{ "Event": { "published": true, "date": "2026-01-28", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-01-28", "timestamp": 1769644982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "62686a4b-8c79-460e-8175-5857cb60847d", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c952af-fc91-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769636299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636299, "uuid": "294f02a9-cfd1-4612-9fb5-99b856ddee86", "comment": "Malware payload", "value": "486de5cde6abddb0904446daa8d51bcc", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636299, "uuid": "7f00acf9-a30d-405e-84de-56194c15eec9", "comment": "Malware payload", "value": "00d11300d97796867d3a7de7df663d50f9eba274a1c17acadb677d2cd704570a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636299, "uuid": "2884d5be-1e4d-44af-8d6d-846266847ae3", "comment": "Malware payload", "value": "64cdd8fcba73fc68af91d92d0cbc476f27f7045e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636299, "uuid": "66f41ac6-52b8-4393-8317-72bcb5c447ce", "comment": "Malware payload", "value": "08cfb5b6d1093ab7d05602161616d592c9c3b6068727f8e0d094ec33763a6ac05f1045368bc4128ecb4a16aacee7d995", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636299, "uuid": "cdeeddcc-d6eb-443d-be3b-2fb1d5066bbb", "value": "T1ED336333D410FE0641A1EE55A2799B04D672D97748AC6418B60C4E4D0FCA9EA3BBFF4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636299, "uuid": "ea995642-d005-492b-be6e-940904a6d723", "value": "1536:CcHg5AjywuqIDFSD4zNq94AbluKlAGRhl0IG/O1kA:C7qtN/iOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769636299, "uuid": "221b1496-4e9a-4537-bb69-9e38371743c5", "value": 55045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769636299, "uuid": "90f186e0-1dec-4e0d-acf0-2af9c83f6821", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636299, "uuid": "342f08ae-5dd5-48a7-afba-2868de14f085", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c2ebae-fc42-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769602396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602396, "uuid": "62ec4b2e-6295-48bd-a893-a19cfb69b2e6", "comment": "Malware payload (Mirai)", "value": "6938e85bbe734e897c74dc852baa0e03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602396, "uuid": "b5d4c24c-2572-4e89-8094-5275f58560e3", "comment": "Malware payload (Mirai)", "value": "0119206748aad3f6402146d447a13a2be4aaa2952d7175ef4f11d26725c72f0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602396, "uuid": "9987134a-fb44-4113-9388-93ee792b2921", "comment": "Malware payload (Mirai)", "value": "027136e4e71e5d90f64425fa7c4fd645c7cc0318", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602396, "uuid": "1bada0c2-4230-4622-94eb-12006cf02262", "comment": "Malware payload (Mirai)", "value": "08ce6d926c5ed5674240b0a20d26b6fd7af792ed267c32e133f241de58d8fddbc177ef88e90afedb2ab10890bbe4e599", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602396, "uuid": "fe2dec52-82b6-4cfd-b23d-8482cce8c7f3", "value": "T1BD735C0277689F17E5D65AF118FB1BB087AAFD5029E67584E90EEB840331FB2184DF48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602396, "uuid": "97904841-7a6a-499d-9d92-378576222c16", "value": "768:MzzpxA779ZnaLskvgeFAcs1pl1gb8vpH5aEgGsllk5MDKw0COClBHW2tdFsDMUQe:MJ8ZnaOl19Hszk5J1UNbK1DVPy4C1p6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769602396, "uuid": "1af9e74f-a108-45d1-8553-f301e175c02d", "value": 78720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769602396, "uuid": "87640d96-8e1c-45c9-9067-70fa9b36b322", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602396, "uuid": "c9f4b6ff-8927-4344-99e7-2cbf8d4fdd45", "value": "pandora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4948109-fc29-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1769591730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769591730, "uuid": "2ea09956-1f52-4c21-878a-528165aa5dd1", "comment": "Malware payload (RemcosRAT)", "value": "d0e8ac832e4bd1926daad4808e268db4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769591730, "uuid": "801c8f98-6843-4654-b8e9-882bb6ad0134", "comment": "Malware payload (RemcosRAT)", "value": "014f82191da6caeb5662632441b2793fa4ed776f53913b5bac0d47133796397b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769591730, "uuid": "9e1a38b5-0e42-4f47-8087-38b4ff6534c4", "comment": "Malware payload (RemcosRAT)", "value": "484b7e0ed4eb0417f5dda8e1f7a5c9bf91a29721", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769591730, "uuid": "de43a246-10df-44cf-b740-e5fcca7d3853", "comment": "Malware payload (RemcosRAT)", "value": "df65e93695f9e0ead0ad0b0ded0cc3f239c8530797c11b49669b9528b45616e6dd929f42b3f5aa16a319a68f99a4f789", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769591730, "uuid": "9152094c-6584-4e2f-8ea0-355db5819684", "value": "T117452256362ED817C4669AF80CB1C13057F4EC9DB810E2CAEFE56EAFB5BAB401601357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769591730, "uuid": "fa4b787c-b52c-4180-acf8-2d9db80dfb07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769591730, "uuid": "c42c8c13-39e8-4bfd-a3c6-dc160116dd04", "value": "24576:zNEa4+HN8AAnkVhIsjk1i72QZp+tOrV/kZOPmBGB99F1SM/z9gGx5Q9nb5:c+t8chIsjk1O+tuCOPmBGX9FgC5gGxiR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769591730, "uuid": "f64473ab-c11d-4e12-95d5-7ea6ef1124fe", "value": 1181696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769591730, "uuid": "c4602cb7-d928-4ad2-bbc1-211851792249", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769591730, "uuid": "a296e468-4747-4b56-aa6e-04a8c8b18645", "value": "SO-\u7531\u946b-EXW -KEE-SEA CFS CLS0129 SO#4843.pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac37bc3-fc2d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769593485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593485, "uuid": "a3d72efa-c628-4ba1-870f-b29ee6e03918", "comment": "Malware payload (Mirai)", "value": "fa17f79316eb6b6936fdbe2cd44f09b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593485, "uuid": "92c9bd55-7877-4d20-b952-18c4fc3f6bd2", "comment": "Malware payload (Mirai)", "value": "016550a25f05a8555c3c6da0822f2abb4ffce15527acb8c1e2cb4983869f2244", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593485, "uuid": "82a8ab58-24dd-42c9-8be0-9a440de3d4e8", "comment": "Malware payload (Mirai)", "value": "5903c7fc1eb900c5466a4e12b3333f1a89d3b7fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593485, "uuid": "1547a123-1cbd-4468-9731-4c1991b7fc10", "comment": "Malware payload (Mirai)", "value": "07d75db8f8651054e0ef3d2261048c8ba1d8d7f599a026dcbab54d625fa7a3675bdb4835a656b8c4b0b03e3a4586989c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593485, "uuid": "71b9f3d9-f79a-425b-80d4-5e542101729c", "value": "T16393288ABC85C702C6E0A1B6FB0F559D371643B8E3E6B107CD18AF29634F8970A37651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593485, "uuid": "9b57c463-a750-4146-9aa5-55776ef3e635", "value": "1536:eiKYuHe3XCinXX04cz5/I4Su+pXojb9cIusR2ZXm5KuetGvBaqaCuqZL3X:enYu+3XvDcz7+VojBrusRom5jzlaCuOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769593485, "uuid": "e25393df-15ba-4d9a-b1d2-81bce2153ea2", "value": 96576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769593485, "uuid": "503c4f76-b542-46ed-9cd7-db6d8e27b956", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593485, "uuid": "9fc0bdf8-38b7-4e0e-91f7-b799a0a7027c", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f73928e-fc88-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769632390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632390, "uuid": "1bced9d1-cb97-4dd5-a4dd-4d921faf6db1", "comment": "Malware payload", "value": "a9458197291766ee95d15d8678dde539", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632390, "uuid": "52e84ee3-f760-484e-bd73-87bd07f10dda", "comment": "Malware payload", "value": "03bf9dfee9ad7c87c06a2106f36b1b6ba8ae2c08b1eb3b0a28581f9fa9414e33", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632390, "uuid": "4645b644-dc63-4567-986d-6b4f75d3a4ee", "comment": "Malware payload", "value": "f41e8087dbd284c7db187078a41b22547ced136c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632390, "uuid": "91beea7b-07bc-4bae-a620-4cf83157f004", "comment": "Malware payload", "value": "784d06cce94a10d63809e453459e50eb5d47c737b70a60963c5bb6c917fc663f9420a76b06a042ef1c2b648c49813910", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632390, "uuid": "df638db4-6991-4550-bcc2-1537a7427556", "value": "T1DC4113ECD095534FD0C48D30747A658C72CB999E67EEBE24E483687A50C89443FDB636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632390, "uuid": "cd2e997c-2ee3-4ced-838b-fbf90f5f39a1", "value": "24:wbxDqkpMjpMiM/MGMIGZB4xj/RMRR0/xcL1/j/+Zy3ZMZZkhc1pzZcZ6u0RMZFZv:mMdMiM/MGMIVjXoT+Zy0Dlq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769632390, "uuid": "f9b34c8e-8e1d-4072-925e-5c2958d42e30", "value": 1985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769632390, "uuid": "af442ae7-ce59-4ade-8530-e1bede3db2a5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632390, "uuid": "7e2cf00d-559e-4a55-ac72-39fc3de0c68c", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7aa2145-fc63-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769616673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616673, "uuid": "581218b4-99c4-4c16-9244-0664dd5584a0", "comment": "Malware payload (Mirai)", "value": "3cf3a5a6c034c86cc2961e2469fa7e88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616673, "uuid": "a1e9def6-9e81-4146-a20d-a13838fe764e", "comment": "Malware payload (Mirai)", "value": "045a662717c16c28648ae8f04b247ce1bdfe2c326fb4e909308129541b673e5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616673, "uuid": "66989bc2-49bb-417d-b6d4-8dba5b31fbbd", "comment": "Malware payload (Mirai)", "value": "fc6ccb91ec1840c584c5e17c876a82d49f0cbf66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616673, "uuid": "20e09beb-88e1-4207-b522-f1442493dfd1", "comment": "Malware payload (Mirai)", "value": "17b9270c682b1bc88361d1c106d7624fc065b1c857542de25e19b481b31462ee22e23c1de50fea31327c72ed83924c66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616673, "uuid": "a80001b7-c065-40f6-a282-dd7531ee96cf", "value": "T1E9C30956F8819B11D5C151BAFF0E124E77131B3CE2DE7312AD24AB34778A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616673, "uuid": "da9e1f23-a4cb-481c-a385-8369c51b9db8", "value": "3072:fsDTYhjFMX++aR8fcDeRqQVDtNQYciYfG11:fsDT6aX9aKfcRQVjoiYO11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769616673, "uuid": "ebfe3472-c687-4692-9c14-ae46ce358dcc", "value": 129244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769616673, "uuid": "6fc8fc5d-181b-46dc-b4e6-00ce77c1f3b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616673, "uuid": "4d65c8e4-7551-483b-9da0-0a6537ef8ea8", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f19715ee-fc8e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769635131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769635131, "uuid": "f8512f30-4e22-4f91-9b9b-02025aa61c86", "comment": "Malware payload", "value": "b437874eb15469ba6b089e01c2b4605c", "object_relation": "md5", "Tag": [ { "name": "007consultoriafinanceira-net", "colour": "#338075", "exportable": true, "hide_tag": false }, { "name": "avisoalertas-com", "colour": "#A3F604", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769635131, "uuid": "202b636a-34d5-4526-9aa0-8b46c0def102", "comment": "Malware payload", "value": "04c2743c1c5564ef8ba9c9ff8c6c8e9df459442d70390ad71482d9813358eb41", "object_relation": "sha256", "Tag": [ { "name": "007consultoriafinanceira-net", "colour": "#338075", "exportable": true, "hide_tag": false }, { "name": "avisoalertas-com", "colour": "#A3F604", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769635131, "uuid": "aa44012f-085f-40f9-a42f-da70caa78305", "comment": "Malware payload", "value": "4bf4f85d5f8f2036668bd8dad0e0b5f63a7b4864", "object_relation": "sha1", "Tag": [ { "name": "007consultoriafinanceira-net", "colour": "#338075", "exportable": true, "hide_tag": false }, { "name": "avisoalertas-com", "colour": "#A3F604", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769635131, "uuid": "6284d2fb-dc67-4d4a-88b9-d7df6a80c182", "comment": "Malware payload", "value": "cfd5a6b1365bc541e99f231b952425c12f2b41b69bf2fc286e8903809ca34bc0aab1fb480ba0a5452f3b947d9aeba619", "object_relation": "sha3-384", "Tag": [ { "name": "007consultoriafinanceira-net", "colour": "#338075", "exportable": true, "hide_tag": false }, { "name": "avisoalertas-com", "colour": "#A3F604", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769635131, "uuid": "2e5d0864-20a5-49d5-aa28-ac2b313c4a91", "value": "T1A5073310780FC376C3BB92BDCEB53ABC00C21D25664AAC52259D766AE1722227477DDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769635131, "uuid": "aa397899-9dac-4a55-819b-432a1f1baa09", "value": "393216:KOcwS+DYjgVM42/s9jmO/t2dxxv/SbKHXlrRCg:KO5S+jVM9cmO1MNEK3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769635131, "uuid": "77eb8dc5-a582-4331-b47a-d78964a1e433", "value": 17096704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769635131, "uuid": "936dce11-a4d6-472e-8230-61b2c0052c4c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769635131, "uuid": "d43bc9e1-67a4-414b-9926-48e26e418fae", "value": "setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5e20983-fc71-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769622549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622549, "uuid": "360d48b5-4179-42f4-ba89-29b2464569a4", "comment": "Malware payload", "value": "2a3a04e217c2ca52f40a8b32871beda7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622549, "uuid": "93544f50-0889-48ec-bea5-47ac8155d787", "comment": "Malware payload", "value": "0715e0493ffa012a9ff1092d79408e9478b831d93d78ecb64fb860800755ec14", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622549, "uuid": "968a2e8b-45e4-4200-a627-bc877ba27d45", "comment": "Malware payload", "value": "c5f07cf67b9aa7144d88fc585f60399db5c1c684", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622549, "uuid": "f237f289-4747-469c-a276-66d746edc85e", "comment": "Malware payload", "value": "be59e4eeb2cdc22a6f668434eefe728f2e05a4534dfe725ebc75f04e99f231f9555460cbec84ec579459e2c8a965bb4f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769622549, "uuid": "6308cea8-8880-4f20-900c-b1fb950c33b8", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769622549, "uuid": "8e2f0612-e429-44bc-b06b-08e19dfa8478", "value": "3::", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769622549, "uuid": "5c9321e3-b8c9-410c-9122-00b22efe67a2", "value": 11751424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769622549, "uuid": "962b17c3-d5cc-43f8-9aa7-fbe93512171d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769622549, "uuid": "08621d53-5a0f-4f61-bad5-6b04ad4796ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a16f38a-fc6e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769621187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621187, "uuid": "01be31da-4070-46b8-a38d-46bf298a9071", "comment": "Malware payload", "value": "23e4090f2ca73ac78212bd69cccf4543", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621187, "uuid": "b0630ae1-d729-4996-a95b-9174d3d02d88", "comment": "Malware payload", "value": "0750cef10b74193d1494718f84148a00a7a492e85f5ca1d27e5cef7611dcefb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621187, "uuid": "8669e149-b0ef-4116-8851-c2e5bcdb9ad9", "comment": "Malware payload", "value": "96f2207ea5f0eb5a16ac0073093aa2d9cd2379d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621187, "uuid": "21d555e2-a093-4397-9452-6f1e95a30fb6", "comment": "Malware payload", "value": "14467a14e5e6459b5487260d881f39f3a7a51c19dc2357c9e6d53c6f36d02bdb1b2068bdc3bddc3e4226f6fa3eaca19c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621187, "uuid": "791b7644-bab7-4959-b912-2e4c0f310163", "value": "T1A0E31945FC519B16C6C662BBFF4E428D772B17A8D2EE31039D256F20378B95A0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621187, "uuid": "f371a982-87e5-4df2-9262-b27b07c40ea2", "value": "3072:MzBs49tbMgxKZJ9Lwj5hMnXlU/vQP9EfSf4PTRLil6+GXH9VWES:eBd9xMggZJ9LqrMSQVi64bRLo67dVWES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769621187, "uuid": "6e6708ea-5516-4759-b1f0-324187558ad0", "value": 154168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769621187, "uuid": "dd948652-1738-4e76-92a4-4639ba0b537c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621187, "uuid": "ed77ed33-dc8b-4ebc-860d-8a5af2ad5c7e", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda27c61-fc91-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769636359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636359, "uuid": "69d9243c-16f8-4325-a4fd-4ef0c6ef29dd", "comment": "Malware payload", "value": "baa5ce55065a896d5da48fa4e65f90d7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636359, "uuid": "4e4c85ed-9962-4161-888d-ca9697cb86f4", "comment": "Malware payload", "value": "079d28c8654750aedba4f9bab422b37bf754921da6502523065086cc73ee0fe7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636359, "uuid": "3be01cfe-f0c4-4e7c-a9bd-40107a613f03", "comment": "Malware payload", "value": "3de58cb99db96595f64d115f405acf05e812f80e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636359, "uuid": "ba39cee3-9a10-45c6-808a-5b53bdb31493", "comment": "Malware payload", "value": "35c14d21ab0063b947a6550f919c974ce01a5e1d6995017d8e52f354f53c6a860496ff311716d0392819a734e65e1cd8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636359, "uuid": "682d075f-bca8-48c8-ad9b-886e41337a13", "value": "T1A1336333D410FE0641A1EE55A2799B04D672D97748AC6418B60C4E4D0FCA9EA3BBFF4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636359, "uuid": "e27cd659-7a81-4ccc-b9a5-0cb99a30095a", "value": "1536:CcHg5Ajyw3IDFSD4zNq94AbluKlAGRhl0IGJO1kA:CItN/oOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769636359, "uuid": "9c36049f-f74c-4d7b-b5bb-853249fefd11", "value": 55045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769636359, "uuid": "630f2d87-a3e0-4e78-b860-67a39494cd69", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636359, "uuid": "04d746ad-bdc6-45f0-9b79-a43db4c3cd36", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1851f946-fc70-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769621882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621882, "uuid": "7b28b578-1eb7-4fde-9916-c20b1c872e66", "comment": "Malware payload", "value": "ee7f80b535931c07bead0e21b0c6761c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621882, "uuid": "33003be4-458a-4ad5-92ed-888b21a59f77", "comment": "Malware payload", "value": "07f28fed1376b2575fee8d3ff15d9afe7bca37125359e87a1b58237f723ccddc", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621882, "uuid": "0de85617-80fb-4cb8-9105-92b95c432518", "comment": "Malware payload", "value": "2acc983eca527a68ec42f8bcd6758ba1d199f4dd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621882, "uuid": "91c94ca6-0349-4be5-9c9d-5478b252e597", "comment": "Malware