": "b17b79fe-2f69-4b64-b49e-4af96a23326a", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751325462, "uuid": "8cf10a88-82d7-4f6d-84a8-3afacb21fafc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751325462, "uuid": "c3e4d075-04ac-4601-84c6-b3ce33d439d0", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "296f22a4-558b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751271663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271663, "uuid": "f53725a9-d9bb-4443-b1b1-56ad23316c9b", "comment": "Malware payload", "value": "4c41a7c06a37ca6d88038363bcbae173", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271663, "uuid": "17c04a28-54a5-4c05-94a7-f8e2360e6465", "comment": "Malware payload", "value": "fb0e3a8fa69b5466273abbb40fe4a4a5f5a043581a0b429b6265cbb725217d89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271663, "uuid": "53d61a5e-e65d-44b6-a4b6-0fdbdf71ba9a", "comment": "Malware payload", "value": "c3a222f7a5a127f18db8322a274035b5b6098d51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271663, "uuid": "b9f63887-65fa-4111-82f1-ccdbdffe5907", "comment": "Malware payload", "value": "19d21d20b4a364693a3cd8d70ec9914312983d07dd36e5f203219f6cceec2bc02d112f82ef2da896317d9bc812c83425", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271663, "uuid": "745ce250-aefc-4860-97cb-36e9188fd3a2", "value": "T1D3D318C7F900DAFAF80EE73648530809B130BBA645925E372257357FED3A1990577E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271663, "uuid": "16b29812-aa08-4a72-b7ce-ba6b37a2a42e", "value": "3072:iBBE9BMAB9yGEz+prtZ0VYEzFDM72QV7jbiLLbq5lmyxMMN:iBBEW3+pXEdM7eLeeyxdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751271663, "uuid": "6a18f7f3-95e4-48ab-80ce-1b757ad6deaf", "value": 136428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751271663, "uuid": "12ed54da-eda8-4c46-88d3-733f359a6256", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271663, "uuid": "e4f34d19-0a4d-4356-8df5-6a1c4ad32831", "value": "cutem68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f666da2b-55dc-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LClipper)", "timestamp": 1751306796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306796, "uuid": "83b1b38b-b91a-4d12-aa0b-4c2585c2fdc0", "comment": "Malware payload (LClipper)", "value": "78dba2e08107d4a8d488690dbcaf74f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LClipper", "colour": "#DBF740", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306796, "uuid": "fa21c41b-e38c-481a-bbbb-275b44fb317e", "comment": "Malware payload (LClipper)", "value": "fb24b8f166faaa7981aa4f768fba7a2cc3ad1b3679d7a4b5600e8f8c81b8218a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LClipper", "colour": "#DBF740", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306796, "uuid": "cebcaef4-13b9-4b62-a860-521dbe5a998e", "comment": "Malware payload (LClipper)", "value": "41565a5384240f7e3a98730236186e1a17dbcba7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LClipper", "colour": "#DBF740", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751306796, "uuid": "03c950c7-f0e3-484d-904a-1331bf2d30f7", "comment": "Malware payload (LClipper)", "value": "b0398dedadc4cbcd316033e8f75264585d77c696dc566eea46f2b94d70e9b63a73ebe7e6e151dfa5ef946fdfeb5fd388", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LClipper", "colour": "#DBF740", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306796, "uuid": "4db99ee1-f790-4cb2-9457-d63c08295446", "value": "T10F2633AB9BB92FE7C085C57C80F5C722D646801E28D94C933B5D5BB9398316B9347339", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306796, "uuid": "eb7b18c7-8c8a-4d1d-bd64-27983a76e312", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306796, "uuid": "82d740db-b154-4bcc-9ce5-fb5f2d90d0f7", "value": "98304:BGYQe33gxvlBKUjXQF5EmL7V0aKoOXAuyCoqRrsbXH9CgzMadHwym:xFw1TKCXQFSwV0aK3XAuLRrWXHQgQWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751306796, "uuid": "d51b52a9-514e-4f7a-a982-401c4ade5c5c", "value": 4704768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751306796, "uuid": "d33ce2a6-71d4-4f6d-bf0b-1bfdf8fe0f48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751306796, "uuid": "3a2de3c6-a351-40fd-b55d-3f4ac4b1aabf", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1276615-55cd-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751300264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300264, "uuid": "707a95ee-d1d3-4994-9db5-f062c3814947", "comment": "Malware payload", "value": "1deef49381cdc01525d3612def5f6766", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300264, "uuid": "1527ff76-07d1-4813-ac24-9371db987899", "comment": "Malware payload", "value": "fb2ad4c4202265ef23f43c13c5e2a842f2cc0054a44e321bb7470e48d72e6df1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300264, "uuid": "c5b6c706-0b75-44b3-b4ea-ab7ae98fb611", "comment": "Malware payload", "value": "b66ca829599b0adf8c4abf6043ea626a60a605ad", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300264, "uuid": "fd78c36c-b0c8-46c4-87b0-44a208aa8957", "comment": "Malware payload", "value": "fb5949b2fe963480c97e93c73c9fdfc21e5e294dadd69a543fc601b8e1f0c6894bd45258390ccd631084ae28b7fde447", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300264, "uuid": "ee266f3a-ca52-438c-a372-b1297140bbc2", "value": "T18941B28B529309F13E69A967622B495431D2920B418BFFE2EECC36F880DDE4835716D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300264, "uuid": "8429bd87-e744-4f2e-b153-436f2305f308", "value": "48:vsChrZBkssClrossCXrWssCbrqssCV0rV4kssCMrrssCUrhBssC7r8lssC9rcdP1:vsYJsasas2smq4JsQsEsjesmsqsR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751300264, "uuid": "5cd2c849-8311-4920-9a0b-f0fccfb5aa91", "value": 2113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751300264, "uuid": "0eca9f98-1131-41f3-ac11-bac585fc4442", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300264, "uuid": "d71dddea-11bc-41f1-afa8-87b87412a27c", "value": "machine", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a4347b-5580-11f0-8bd0-42010a9c0005", "comment": "Malware payload (GuLoader)", "timestamp": 1751266986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266986, "uuid": "37f0601d-d6d4-4c1b-b34b-4a4050547cb5", "comment": "Malware payload (GuLoader)", "value": "48ea798be5cdf89f5db23f78fd5dab53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266986, "uuid": "8713533c-21c9-49d4-b1ba-fe5c494cc73b", "comment": "Malware payload (GuLoader)", "value": "fb916e8743da0246ccd1dcca9f8824b0d283be0306d7e1b7df10513aae265cb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266986, "uuid": "1ea7e2fc-d1e1-4ce3-98e9-8b1a9fd6ae3f", "comment": "Malware payload (GuLoader)", "value": "4017853672e761d7874dc35181cbaa272bc50b82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751266986, "uuid": "80973198-d1e7-42a2-8ca6-f6bbbe39b5e9", "comment": "Malware payload (GuLoader)", "value": "aef4bf1a0bf9c4bbab7cd751afb6ce7d141f22f4d1d3499fed3967e157c030835cfbd43a207562596d4c3eb7e38bd366", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266986, "uuid": "ea77a809-4d65-434f-be97-9a283611a46c", "value": "T17C2512A6614CC487DE111036507BFF53B2B9AF992FB40697CF40F22999B3ED4861329B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266986, "uuid": "df5b7795-39ea-42b5-b420-1a3dac9d9502", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266986, "uuid": "d1536c4a-0827-4cb2-b845-09deaf589832", "value": "24576:xAI2KZ2QLAyrZM3Yc/wQTHdrF4w+zDtcH8um:yULDZM3fwQbdeftS8um", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751266986, "uuid": "6228a9eb-f45a-4d55-9798-4379358876e7", "value": 1028256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751266986, "uuid": "bab772a1-519f-4d71-a889-b43d0ce1a7bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751266986, "uuid": "eb58d8c8-9933-49bc-ad5a-db557eb5d7db", "value": "Nuevo pedido - 1500007088.