payload", "value": "07b5f2b78b3280448e116c279e5f1cab976922bc88dd6fedec044606d30a565ce53264eaf400940afc5d9566519b796f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621882, "uuid": "bd9c9f8b-9b12-4917-a5cb-40e3830bbffc", "value": "T10D66393F62A5816DC26EC23EC0A78F01D9F3B1751737C2E752A207689F569C19E3E261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621882, "uuid": "a21e63e5-0449-4be0-8b78-c0a37b7112a0", "value": "9692762365b0d3385170e1ababcdaa1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621882, "uuid": "15d04b35-edb3-4382-a877-b5f3927fd6a8", "value": "49152:QLcLOnXF09KKdYbIK4KdgL7dPSXceQJQ+4KJL6gH4eY2FKTf5+Qn23m3beF7hrbI:KswTn23h7ZaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769621882, "uuid": "f36ad9bc-d8eb-4674-9276-b4ec368bf329", "value": 6965248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769621882, "uuid": "207f5e90-fecd-4491-aa60-ac37d338d730", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621882, "uuid": "ec5ced3d-9b73-4e1b-9e98-023c39f0745d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "936ed0c4-fc73-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769623377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769623377, "uuid": "a52460fe-8359-4a79-95af-72e50f8796cc", "comment": "Malware payload", "value": "cb4bee0541640b889c8cae59169f6c6a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769623377, "uuid": "53a392c8-d961-4726-8ae5-fe9dd82266c9", "comment": "Malware payload", "value": "0828f4aefbaabbfd586b4f050aaf015c9feb0e21e3bfdc9daa863935112514fb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769623377, "uuid": "58e4f8f3-8381-41df-a70b-0e2d4ab52755", "comment": "Malware payload", "value": "6d671d4f37a9d010f205c3b2b150930b9132a12b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769623377, "uuid": "aef5f68e-2c1c-4e40-a2ee-4a0909a0925f", "comment": "Malware payload", "value": "a507eeb7828f3c553aef4a6a309210c8713fbb4ccb48bdad33fbf0667ab2a3598a25631f820550d8600864600cd841ec", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769623377, "uuid": "56e93f7d-3fc3-46f0-ab1c-3ca437620af6", "value": "T14B24CFE837DB2D2EC5BD491EB4E1C0027F9E88EB063956CE41DF06D2B7AE24656BC450", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769623377, "uuid": "82c4e06f-88bb-4dfc-9be6-899cefaaa0cb", "value": "6144:Oht03cvuIwJ3ezhbSOADg7NLSEjQwBO1Vj:8K3A1JLzQwBO1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769623377, "uuid": "86592f03-2add-4aec-8a77-de810427d4f6", "value": 217018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769623377, "uuid": "4ad75cb0-434f-4e2d-b20b-08491e536e38", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769623377, "uuid": "62d7e5c5-efeb-48f9-8555-bbbc31453f71", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353ea41c-fc55-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769610334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610334, "uuid": "b4c5fedc-27e7-46a3-bf0d-84719e7d6724", "comment": "Malware payload", "value": "382047c86de3eccb1f78b97a51a9caef", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610334, "uuid": "0e733c08-003e-4033-9c68-fc33392983c6", "comment": "Malware payload", "value": "09d215bad128ad10debe3299334d066e1ea761651285d78c386377187fd7dcbf", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610334, "uuid": "33b18e77-cae2-4c35-b5b8-3224d4a2584d", "comment": "Malware payload", "value": "434308016b19320116d1a3beed462208ca7b5677", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610334, "uuid": "04b337b7-d9c7-4a9d-b365-5fbc558d74d4", "comment": "Malware payload", "value": "05efac5961de0130e3250951965b9136010faf6b18ce1e0b96732b5cbaf2dd75523439aa2e4ca50ce9b2474995383081", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610334, "uuid": "b9b42109-c528-4b4f-afac-83f4b02b9cbd", "value": "T1C781F91F858B34D6CDA84657B6EC05ED141CB6CF21B06D40230B3E856C596BA4AFF0AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610334, "uuid": "e153ec6d-7a25-49cd-9b63-bfe51a3f3f4e", "value": "96:z6WgS9GCfKXM0dwacLonrU3OxAI6ni5dI/p4wHglnSjWaW/g6P:z6WguGTc0dwxLonrU3OxAH2643kzMzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769610334, "uuid": "54d747ce-df62-435e-ad45-e3debfae5ac7", "value": 3971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769610334, "uuid": "61cd1150-4bad-46c4-a1f2-6d20e86ff822", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610334, "uuid": "45c3b4ec-cc6f-41ad-97ca-fd2a69c47fd5", "value": "installer.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c06f32ed-fc98-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769639344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769639344, "uuid": "0c735c78-9fb1-46ed-b342-f45e13b33d61", "comment": "Malware payload (Mirai)", "value": "5e6b0e8601e9f57bf525fe81811dbbf8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769639344, "uuid": "bb406ece-d34b-4e98-8c18-df18b25b9f20", "comment": "Malware payload (Mirai)", "value": "0a88879aa3613f41f84b0bd79e7e1d5a5f536c89c99eb9422b618449f100ab2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769639344, "uuid": "356e76cb-d49c-421c-8c90-8db46434f2bc", "comment": "Malware payload (Mirai)", "value": "117ff3c4f43cee1d3488918b2e7bccaa5c4e4057", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769639344, "uuid": "85f1da83-0f48-4437-9c95-c005f00e4147", "comment": "Malware payload (Mirai)", "value": "864ad459ff4b0354a7f6d228ebb0e1b13f7d32cacd5a2d1b0108db47e72d3512d827a206392638626a8363d3baf3ea66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769639344, "uuid": "606a5f5d-9495-434f-bd43-28fe8a01d559", "value": "T11493C65E7F228FBDF168C63147B78B21935963E623F1C685E29CD5001E6034E586FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769639344, "uuid": "3a9b6eec-e7b4-4402-9d61-3be5f865252c", "value": "1536:z+BS+BZdBw2noqPq+rgp/Ig02Yfr+2CRtpkEbQjnlvRRAR1gtePBseb/2+ExhXno:aPS+4Ag0AFt+RCR1gtUwxhXno", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769639344, "uuid": "2bfaf1a5-b777-4e16-a84b-487dc127b437", "value": 97252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769639344, "uuid": "8c345d0c-bea5-4338-9950-1aaecad3fb2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769639344, "uuid": "e6490852-3644-45a3-b105-6390e700f340", "value": "nabmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d8f645c-fbe7-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1769563184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769563184, "uuid": "44d8a174-d1e4-41ae-8627-d847359e80ee", "comment": "Malware payload (PhantomStealer)", "value": "fb49a77e4cb5e790d05ef3988b056751", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769563184, "uuid": "13509601-e605-4fea-b97b-c96f80bcd7c0", "comment": "Malware payload (PhantomStealer)", "value": "0af6f85cd8c718bcbb27bac01d8147f31fb62a84042fed655233a22edacd09ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769563184, "uuid": "ea6f575a-d6eb-48a4-9a43-06f45813fdab", "comment": "Malware payload (PhantomStealer)", "value": "bea8a85d5c73b37d0228da4552883a0cd8e4b20f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769563184, "uuid": "67230ef4-5f06-48c9-a115-5fb71b4b3a99", "comment": "Malware payload (PhantomStealer)", "value": "6042a351e6ccc2a3916f3bb01b840302c5be625c9e47386595eaca07f97d871a7ff2adea10493a5ca5031872d1428f63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769563184, "uuid": "0b046555-a89a-479a-bad0-ce673c608a51", "value": "T1EA75E0027381D066FFAB91334F5AF6215BBC79260127E61F1398197ABE701B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769563184, "uuid": "ac49547d-f8f8-4924-8ce8-e7e865dc4120", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769563184, "uuid": "c75f485a-1270-4306-9d99-6a28932bd40d", "value": "24576:L5EmXFtKaL4/oFe5T9yyXYfP1ijXdaS9kObOGM3B0bHzSpezbDLtqfDam1dhz:LPVt/LZeJbInQRaS9F2xCmyb8ram1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769563184, "uuid": "b6ea8730-b4b5-488b-bce3-19d6f5d855d9", "value": 1689088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769563184, "uuid": "17be9e6d-6b0b-466d-b212-3113e15ba2f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769563184, "uuid": "9ea6fe41-4371-4feb-922f-75ba2c4c8dbb", "value": "CHQUE COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aee0a2a-fc7c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769627255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769627255, "uuid": "9b61fdcd-eddc-4969-9a1a-4da6f1aca429", "comment": "Malware payload (Mirai)", "value": "3748a20b72d6ca857557c72c8af0c97e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769627255, "uuid": "6f44a227-11ef-4d47-b183-a9c44b886fc6", "comment": "Malware payload (Mirai)", "value": "0b2fa5ca46439e8b2ed157bdd7f48c3069920cfa8980af1642a02217a6654ead", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769627255, "uuid": "929441e9-278e-4eae-a56b-eca109008614", "comment": "Malware payload (Mirai)", "value": "e7d2d3dd885ad5739721a69c80ba7a7764a15222", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769627255, "uuid": "17a936b8-51d0-46ec-af6f-667fa5690218", "comment": "Malware payload (Mirai)", "value": "8557e35dfd6dd226fb3c928ddf6b5f346cbdfa3a4636a7dcf6aee4b594fb4dc6c359bb054ab1c1955b6465a1c0bf3d02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769627255, "uuid": "f57dff97-05a5-45e0-b04e-48136a2fd069", "value": "T17AD30985FC414F13C5C612BBFB8D428D3B2A17A8E2EE32039D255F25379B95B0E3A546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769627255, "uuid": "d4551941-a99e-4ca3-bec0-63165c203f44", "value": "1536:2+0tievK8cfb/dD2b1e4VmRS706q3r7lVrwyw9e36gXw7XsvTAg47kCyHfftbOY2:2+0tioWfDdDx4qSO3vAyhrnoX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769627255, "uuid": "06500ba4-0f9b-45dc-bed7-dba68836df26", "value": 