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d602d6-55ce-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751300621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300621, "uuid": "0a7385ce-5564-4a29-a499-ca94e0a3346e", "comment": "Malware payload (Mirai)", "value": "6c438b55d4ddfee0f9a22860a904b6d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300621, "uuid": "9fbc30bc-4aa3-424a-acb8-8eaf11cefbc4", "comment": "Malware payload (Mirai)", "value": "fc1848906eb6cf539a5009dfa5cbd87b822287242ceb9e04e7bd6f747a1f0a6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300621, "uuid": "8a411cc1-2937-4d86-bf32-6baf80f2bb95", "comment": "Malware payload (Mirai)", "value": "fbe22d92fb3094fc95718710f0eaf7271d3db614", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751300621, "uuid": "302fe965-6b96-4a44-a872-433ccc426f63", "comment": "Malware payload (Mirai)", "value": "1307e5072755315ec00770338bdfb48c16ede72f9ef231beab5b782dee9eccec9dae67edb69c8f6b201417d882dc1a90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300621, "uuid": "4808813f-93b1-4091-8e0a-76e240926c63", "value": "T1CAE318D7F800D9FAF80AE33648530905B130B7E246925A377267357BED3A1991877E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300621, "uuid": "c593dc83-e15b-4af5-994b-32f062e659c7", "value": "3072:0F2Gwn+l6j7/JWth+hqAuNN/wZVrjbirLRae+7ybbIE6It/:B52h+YAu/wULRaPybMEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751300621, "uuid": "2f1a3bc4-aa7c-425f-bd71-de0b73626d9f", "value": 146752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751300621, "uuid": "c9caf80f-7017-4f5d-9a98-c45c51f2df7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751300621, "uuid": "6699098c-236e-4cc2-bae7-02ac10fca986", "value": "cutem68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c14134-558b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751271657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271657, "uuid": "cd0fb9f0-0d82-44bc-b640-cbb5731f53e9", "comment": "Malware payload (Mirai)", "value": "6e68527bdd5dec77a9d38e512bb5d94c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271657, "uuid": "018bcb3a-a5d5-451e-a547-eb1377a053f1", "comment": "Malware payload (Mirai)", "value": "fc9d15e4c55967177adc41dc29a6c5a64f167a7cb8cd0f8915d022e42c59b468", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271657, "uuid": "a065a4c8-c263-4310-becd-c281b9be99c1", "comment": "Malware payload (Mirai)", "value": "3f6f860435110fd6e74cc54456c12a9886e7153b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751271657, "uuid": "e5676d84-e926-476b-b6a1-73b022962261", "comment": "Malware payload (Mirai)", "value": "180783b2d603e4806358dc91570e95c02db79f75775e0389cbdbf8d751c2a84b4b3acbaa7aeb7255dc3cdc58470cf420", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271657, "uuid": "4c0b19e8-8939-4eca-b69d-05da18b56964", "value": "T147C3F856F8819B12D5D111BAFE0E124E77231B78E2DE72029D246F747B8B8BB0E3A505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271657, "uuid": "62926247-87f1-41a9-a8e0-d227a6bdeae6", "value": "1536:V/nKHvJjYkNmowL5uIdR8grXyytTtglZSICa+gqNO5OibiLKFXEK+S5EOEBq0m0S:k1bMfxdS8X/GlZSICa+zKFXEKHWOEyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751271657, "uuid": "0fe9a46b-bad6-4dea-ae2a-e2145b9bbed3", "value": 128240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751271657, "uuid": "cd2150e6-06a1-430f-8da0-36d26e0c1106", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751271657, "uuid": "094dc085-0cf9-47c0-9f75-cf9cf47c5c7d", "value": "cutearm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44dcec52-55d0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751301344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301344, "uuid": "a39e48f0-40e8-4096-a9fe-b8425b88974f", "comment": "Malware payload", "value": "2e5fc8d5ddf7750ccbe10ab8d63298a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301344, "uuid": "25a7376a-695f-456c-bfac-a935476398da", "comment": "Malware