133792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769627255, "uuid": "b6f9a738-f8d4-49b4-806a-5fc65765e7ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769627255, "uuid": "9d83084e-6b6e-4056-8e34-203b8973ff16", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f63becc-fc43-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769602539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602539, "uuid": "242a9b30-3c29-475b-868a-525cd0d0a44a", "comment": "Malware payload (Mirai)", "value": "159242d48e9168ae6bf4f8e1863f2ad9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602539, "uuid": "8106ff7b-741a-409d-9f29-6330acd11185", "comment": "Malware payload (Mirai)", "value": "0bb0a88e37d825b762bbae9a8fb67c0f0a5f63a0cf5586d8d07d915401b57632", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602539, "uuid": "c1d921f0-8462-422d-9867-21a868fd18e5", "comment": "Malware payload (Mirai)", "value": "639f5c578bfac4621faa61edd70f263ef3aa559b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602539, "uuid": "3f4acabd-f676-4cd0-86a5-eff43e7893b7", "comment": "Malware payload (Mirai)", "value": "27941972fa1c1ed76790f4feef30638746bdf62e2af0234a5b0bae152a50eb3187bbd011c3449a518fe88f8e96190fd5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602539, "uuid": "1e94bc36-fbe5-4496-a372-5e137e87f07f", "value": "T15F533A93F404DE7DF84EE77B84570A06B271E3A50A421F36A3277957ED7A0E40862EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602539, "uuid": "54f6f790-ecaa-46d3-a198-dfb9fa73659e", "value": "1536:h8kwWOJ+0kaV58Q+O0niDeYAVe2iO48MrA:XwWOJrV5/hgdYz2iOWrA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769602539, "uuid": "0672bd37-f3fa-4b7f-81f7-4ba64c5f12da", "value": 61528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769602539, "uuid": "0648530c-f937-4a50-b3c4-8a8e47009b0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602539, "uuid": "e0ad2c40-82a1-4c8b-a59d-988c7da63263", "value": "nabm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "284a9e8b-fc65-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769617184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617184, "uuid": "f859ca07-c555-4327-bb3d-c413857a75a0", "comment": "Malware payload (Mirai)", "value": "6dda3b3f571f31e8623feb49319cbc57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617184, "uuid": "5ccc0402-e7ff-4e3d-a981-95ddd908736e", "comment": "Malware payload (Mirai)", "value": "0c5bdbd32d9558693ead6d7bdc8f4eff922d95bd73a2ac9bb15c0965ef311420", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617184, "uuid": "f76dc5e1-dc47-4b36-977a-87ddf1fe63d1", "comment": "Malware payload (Mirai)", "value": "cbb21a59215dae574122360a980d6d7e36d50030", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617184, "uuid": "7df8887a-9008-4b7e-bc9c-31e1289976f0", "comment": "Malware payload (Mirai)", "value": "88bdfd04632667a5aca9084ce91b59d9a6072e202da9161fe0bc8e813d16f46837f675650e86ab8173fd2a4e817400bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617184, "uuid": "32000867-803d-4ac6-925d-64197ab169fa", "value": "T1DFB39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8905F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617184, "uuid": "9a4c5f34-6b90-4f34-ab86-8eca965bcc7a", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1a/LWy:c9sSyzz36YaWWgg1aq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769617184, "uuid": "3dd677de-079d-4770-a55f-408f4608c961", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769617184, "uuid": "8fa028e2-baae-4bf7-8933-8c95966917c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617184, "uuid": "b11bfbf3-0e33-41fa-9999-960b1067261b", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99a2ad33-fc9d-11f0-a129-42010a9c0007", "comment": "Malware payload (SVCStealer)", "timestamp": 1769641426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641426, "uuid": "42741aa7-d06d-4cc7-b9cd-b1380d290ce0", "comment": "Malware payload (SVCStealer)", "value": "ceb269e65a5147e28c118d24a569656a", "object_relation": "md5", "Tag": [ { "name": "24x01x2026", "colour": "#AA0AEF", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641426, "uuid": "66b78dba-a186-4cd9-8d5e-cb898ed6fd2a", "comment": "Malware payload (SVCStealer)", "value": "0da1a26f3da6f4712aca28a7cdba40f97fe228c604ce7087bc8db990dea3fc4c", "object_relation": "sha256", "Tag": [ { "name": "24x01x2026", "colour": "#AA0AEF", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641426, "uuid": "dff76c41-b3e0-4f7d-b22c-6bb1a291c094", "comment": "Malware payload (SVCStealer)", "value": "63ba76f6d06f298380d4d93887a29cb178038ddb", "object_relation": "sha1", "Tag": [ { "name": "24x01x2026", "colour": "#AA0AEF", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641426, "uuid": "c6a19a9d-c363-4577-b1a9-8fb705304906", "comment": "Malware payload (SVCStealer)", "value": "438b72903f18689f290d14c22bea086877020d33ade4e65386f708cfcf500d80dcfabca93af78c71c52b9b765906e4f5", "object_relation": "sha3-384", "Tag": [ { "name": "24x01x2026", "colour": "#AA0AEF", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769641426, "uuid": "48676db0-9ed7-4e90-903a-ceeb587f57ce", "value": "T140759E55B2B400FCD167C178C9475A0BEBB278061770EADF57908A6A6F23FE11A7E324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769641426, "uuid": "b81b178f-d112-4655-b4d6-1cdcb5ca5669", "value": "14c00cd98c6c67089f15befbbc9b5dc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769641426, "uuid": "457ed63d-ecce-4423-8bff-51c164f43326", "value": "24576:R02+h4Q8qAjv6qfjq1nJAfPVHDClF7rDheENnlBtSqNOqrXtd0RlgbCpS:1Q8FDjWJAfPVHCpheENndL5r03gb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769641426, "uuid": "e784f2ab-aba8-4377-a885-9865d321ff0a", "value": 1665536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769641426, "uuid": "55c55290-12fc-418f-b244-4cf1028bfb8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769641426, "uuid": "3df3818a-7229-47a4-9ccf-3defd7483d6b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9c06fa-fc6e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769621191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621191, "uuid": "ee26a567-1218-45bd-a5ed-d7de921520f9", "comment": "Malware payload", "value": "79f0b1a35a16d63393cbb91a28986616", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621191, "uuid": "a1fb1ad6-1686-42cd-935b-dc97a3eb4a68", "comment": "Malware payload", "value": "0dc060ea6df303806ac9c9cf07af10b82dd19e8cfc0b1a8f05974a42dec769c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621191, "uuid": "30191f1f-27cb-40e9-b350-e0a0760e83ce", "comment": "Malware payload", "value": "85140ae140b140cf8ce768f3f01a1e6a0dd7bd5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621191, "uuid": "8cdfdc3b-cf0d-45ca-bde7-76b711b0cf30", "comment": "Malware payload", "value": "f39bb483c605d3c37cb3b832c28793f683eb186279b1208b530128cf6b4ef8adfdc54d82d4d4c892859ef57e907a9e93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621191, "uuid": "b99df1cc-fe68-4245-aeaa-ab9715537aa1", "value": "T11E668D03FCA159E9C0AAA23189A79153BB75BC441F3223D72B60B7382F76BD45D7A314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621191, "uuid": "c3402b66-5c1e-41f6-be0b-a57fe2d3b216", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621191, "uuid": "330b7b4f-59fa-41a0-8041-05eba8c0996a", "value": "49152:QK/amW2pcIllk8LiVfpDGAgU6qK3LRTX3CikiVqK+K9KMtnkJ5EUX5gJmTVSeOeb:Q/mLlkfyjpRRztncEWaJniSOC/vdoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769621191, "uuid": "9aa7afa3-a603-41bf-8042-766612aed623", "value": 6695424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769621191, "uuid": "7bffe9c1-46f4-4129-8798-cf25d386f99c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621191, "uuid": "2dc38d9e-548b-4074-bdd5-fc8d18c60dc0", "value": "SecuriteInfo.com.W32.PossibleThreat.16526.8438", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cde873a-fc3f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769601059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601059, "uuid": "15b93344-cd31-4ada-8ddc-ee8fac83a12d", "comment": "Malware payload (Mirai)", "value": "02e8a545401256e173e920204d21d247", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601059, "uuid": "4fb79c9c-e0fe-41d3-8eec-2741ec763c22", "comment": "Malware payload (Mirai)", "value": "0df2948c40682613272f1e9f021aec4d67df51d6c5dd670a342e44651772cc80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601059, "uuid": "9031e38c-e8cb-4705-8595-1c4c9163f89a", "comment": "Malware payload (Mirai)", "value": "f3faed700b477089ce0882dfdf78bda6c62c4a39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601059, "uuid": "356d673f-ae2a-42c2-9687-0ad7078fb654", "comment": "Malware payload (Mirai)", "value": "d93249411fd998a224277b3b7fd6688751935068691141d48302be2eff70f51d4d0dc635065c2ba05c3b666528447d8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601059, "uuid": "91169187-e6bf-43a2-a9a1-f1119f012343", "value": "T1C79329A6B410DC7EF41BA7F780171A19B131A3E44E426B27762BFD63DE6E1742822D43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601059, "uuid": "81ca0f66-441c-42c8-8ef6-06386d3c80e8", "value": "1536:KwGkkD6J1cPz7hgYWx1Ha1VMabDAh6WSXOWGXITaF8s+1x:KwGkkkIhgYW4MaHk7BWKITahOx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769601059, "uuid": "ea8d8ba7-ca57-47e9-81ac-e6e613185e07", "value": 89096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769601059, "uuid": "c47328ed-21b0-4318-97f8-572870639072", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601059, "uuid": "160818cf-2952-46f8-8a7a-7ebb7413b75e", "value": "nklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "429b4c30-fc40-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769601337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601337, "uuid": "bded16b3-a102-4225-908a-5100b35c589a", "comment": "Malware