payload", "value": "fd180216b6a414d2a79c85b7e33b20b8651fcb642d49734a04fdad54d360bb54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301344, "uuid": "a4a98c95-91b8-4a65-a64f-58e9de4704aa", "comment": "Malware payload", "value": "9f6489fff116ceaed7870380370f28bc603b48e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751301344, "uuid": "d9b3557e-0e2b-4f93-b18a-4aed89b3e0c8", "comment": "Malware payload", "value": "4ed3018c25b31d20bf0fe88a9cfee50b252027760329c6783a14ba95a436c8526e5ae72ebf5e80a7057e0da059ec925e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301344, "uuid": "be1c1b9c-3952-4b0e-9fa5-6c9a5edbbf12", "value": "T110A40294E9819B62C2C801BFFF0F45BC77A31F69E1EA71068D16EB1662D745A4F7E800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301344, "uuid": "437e1a96-d24e-4304-ace3-696fbab04df4", "value": "12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751301344, "uuid": "d7b97641-6277-4285-9da1-1bc2d20b1707", "value": 480792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751301344, "uuid": "e54fd6ff-05de-4950-b00e-fbbabbfbcbee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751301344, "uuid": "8927f7c7-58a3-464a-b210-680c724beaeb", "value": "arm926t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b979d3-5570-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751260248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260248, "uuid": "714e16d5-07bd-47a9-a964-28d48ab65bcb", "comment": "Malware payload", "value": "ca5b84da84e846943f633292091406c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260248, "uuid": "020408be-0400-476a-9d6d-4b7662152d10", "comment": "Malware payload", "value": "fd592dc2a990daea7a0bdb72779f4af8171b3e19d9d331d31c3e03c2742d797f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260248, "uuid": "33601fe3-7e9f-4b29-8700-4da1af7fd8ab", "comment": "Malware payload", "value": "3ce9e7c7c7f63572f24b691b9cc437832b87e0be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751260248, "uuid": "9404314e-fb68-4009-b93b-8c08784752c6", "comment": "Malware payload", "value": "eb42883cc1c2a3a947e82db9e4e873abfc91b24526fd9ac6235dd8809d851a49895513bc074a360d677b13ffad545a25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751260248, "uuid": "90c8277f-9b03-4634-aa50-3cc6899722c6", "value": "T132A41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751260248, "uuid": "2dd4ad21-f469-4759-8fbb-610a4d107689", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751260248, "uuid": "926c89a5-053d-45d0-9104-9181fb757371", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751260248, "uuid": "a424729a-8b9a-4b2e-9495-b4ce2e27bd1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751260248, "uuid": "c4bc50e3-ed25-4b05-b222-c2e3cf985d96", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53815837-55eb-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751312965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751312965, "uuid": "7d387b26-176d-41c5-9df5-e89d632b5be9", "comment": "Malware payload", "value": "307d472746a8e63a21f859772b9f5b7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751312965, "uuid": "a4d821b4-eb92-4911-a7f8-616b719f5094", "comment": "Malware payload", "value": "fd5e2e0590f9897e94bf806a54b0194e50a48fd16c81e36fa6efeb71174fd1b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751312965, "uuid": "5a3d2322-91d6-44a2-966a-d1754ce37b22", "comment": "Malware payload", "value": "6c45f6e51efc4ae9405ed5e10cfca1b2c33e8709", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751312965, "uuid": "d89fdb7d-9306-45b4-b745-064400ccd9fd", "comment": "Malware