payload (Mirai)", "value": "b186cd7414fd86fc7dc4e822b3a00b3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601337, "uuid": "133bb83e-8666-4a66-adbf-876c51133ec5", "comment": "Malware payload (Mirai)", "value": "0e0522a60d75dbd0148d32e397d7673d39be65c4710d7cae654b11ad7e0cb924", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601337, "uuid": "fc22f8ad-3e64-44d9-983b-84a2fdea96cb", "comment": "Malware payload (Mirai)", "value": "fbb33e3295d789fff0adfe1caec9ca709d0ab62f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601337, "uuid": "788a0333-f8a1-46c4-a24a-e0c7a05110be", "comment": "Malware payload (Mirai)", "value": "ab1576bc5226d267873db1f7fbb11c8231c053840589fba9b03da372c47cd5dd2d6a210fcf9cac2746d72f5377dd6961", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601337, "uuid": "c95372fd-eedc-4c55-9d29-19074a5770a2", "value": "T145931AD9BC858B11D5C126BAFE0E618D33138B78E3FE7213CE185B2E534A86B0A37555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601337, "uuid": "35a008c2-6ce1-4d82-a187-c74a7fb15c4a", "value": "1536:q0n6ag1UhE9+0R/5ByR+TfEcyYfc0iKozsCkbeA10ATb/exQsZMHiQmzpR8qCgvN:8UhCD5By+TfEcnfFozdqeA28KzpR8qCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769601337, "uuid": "06c55bf9-9d1f-4496-b606-85d2835dff9d", "value": 96128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769601337, "uuid": "a9fa2854-412f-43b0-a41b-c93d66e6854d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601337, "uuid": "83851d4c-f5f6-4ea5-9c62-767e1de8f028", "value": "nklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f600c1-fc18-11f0-a129-42010a9c0007", "comment": "Malware payload (DCRat)", "timestamp": 1769584082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584082, "uuid": "dd765b51-7643-41d2-9074-189847f0670b", "comment": "Malware payload (DCRat)", "value": "f1a44fb58ab859ac682d67df730f6cf5", "object_relation": "md5", "Tag": [ { "name": "bknoww-com", "colour": "#F8EF07", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wmk77-com", "colour": "#33F251", "exportable": true, "hide_tag": false }, { "name": "wmk88-com", "colour": "#FFD915", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584082, "uuid": "ab0b7bcd-19a1-4753-b299-219f06e069eb", "comment": "Malware payload (DCRat)", "value": "0fb6e39dac04676095716c951ed42d5a30441fbbf9483032ddaaf076d0f80003", "object_relation": "sha256", "Tag": [ { "name": "bknoww-com", "colour": "#F8EF07", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wmk77-com", "colour": "#33F251", "exportable": true, "hide_tag": false }, { "name": "wmk88-com", "colour": "#FFD915", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584082, "uuid": "bf7079fd-dc68-401c-a477-eaec090e78a3", "comment": "Malware payload (DCRat)", "value": "d24322e38e9a5be9d38770e3c351422c2a76d522", "object_relation": "sha1", "Tag": [ { "name": "bknoww-com", "colour": "#F8EF07", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wmk77-com", "colour": "#33F251", "exportable": true, "hide_tag": false }, { "name": "wmk88-com", "colour": "#FFD915", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584082, "uuid": "09f58586-f121-47e8-8d56-1936b7345857", "comment": "Malware payload (DCRat)", "value": "05cf318aa12613d772aae04848c0f9fa943db96c33b169b24a3fb2d1c73d99daaf825b0424df24073495304e283e46cf", "object_relation": "sha3-384", "Tag": [ { "name": "bknoww-com", "colour": "#F8EF07", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wmk77-com", "colour": "#33F251", "exportable": true, "hide_tag": false }, { "name": "wmk88-com", "colour": "#FFD915", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769584082, "uuid": "8ac29835-1fb5-4bfb-8464-0c2f4b7c3670", "value": "T1E3E61C34FB5C109E5DC11FA3FAF0D171B89DC436A41B1BA194EDC2AE9A97ADC42122F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769584082, "uuid": "7e300d5a-9795-4793-9e50-ef04cd2126ac", "value": "cc1dab98ba766c8e185d82aa9209af71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769584082, "uuid": "9e76d1d9-09c8-48d9-b118-b194f954b9b6", "value": "49152:MOHLOhlRXW8nWOZVcSd5MMdXZbMskojvnhX76sX16F7zUNes5XHT7hKSmsKkByJU:e8Lg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769584082, "uuid": "c5255b85-f867-44ee-8aa6-f8aafe6d149c", "value": 14803968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769584082, "uuid": "7bcd290a-9e03-4591-ab7c-0c482b3b1be2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769584082, "uuid": "9a16a132-f16f-44c7-873c-69a3dd08fdfa", "value": "python311.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "668bf302-fc6e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769621154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621154, "uuid": "25af59a7-1224-4880-8aee-3a89ede790a0", "comment": "Malware payload", "value": "b382937056e66ab9ca0d08bf3d48d497", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621154, "uuid": "eccd884c-2a45-416f-83c0-24c8c0658d55", "comment": "Malware payload", "value": "0fc90a024d9bb900bb43ab567cabf32defd4f3b6107f94197baab6b2a11effbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621154, "uuid": "29ceb79e-2ef8-4539-b3f6-1dd73d9462ca", "comment": "Malware payload", "value": "ea898bbfcd3625d9309f5fcb7f06fc6116142ee5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621154, "uuid": "c4abd99f-d208-4a9d-9beb-8ee5b601468f", "comment": "Malware payload", "value": "7599b1961a427166f0f90a527777ea18d197b3a3b2884b8a3d10358b9030d4481a2a65088fa7a0b420f223abbfed6703", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621154, "uuid": "d2e627fb-2c57-40b3-b545-e1455859eed3", "value": "T1260633DA9489E690E6916850930DF1E4168EB936BB7530225C2FCFE4CA354C2FFE1E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621154, "uuid": "a1f6b079-76ec-49da-9a70-e97f7308e6e1", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621154, "uuid": "e0a29b0f-83f4-47ce-8908-33ddefd338a4", "value": "98304:M5o28P5n/zFNUw0LH/7r/ug7EJETZ6vGhfrWcZvri1Nrl6uvtBxt:4oLl/pMXn75UncRgBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769621154, "uuid": "07da334b-648d-46da-ae91-e8f2ae30136e", "value": 3708416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769621154, "uuid": "1c4ac323-96e3-48bf-bd5f-fb6358da0dc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621154, "uuid": "c566525e-0bb5-4bd1-a19b-6484b006ffb7", "value": "SecuriteInfo.com.W32.PossibleThreat.16526.8438", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0752a55-fc66-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769617815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617815, "uuid": "be56a244-9139-4b03-9ea8-d0cf92d928f1", "comment": "Malware payload (Mirai)", "value": "5e3074e8a0238be0523fad68924ad08f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617815, "uuid": "2cf03c73-7217-4e9c-8b78-3239869e957e", "comment": "Malware payload (Mirai)", "value": "10a7aff25c88eb3fb4ce17dbdd1d78e941b3c4696935f2843afae1a7403c73d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617815, "uuid": "d2669444-a3d2-4bda-9229-07c4aa96d2ef", "comment": "Malware payload (Mirai)", "value": "ddefcaff6660f7135d933855956b8d3811d76a97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617815, "uuid": "d77f3229-75d9-4648-b9c5-2a9c1e4ccd72", "comment": "Malware payload (Mirai)", "value": "58c393d6e574c9df0582a67423354de7fc61e8a5cf41d213a3a1be6341e7de07a235c5935705a98fb294bae0d4bd79b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617815, "uuid": "2a7a346d-2777-4fe2-9dff-ac03be833922", "value": "T1E5A3D61ABB510FFBDC6FDD3706A9070535CC551B22A83B3A3934D928B64B64B4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617815, "uuid": "12c27d90-a67b-4aef-98fa-a5c49875aa60", "value": "1536:meL1QjVrJaNHL6xSQYd4ERxu8jyH3FvrrZsc+yZNvMe0+V7vuKgknuM:m0QjVra9xzjyHJrZsc+yucwWB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769617815, "uuid": "5974d758-d049-4e97-84b4-8b8776a47767", "value": 97860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769617815, "uuid": "2d877e97-c0aa-445f-b7a4-bf832bcacc1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617815, "uuid": "56a7b517-86b1-4588-8c89-63c6424ee1ea", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e4c37b-fc66-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769617818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617818, "uuid": "ddd68c06-519d-4a10-ae95-e6fc65bd636d", "comment": "Malware payload (Mirai)", "value": "a3c6259477aedd5679013d19f0e3d140", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617818, "uuid": "e67cab59-3d1a-4a07-935c-91944fa33919", "comment": "Malware payload (Mirai)", "value": "1203b21d4510c0ef5f481452cc0a59b8ed83257561b6acf8a81df23047ea0403", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617818, "uuid": "0d57107f-45d2-486c-8505-047f0e8bf37d", "comment": "Malware payload (Mirai)", "value": "72fd6fa66e762fd3f367bc730942e68dcccad6f9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617818, "uuid": "d91810e9-2a98-431b-99d9-d4366728e477", "comment": "Malware payload (Mirai)", "value": "b0898842b75b4e27d3d2dda062a3ef5f99c5c349b050608faed7684aa5653b129d32fb5d6526089a47ad2ca517f41fab", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617818, "uuid": "0c148b49-fad3-4152-9923-3cadeb4e0f2a", "value": "T121518FF829B1AE3B4545DF46E0B14FB9A40FB9C894D00F68979F78ACBD6C405783065D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617818, "uuid": "2b30ea47-bca6-468d-941d-e7f4c309459d", "value": "48:rMpzaC56q6IwQgOh18W5uWebCwqgojUHx1HxWEfWq6D3E+Ji:r8+s6q6IwQFh18GuWebCwq/jevHfW5fi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769617818, "uuid": "c766d3d8-4c31-45dd-b3a9-2b21098f0e96", "value": 2729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769617818, "uuid": "34ebde24-25cc-4378-8f26-41a2eb4c6bdb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617818, "uuid": "4c26bd09-4ec0-481b-8b26-da078b506d35", "value": "massload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f949cb3-fc28-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769590943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590943, "uuid": "1ced6524-1c17-464d-b84f-73b590d5deaa", "comment": "Malware payload", "value": "40c3f167f3706961960f4f21733284eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590943, "uuid": "7e2b992a-9d0b-4dc4-9e37-f25b4a4be55e", "comment": "Malware payload", "value": "1289fce8a8fa0e4cc8991d8287e37e99ed2405b6b7095f124ab191a005b2185c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590943, "uuid": "f1d3a9b2-b22a-4602-a29b-93ca1aff525e", "comment": "Malware payload", "value": "d1a3cbba6aa72ee34f20522779c555ef1dff7f63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590943, "uuid": "0001d7ba-1aa2-4ae2-adc6-754ecc6b69ac", "comment": "Malware payload", "value": "4dd13a63d35fdbe87e5f88960ac3b535cb9a75d6cb979d89803f4d32bd628f9bb0491abade6aebe062cfe557198617df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590943, "uuid": "22571e69-0da5-4931-8273-02ba1d38804e", "value": "T1A183AF40E660D462ECB5CB3620765E775DB3BD26A8B0160F0B2C36247FB36D2951F927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590943, "uuid": "8cd9b7ba-705f-42bb-a78d-550782aa95db", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590943, "uuid": "4746e9f0-65b5-4e9a-9f27-dde05b039dd3", "value": "1536:MT4HrN+noJHCq0Zs0s0DAVeu6TpisYX61zHRp6BMVO:MTIN8ogtjDAVeu6TpisG6FHRp66VO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769590943, "uuid": "3953d929-f6bc-41c4-a9bb-8b3f0f09f345", "value": 83840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769590943, "uuid": "287b0052-ae8a-4139-a300-47ae1388af69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590943, "uuid": "e0f9b33d-766e-4a57-9bdf-4ce99b48d6ea", "value": "1289fce8a8fa0e4cc8991d8287e37e99ed2405b6b7095f124ab191a005b2185c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2821671b-fca1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769642954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642954, "uuid": "c1e80739-4be5-431d-aa11-345c7654f0ed", "comment": "Malware payload", "value": "77ff0080c2f10ce902957315343eb3cd", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642954, "uuid": "4d869465-0f16-47f2-9f49-4023942d21f5", "comment": "Malware payload", "value": "139bba30f419dbe42d9d9c887035de9504495c5e408c88a6f5c802e5ba8c5f75", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642954, "uuid": "05ef99de-2d7d-4b98-bddd-cae425ee0c2b", "comment": "Malware payload", "value": "c4138399ef66418abb54510536c86ec9721db610", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642954, "uuid": "330b8a92-af7c-4cf3-a026-fca684e45dce", "comment": "Malware payload", "value": "6f99b339ea983d7248366ef45e709b824249b407c2b625768ca40381d49a98b1206d38faa09d534aec32cbfc71e49659", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769642954, "uuid": "daefaac1-3708-4532-9830-5cf745cb4ddc", "value": "T1B066493B67A4816DC25EC23EC0A78F01D9F3B1751B37C2E752A207699F169C19E3E261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769642954, "uuid": "6c6f1c30-e7ee-4a3b-b440-2a6678d1c1bb", "value": "9692762365b0d3385170e1ababcdaa1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769642954, "uuid": "0470426e-3964-4af5-8b81-6730b0cade31", "value": "49152:lLcLOnXF09KKdYbIK4KdgL7dPSXceQJQ+4KJL6gH4eY2FKTf59Qn23xxD8JB:FswYn23f8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769642954, "uuid": "42f5f823-42dd-4309-8278-e7fe3fd13d85", "value": 6878208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769642954, "uuid": "459baf8d-487b-434f-a6c1-2c95abc0223a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769642954, "uuid": "dd0157d9-57a9-418f-bc18-4c29f5a5d4f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "992b4e37-fc18-11f0-a129-42010a9c0007", "comment": "Malware payload (DCRat)", "timestamp": 1769584302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584302, "uuid": "17138c44-5fb8-477e-8baa-196d7c948c7b", "comment": "Malware payload (DCRat)", "value": "68266b719ac1fec0769a821057b4ed08", "object_relation": "md5", "Tag": [ { "name": "64-188-91-221", "colour": "#D42526", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "ou6160-com", "colour": "#119E75", "exportable": true, "hide_tag": false }, { "name": "ou6161-com", "colour": "#2C0918", "exportable": true, "hide_tag": false }, { "name": "ou6262.com", "colour": "#BF8AB1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584302, "uuid": "112b616a-dee1-4380-94d2-acfa03a10700", "comment": "Malware payload (DCRat)", "value": "140cc3542775ce77903d10bc30b5e11c1404bc2119a496a4b7b24c7fd95a1d2c", "object_relation": "sha256", "Tag": [ { "name": "64-188-91-221", "colour": "#D42526", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "ou6160-com", "colour": "#119E75", "exportable": true, "hide_tag": false }, { "name": "ou6161-com", "colour": "#2C0918", "exportable": true, "hide_tag": false }, { "name": "ou6262.com", "colour": "#BF8AB1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584302, "uuid": "63ffc321-9f64-4105-9838-0667616193cd", "comment": "Malware payload (DCRat)", "value": "0561d16aba2d9166ddcd87dcb1e550bd0d591595", "object_relation": "sha1", "Tag": [ { "name": "64-188-91-221", "colour": "#D42526", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "ou6160-com", "colour": "#119E75", "exportable": true, "hide_tag": false }, { "name": "ou6161-com", "colour": "#2C0918", "exportable": true, "hide_tag": false }, { "name": "ou6262.com", "colour": "#BF8AB1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584302, "uuid": "b2d92fcc-bb38-41a8-be88-bea84bea442f", "comment": "Malware payload (DCRat)", "value": "511418242ce62aa72b866b8aa3d66d91dce044960839032aea2b9e14a1c417377e9d8ad31d76b1fd7d8437cdcab8593e", "object_relation": "sha3-384", "Tag": [ { "name": "64-188-91-221", "colour": "#D42526", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "ou6160-com", "colour": "#119E75", "exportable": true, "hide_tag": false }, { "name": "ou6161-com", "colour": "#2C0918", "exportable": true, "hide_tag": false }, { "name": "ou6262.com", "colour": "#BF8AB1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769584302, "uuid": "b5d01505-03e6-4a4d-af3b-7a7d7cf6b20f", "value": "T1C82633822E8ABF43D57F08B5C266BD4B9B735804298B8E18CA4503F3873B1D916F56D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769584302, "uuid": "2acc577a-2e67-4f90-96f0-9e47eb6580e4", "value": "98304:ByXwPncpCbME8i8AGG5mR21y0A3wM8zynNnVD8pp:BycbMpqGGJal8m3gpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769584302, "uuid": "53dd69d8-8ddf-4061-9fce-c7ed932a922f", "value": 4826622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769584302, "uuid": "6f3dade3-9871-409c-bd8d-a388586dfb73", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769584302, "uuid": "1184e95d-e223-4a3a-ab6e-238bd0712300", "value": "140cc3542775ce77903d10bc30b5e11c1404bc2119a496a4b7b24c7fd95a1d2c.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5103f78c-fc91-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769636150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636150, "uuid": "5718d5c4-f008-46c0-aaa8-03e885b884d9", "comment": "Malware payload", "value": "ad4b01a374fa79208caa1bb1345f8d79", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636150, "uuid": "3e8d4354-4201-41d8-a4f2-98d6906cb482", "comment": "Malware payload", "value": "1486da060d78dca7d59f4dd7fd689f3f5cb0258838210a8285308428487d0eab", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636150, "uuid": "568785ca-3b81-4b63-8f6c-e948fa3a83c2", "comment": "Malware payload", "value": "2d35dcf88212468da049d91d00c1552f16500820", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636150, "uuid": "17aea9a8-597c-440a-bb4d-28580ed82c51", "comment": "Malware payload", "value": "cb8e037e1fd5c1fd206d5f63d24841dcfa70898a1332d2178acb947429c879f5d13f1976922ba16d9fb5367f99fa9543", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636150, "uuid": "aff06e7e-40a0-41ad-bde7-3c44b6933f8c", "value": "T152336333D410FE0641A1EE55A2799B04D672D97748AC6418B60C4E4D0FCA9EA3BBFF4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636150, "uuid": "34b6476f-5fff-42c2-b90f-e1967434c611", "value": "1536:CcHg5AjywHIDFSD4zNq94AbluKlAGRhl0IGHO1kA:CYtN/COB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769636150, "uuid": "96d80f82-0b6c-4145-b088-db1b5988f2d2", "value": 55045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769636150, "uuid": "792162c1-4f46-4eae-8db7-a8aa9b71bf7a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636150, "uuid": "a244868f-c7dc-44a2-b6a2-7d482599944b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c9167e-fbde-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769559325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769559325, "uuid": "ccf858c2-d6f1-4357-8f95-4db267cb0ce7", "comment": "Malware payload", "value": "9bb590ef628537dc4e5acc19b3fdf44a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769559325, "uuid": "29154cf8-cb88-4708-8bf6-694ddea37791", "comment": "Malware payload", "value": "14a7996ada035d9dac61e71d8b5e3b9e6cf301b4d9fe7701c5a2d2fa48e74f44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769559325, "uuid": "8f0fbf2f-c933-4652-9f21-b886b4338e25", "comment": "Malware