payload", "value": "0f679931099790df25642f59bacd978141c666c7ca9b813b96d752990c056e19246501fcaa01827b58dd482e39826ff6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751312965, "uuid": "a89f5a8b-aa19-4dab-b608-45e315e52505", "value": "T19C268DBDA6BC00A894AAD6ADC3466127E772705953B066DF5E608EF21F13FE0167F700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751312965, "uuid": "e223ae63-be6c-48bc-b7f3-c7dbfe104204", "value": "49152:sLVwASO8GtlqtH8a6Ux0RtEd+ARw3Q7PoqDnNeVOuRPD4aUjBhwBCTuejAOd5IIu:oaPdlaOuR71UYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751312965, "uuid": "974c7775-62ec-4b6e-830e-07b026ebeac7", "value": 4460495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751312965, "uuid": "c3405a9c-5050-44ef-a658-e3189a572789", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751312965, "uuid": "46aa2e87-6bed-43cc-a377-b351240c6003", "value": "fd5e2e0590f9897e94bf806a54b0194e50a48fd16c81e36fa6efeb71174fd1b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1b48b4-559c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1751279133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279133, "uuid": "f4209b81-9c4c-4f50-9932-b52990f9fc6e", "comment": "Malware payload (AgentTesla)", "value": "4d00eed69a01f762ae8c8c149f6b3f38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279133, "uuid": "d53c4893-bfe0-4970-8ba0-4251f2aea966", "comment": "Malware payload (AgentTesla)", "value": "fd6cffce948aff9c17134a6d29b5ba7722e65a7b385abef06fb357cd2b32b1e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279133, "uuid": "d33e5722-af37-408f-902f-2da45a1e4cdd", "comment": "Malware payload (AgentTesla)", "value": "42bd3c9d29609df1ca7d70632cffe13c4e7b77d7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751279133, "uuid": "74c24bfd-c34e-4458-a6aa-c8f4f2b4ece8", "comment": "Malware payload (AgentTesla)", "value": "72000bed65089a50435d207552194fc4347d8b51226fc423f5dd5bff95ec8f10d35c3996761fedc0082876f8534837dc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279133, "uuid": "13603d6b-ec76-4d4c-b309-96bfac52a67c", "value": "T1ABE58E092331EE16DD42A335BAB747092B53E13852C2921B931DFB35EBDA2C72F91593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279133, "uuid": "6da08072-2305-4c87-91ed-cf56e18d0080", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279133, "uuid": "c6ecf19c-ace1-4959-9cef-0081fd46559d", "value": "49152:tp7q4d6tl2pMedWjIUmyC/2aGg4t8CPG36reVMBwNfRZQU8lCE/vDMoydg:t1q4wtl6IIVsgXCPG33+B6fxIvvD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751279133, "uuid": "70f654ab-770e-4f86-85ed-4a44988d57c3", "value": 3028480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751279133, "uuid": "2e224551-0c57-4e45-9192-f5defdba4dc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751279133, "uuid": "ee3e41b5-fbd4-45dc-83e0-6a277f02b3d2", "value": "TK_107297915100_ 3HZ2502-2(ROLL 304-NO1)_SXXK_GREEN STREAM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8199d14-559f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751280546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280546, "uuid": "7aa6fa4c-a901-452f-8cd3-bee10ae63414", "comment": "Malware payload (Mirai)", "value": "64a8c6c5768fa055f85809727482482f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280546, "uuid": "f626c8f0-7a43-4f55-9f7d-e6879912a6f2", "comment": "Malware payload (Mirai)", "value": "fdfe60549389cad72f60ad757f02aa0f5c7e7974f3ab936474f152de421b01ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280546, "uuid": "af2fd0ea-fa8f-46e4-876a-64a8d4dd4034", "comment": "Malware payload (Mirai)", "value": "62e3b5adacb7b10aeb87ed8eb514dcae73835586", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751280546, "uuid": "dcefbfe9-859c-4433-9260-28e1ad99efff", "comment": "Malware payload (Mirai)", "value": "64263edb8cd9f38237cf66dd0e375e102f4f6cca12db0ba3d85afe14a132851b894b9a9047597e29ef2ad0db5055a0b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280546, "uuid": "8166673d-62b1-47f5-9fc7-73bdfd56402e", "value": "T16953F2A1970A94F2D1182CBE95DBD18D3F81A2F6DA5D5C0562E4943C31EFAC84B8F982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280546, "uuid": "118794fd-e378-45a0-a40e-fc8ff51daa85", "value": "1536:wGPtaBisYXpiOtjmoI6deCr0qMi0ZE3FHp2iLEzLjaIIDs6s0qb0W:dPfsvOsoI6mqQO1JnLwGIYs+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751280546, "uuid": "b933331c-9069-4ef0-aeee-96113bcbc8a4", "value": 