payload", "value": "d18607e83173dc0c390b0529e461fc9b1aedfcc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769559325, "uuid": "90b14295-8dcd-4655-a102-dcc4f4f1f9a3", "comment": "Malware payload", "value": "2037ad95b1ad0db9f2467cb13e95797107a2742ee15e58f8b2992a57209b0ad545298469cd5efe1d4571f3c8c06718ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769559325, "uuid": "cfc152ca-4706-4620-8f39-ce1862f7b525", "value": "T1B553E791AC82562BC6E423BEE67E618D336577A5C2CF722B8C215B15BBC051F0C73B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769559325, "uuid": "825929f1-430f-4f91-a811-555a9f048c18", "value": "1536:hFd+kOqW4H1GXzPo7tu4WCluLa69O05brm:l+ks4HR7/Z0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769559325, "uuid": "4120bc95-d198-4145-a590-112cd010c5ad", "value": 64908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769559325, "uuid": "f183de2b-dd2c-4d7a-b07f-41440b024573", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769559325, "uuid": "965771e3-b9e8-4575-a0c5-d169fe2b570b", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "025e9c48-fc92-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769636448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636448, "uuid": "b44d3e98-d23c-4b0c-8737-03ccc15dda13", "comment": "Malware payload", "value": "9965c128a599be8412a7e63027fa2b54", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636448, "uuid": "c344d37f-4232-4516-8b4d-7fa7aebf0c76", "comment": "Malware payload", "value": "152adf1ba9163cf033d2821140ee19462c77b925ce4189361ceebd8f6b3ea9fc", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636448, "uuid": "843ad324-2145-49af-af71-294faff51245", "comment": "Malware payload", "value": "fc6d9b926e92f1cd3472684724f0ead9940e89ad", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636448, "uuid": "c13d772b-5ce1-459d-a660-dba8f810dddb", "comment": "Malware payload", "value": "1974a3aba0603675ad6ad72f4ba411f98e8d12867946dabd2419abfd08c5524a2f57810ff5f3acbb619090d681b12c88", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636448, "uuid": "a88ab43f-9cc8-43da-bd88-05d23f513b78", "value": "T1A9336333D410FE0641A1EE55A2799B04D672D97748AC6418B60C4E4D0FCA9EA3BBFF4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636448, "uuid": "ca82bbd8-d22e-4688-9ca5-ee18b32f3ed4", "value": "1536:CcHg5AjywcIDFSD4zNq94AbluKlAGRhl0IGPv1kA:CbtN/OvB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769636448, "uuid": "1e08f63c-316b-41fc-b19f-b60e559ec74e", "value": 55045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769636448, "uuid": "7ea1794f-40f1-4a0d-ae80-d7744b8a03fb", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636448, "uuid": "d10be7b6-2b29-4d05-a363-f877d9bc9992", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0317c34-fbea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769564557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769564557, "uuid": "79f57561-7d36-4a9c-a702-0ff878e46848", "comment": "Malware payload (Mirai)", "value": "91cefe2fedb1a5519c0cffc0ebb87817", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769564557, "uuid": "14252d35-c278-4008-b0d2-6c9818b321a3", "comment": "Malware payload (Mirai)", "value": "164e4e436647a5baa0e5a4061f5ee10632634c1d0e29e7b5e5a5a3128c6142a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769564557, "uuid": "6b11f64b-f905-4267-acfe-da6ac83465a4", "comment": "Malware payload (Mirai)", "value": "1ce1b971c54df9b3ede26ad267ed1880a764a260", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769564557, "uuid": "45841f18-9971-4420-8997-0483761305f1", "comment": "Malware payload (Mirai)", "value": "9e350c711297e889c89c31c23743c6b1bdc7f7a725231457101e155d9c6a81cc4a8f0c2e556e493391d5bea291cd3962", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769564557, "uuid": "c861c1d4-d5ee-427d-bf93-188ac92afbd5", "value": "T184242A13BA81E9FFC486C0B54BEF6535C972F81D1535B18E2790BF621E99EA06B1C390", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769564557, "uuid": "0e6d8a67-3fe8-49fa-be43-a97231ce9ea6", "value": "6144:8wgSXzwGn/laiu17473mmodDbNeFIKGnnGGCyG6GGGGGGGGGGGGGjGhG3zGgm:X7vu1S3mmodsF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769564557, "uuid": "4d43098f-b4b1-4a01-b341-5c04cb988a98", "value": 211408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769564557, "uuid": "7c9b36e1-efff-4269-bb70-d675da460595", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769564557, "uuid": "0a220d6e-d3c8-4017-88f7-37df149bded4", "value": "nx86_64.1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7929600a-fbf7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769570075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769570075, "uuid": "88e584d1-02dc-4a68-931d-2679b0650e45", "comment": "Malware payload", "value": "e0531826bfd84050d37cab4955f67cfd", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769570075, "uuid": "fab59575-2f0e-4537-8e9a-663daac87df3", "comment": "Malware payload", "value": "1865c57283600770164ade11557c329a4fc8e4b2b2069a6fcc13d76f2705435d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769570075, "uuid": "561b0b51-ddda-46bc-9d58-baa6f2e3d04e", "comment": "Malware payload", "value": "f90f3f66ca024cba7b5843073d92bd222cee69e0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769570075, "uuid": "39ed482f-cd82-4d74-a969-aa20d900a537", "comment": "Malware payload", "value": "9686f4374e870cf3df3cc4b340c048b509cfbf966d175f19ec59677f689c8c3995afcedbc498e6f4780b90d3f53d7745", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769570075, "uuid": "ed5e491d-9954-46c5-8f5b-921c449a9306", "value": "T13B67F157F71C4C26D8CB52B829BA0B42F3312D9A978797031414B6B8BDF33D05A9A2F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769570075, "uuid": "f9dac534-0648-4dc7-becf-fa5ec4f35161", "value": "393216:bfdAzxKu2Ts5w4zvxhtikywZLqdJS0aJg5fTr8AxsNkJSXQnPiAx:bKAg5NDiJawaJg5dWNk/i0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769570075, "uuid": "0032ce8d-fca0-4ab5-b807-269b2ee37e3d", "value": 30249440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769570075, "uuid": "b2bd9214-8bb4-499f-adbf-24c8b091ac51", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769570075, "uuid": "6becd7b8-e757-4282-9553-e09dbcbd20f9", "value": "Minecraft_-_Minecraft_-_Official_Versions.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e62e802-fc27-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769590753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590753, "uuid": "a54f4312-0915-42d2-a61b-e76b1f821e51", "comment": "Malware payload", "value": "be47d857d8fe1ed08d4c53ab601c4731", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590753, "uuid": "53163bff-40b0-4e5d-be13-46c585a2be10", "comment": "Malware payload", "value": "18994828db857c4a991068979f9e8a8f04973b75442809c578a4ab97c317ec55", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590753, "uuid": "d6f3ebbf-f3a8-4903-8284-77cc7a4f2848", "comment": "Malware payload", "value": "7248a346fca64ef023a5db75ef014a49ccbd60ad", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590753, "uuid": "49800f6c-29a5-4c30-8515-dd932202a8d9", "comment": "Malware payload", "value": "3e354249f84f612f8977172381e81fc190f17e31ec192ae0d3e6bc8cf1669d33d6875aac145df4ceb8c4c0b9b808b7b7", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590753, "uuid": "281dafed-8f21-4999-97fb-2c83f5dfc5ad", "value": "T1D8D502BB58B2A9536A904663EB0F2C0A735B19D53B58D302EA41915C7F3B1D38F92733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590753, "uuid": "ae63c174-d4b0-4fe3-97ff-10f7afc79e47", "value": "49152:YOc2yD4lTPv40DOZbFIIkvttQGXA+a6mzfuJZT1ucDmui2/6:YoyEFPv4PzkTXjpEYxucCX2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769590753, "uuid": "b80d102f-9557-40ef-9149-277c769e00b8", "value": 2890717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769590753, "uuid": "241bef24-333b-45d1-b9e0-33aaab6c36d9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590753, "uuid": "58eaf12c-70f4-497f-b75c-d25f4b30c821", "value": "Invoice.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d8182aa-fc88-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769632172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632172, "uuid": "6bde8878-a060-4dea-bc38-1b8c15d5925f", "comment": "Malware payload", "value": "316dee725e42cbdb8d0f8f31c8a55855", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632172, "uuid": "33fde657-515a-4c49-9afa-512dee659cf4", "comment": "Malware payload", "value": "18d92432c267b1c37fc9f2703f4545a9f03bd3d52a8b4633e2e27a0f5844cc7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632172, "uuid": "92e94a1d-9c58-4c50-818d-ad2eb90159e4", "comment": "Malware payload", "value": "a687ec890be8d8161c9247f54c5fd4995725de3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632172, "uuid": "38a8988e-2a48-48bf-b668-4aa9e2f706e0", "comment": "Malware payload", "value": "1154bb0012b5d00751f061d11643bb151f3e5dd890430e625fa6b1edc101cdf26a275ce694f18bf36e0ac4cae93a577f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632172, "uuid": "062b8821-a69a-4ead-a03f-9d3f3c00a6b6", "value": "T114043B52FD519E23C6C716B7FB4E828877271768D3EE32039E256F20378A95B0E36641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632172, "uuid": "15260703-c6bf-4550-a9f3-bfae8f4730d4", "value": "3072:LiT2gcnKP/kuZ4rqk5GG44eCqdBEVGCa/3FiZ:OTVnkuW1H44eCOBEMn/3FiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769632172, "uuid": "5a97cf72-7b0a-48ae-898c-bd5157544c63", "value": 182848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769632172, "uuid": "a59b0188-f0dd-4c5a-8ed4-b4c814592bd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632172, "uuid": "abf86003-d5ef-486b-9a46-ac8a5e6d656b", "value": "herios.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d76480-fc92-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769636586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636586, "uuid": "f41b4d98-83f3-4bb5-bf8a-57145ced2217", "comment": "Malware payload (Mirai)", "value": "844d499547e9c8aa76e02a4dec96d39a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636586, "uuid": "e38e52c0-dd4f-4b6c-877a-877373c65de8", "comment": "Malware payload (Mirai)", "value": "19927acedf427373b250721f67e48e5483711fd427959bbe6b50a384c2335004", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636586, "uuid": "e5d4c30c-5847-46a6-a56a-90c4c9bc37be", "comment": "Malware payload (Mirai)", "value": "a0a46103e81e06aa09e611a2682ca303ca528eba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636586, "uuid": "4295f751-b4fb-49c8-9662-77a1d5baa333", "comment": "Malware payload (Mirai)", "value": "2e0b607707582926713a4c619f56ff2478624531b805defc2b6d2a18aff0d7962861afec0582c34cbb2b3939de2aa3cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636586, "uuid": "ec4b21ca-1e88-4707-8243-bc20d96dadba", "value": "T163C32A89BC819B10D5C525BAFF1E518D33138BBCE3FA7113CE185B2A638A96B0B77505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636586, "uuid": "fa44d6ba-61cb-4b89-8931-5fde5ced8b24", "value": "3072:ZM4f5go6lHEEF6fZWn6CNoyzyA7atFkoZF1GFhk60AuqSCcX3:SlFkWnVoyN7atFkoZF0Ft0tqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769636586, "uuid": "22790fe3-6c88-43ec-8b8d-89703aa47e6f", "value": 125576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769636586, "uuid": "499d21dc-79c6-45c8-9520-f4bf724f2181", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636586, "uuid": "54019124-5b7d-4e4d-835a-41ace7aa0ea7", "value": "nklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f96df989-fc31-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769595201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769595201, "uuid": "7b6b5dbb-a555-44a2-b890-86dfb0cedc6a", "comment": "Malware payload (Mirai)", "value": "2008397b8a4d7df49d800909e6074980", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769595201, "uuid": "e3bb52d8-809c-4356-91d4-e8021e83ef2f", "comment": "Malware payload (Mirai)", "value": "1ab8769b21c5a9a0025a011598d5c8d903d07ad672fcca367a91961c12941249", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769595201, "uuid": "ccdc96c2-1b50-4ab8-8355-e17fbe164ee0", "comment": "Malware payload (Mirai)", "value": "b4517c5aff6dd5fdd39d06af010ffb752b741484", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769595201, "uuid": "dc05a900-00b1-41eb-a51a-0028da306f23", "comment": "Malware payload (Mirai)", "value": "ede0b784b7cd6c7594a2393a93dc8ce224d37f51c514b495a33b81087cc6a754c17fc0323d912308a69f597a64b8d563", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769595201, "uuid": "13ab5073-ca50-4ba0-ac4c-681f51e9dd4c", "value": "T16DA32CDA7C418B11D5C116BAFF1E618D33135BB8E3FA7213CE185B2A574B86B0A3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769595201, "uuid": "5d5c36ea-08be-44f3-baab-a00797bde9b8", "value": "3072:FFAbkgsIKsZE8yf/xnZThje/ID+zlI9cd6V6SX:oKkaxnZThJyzlkcE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769595201, "uuid": "164cbbed-1928-4fc2-bda2-8c253236beae", "value": 104248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769595201, "uuid": "c97f58f6-3c7d-4c8b-92bb-b046c0023a74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769595201, "uuid": "8a74ddbc-d7a0-43fa-8017-93196c128198", "value": "splarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e050a2-fc39-11f0-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1769598494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769598494, "uuid": "e1f94b88-1a22-478e-8fe5-5106b4ee3940", "comment": "Malware payload (SantaStealer)", "value": "f825d8182f2396e9e7bb0ce60920a8ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769598494, "uuid": "d2808752-c3c1-4bc9-8bc9-0a4ac8f6de45", "comment": "Malware payload (SantaStealer)", "value": "1ad18510a84e31467097e7b04300a310f8aff3c0f10d284f6bf3ecbfcf131a11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769598494, "uuid": "d8582cd0-fa82-4568-9000-476c8270b206", "comment": "Malware payload (SantaStealer)", "value": "cc16de20487f194d37884c924958864ccba48d4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769598494, "uuid": "210dc82b-1efc-4bac-928e-30f4e67b3244", "comment": "Malware payload (SantaStealer)", "value": "42fb4e8d0ad4e9d00b9129ae2c272869ca6e1ecb58e5db06de94bbbb98222fe9fa2e8a7fe564b9a26b952513d9ad73eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769598494, "uuid": "842582e9-fbe9-4408-8c4b-6c04e22053db", "value": "T181F53362FB83A5E5E2F449B16C0B40FB19105C2396561F7BF03CF2168BE5206BB76672", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769598494, "uuid": "610c87e8-cba2-4638-9349-53663bb7e06c", "value": "b29f7bc6c3cf27ba78272829148a5262", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769598494, "uuid": "fd5aaa7c-dd60-4d26-aab7-418191143ccc", "value": "49152:3o8xwkiYAqp/QG1Ubvq1z2SR6UX2fQPLnZbXA1y52ppW4NUknbdbZWWWm2Wn2hWz:48xwkXAIQK6cnFXA1ygPNjXWL5WrwE0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769598494, "uuid": "e717af6c-35ee-4776-bbc7-225469a1bda7", "value": 3343922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769598494, "uuid": "8063b778-9e1a-4445-a473-234a4d4d900b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769598494, "uuid": "c4b3eeb7-524f-4076-8f6d-52f9684b34d3", "value": "Velocity.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa2013c-fc66-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769617814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617814, "uuid": "f9f02d95-b800-4b41-bb86-417d52f4cbfb", "comment": "Malware payload (Mirai)", "value": "5dcba60b070a39b9070e4959cae64e67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617814, "uuid": "3e070aa2-dc41-4a3f-98f2-8c1d9e3a9be4", "comment": "Malware payload (Mirai)", "value": "1b260e7fbe237c98b9d5614f1207d1448dc138ef2b6a8cdcda0de3d28533f84d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617814, "uuid": "5ecf7525-df82-4467-ad4e-bd93b373f6af", "comment": "Malware payload (Mirai)", "value": "ce92ab1a4c099b6d46add2a1013144eec1d49a15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617814, "uuid": "cc230c4c-ea8f-477c-b0a9-3e329674d2b7", "comment": "Malware payload (Mirai)", "value": "12d1c8271c0a65725c3e399dbe11f0bb77f7736be1d89ff9853c6464380f06d7701e31bcc86cba013a4cf6db451eb84e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617814, "uuid": "0f09b881-5c06-424e-a3a8-d847ad2f99b8", "value": "T1F6832956B8818B11C5C512BAFE1E118E3313177CE3DE73129E246F24778B96B0E7B906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617814, "uuid": "50f36ef4-e7df-4984-b5ad-70cd23e438d5", "value": "1536:YNnLVQ5yrQxZ+E1TGa1/jwawOBpGOQjzMViQDCZleWk75V56Y8x:2Q5IEYE1TGC/jwawiDCZleWk9V8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769617814, "uuid": "e4da3bc1-511a-4e6e-aa33-cea9380d1c56", "value": 83248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769617814, "uuid": "f021f46c-3322-4296-a252-398f258354e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617814, "uuid": "6e04f269-bc46-4f66-84ea-03911b1b1ec7", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd41713-fc66-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1769617811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617811, "uuid": "4373fe51-746b-452d-a537-e8c1f89007c8", "comment": "Malware payload (Gafgyt)", "value": "e0224a8dc4047a637632945fcec4d73c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617811, "uuid": "249f773b-822d-447d-a87e-71633240ed15", "comment": "Malware payload (Gafgyt)", "value": "1c86a16eeb7fe7cd72f14541896aa4f959129578156d9dd2f448b9111df33593", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617811, "uuid": "d36076c0-7f53-481c-b79b-cb26cdd1a961", "comment": "Malware payload (Gafgyt)", "value": "d20ef1dd5d1217a3da9bd3310a3d44ca87496272", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617811, "uuid": "3b2a4320-ccfc-469c-833a-056595e7cfcb", "comment": "Malware payload (Gafgyt)", "value": "1cba7ed20bea5f2a3feddfbaa8ea215925987d52faafbbb00b2532486f0dc7284174750c6cd5834241e08b6bbd14ee5a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617811, "uuid": "9257ea28-633d-4306-b1e9-8022de6d8f86", "value": "T15AB012F730203404C408FD0498B20FAC105346C134840F0812F70624EC5810438B090C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617811, "uuid": "db2fe7db-f539-41f3-91e3-b81ff3b22295", "value": "3:L6FT7KDQNUCz6MRgFjpMPFGBzSEyLTUWOevn:L6FTODW6MmRpVI5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769617811, "uuid": "c430795a-3bf8-44e5-81c7-35bd20fd5d55", "value": 92, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769617811, "uuid": "0a5d0ba0-c886-4703-9eb0-d7994e3fa8f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617811, "uuid": "ec63cd91-62cf-4bbe-9278-3357d6feb26f", "value": "o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaacdb0e-fc7b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769626959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626959, "uuid": "fd242f99-6bcf-4af0-ae91-542a9c9dc94a", "comment": "Malware payload (Mirai)", "value": "d33c61d946bbb81f7b10c7007f8f7087", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626959, "uuid": "52493648-011d-42ad-8dfd-1bf3959d4b6a", "comment": "Malware payload (Mirai)", "value": "1f5c2af574fa68316b0429df828a7ed60e8355d4030d0c9ae312497ab9e8e613", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626959, "uuid": "95b73693-31f2-4ab1-9453-b78522375110", "comment": "Malware payload (Mirai)", "value": "9a20