65392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751280546, "uuid": "40f531a8-98b9-47fb-9e0f-700800263334", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751280546, "uuid": "76ffd3b5-f995-4af4-9b03-d93b86949ecc", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf82cd4-55ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1751292071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292071, "uuid": "46817c8d-aac1-43ad-a9b2-8edff597c4df", "comment": "Malware payload (Mirai)", "value": "6395461c852df85d097ad668c80a57e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292071, "uuid": "4c3d720d-8cb8-425e-95c1-838b3b239989", "comment": "Malware payload (Mirai)", "value": "fed25a810ff084957f4cf11384b377862414c27e0496244862a51e408db0c342", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292071, "uuid": "44bc09c5-291c-41f5-b90a-74c697fdcaae", "comment": "Malware payload (Mirai)", "value": "c652bd3fef04d017dcac63a9b3d6fe383053b85f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751292071, "uuid": "08b83151-02f4-49a3-aca7-c5a5e3275c44", "comment": "Malware payload (Mirai)", "value": "b2bb0d45cae397816e05a1f96fe3cd3413db609b2e88c859a8e459ae9ebe727c2380c8f9abce814c28e1d92b46ffba06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292071, "uuid": "d6695982-ddac-45a8-8047-1a3da444412c", "value": "T1A89349CAB401DC7DF80FDB7B4463490AB531E3A25A831F367257BD67AC361A44863E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292071, "uuid": "0ae31eda-e1c2-4c0a-a7b3-b015adcb7d91", "value": "1536:cIDypAw2/Q04m6ADptFXtcqo747dqO2LlHtq8J94inu/Y3whJdHHr+t+cVEbOyUP:cycAx4VAbFXtcaUO2LlHtfUY3iJ96VEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751292071, "uuid": "72504eea-2769-44cf-86e9-bdd5b8530d09", "value": 92736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751292071, "uuid": "09430845-08f4-4302-b7bd-d738ea024ad8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751292071, "uuid": "1985b2cd-f079-4ea6-8a80-98f8e6ae32f0", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "126eea0e-560a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1751326170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1751326170, "uuid": "b728e2fb-b486-442e-b845-91d57f442490", "comment": "Malware payload", "value": "4c176e649807ea3cbb92120786b14eac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1751326170, "uuid": "10cccc18-8082-4a99-9ed8-f146cffba15a", "comment": "Malware payload", "value": "ff4f1c690384b581cb3bdea7d006ef9d68836591d6f5c5397a3b760ffd2c0696", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1751326170, "uuid": "33959f33-3e4e-4f08-bbd6-015a36a6f423", "comment": "Malware payload", "value": "3ed062d62494d87320f23233f260ee5e4132a93d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1751326170, "uuid": "36b70a1a-80e5-4f25-b06b-d711db5e2ad4", "comment": "Malware payload", "value": "48b57524ed8bf07099998a5714dd7c65d2880be49f0bd74307ad9b32decda6cdbb512fb708c23c8d5692d376dc51bf40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1751326170, "uuid": "ded8214b-590f-45b5-857a-6ec389db2756", "value": "T145A40294E9819B62C2C801BFFF0F45BC77A31F69E1EA71068D16EB1662D745A4F7E800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1751326170, "uuid": "237bddbc-c8e7-4521-974a-5e638aa93a76", "value": "12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1751326170, "uuid": "5ac40ee2-1b2f-42fa-930f-e33291d21f0b", "value": 480792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1751326170, "uuid": "0b0851bb-71b7-4f54-a134-9ca7057c16ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1751326170, "uuid": "4f77b551-0ee7-404a-b9ac-82b0774e15cd", "value": "arm926t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }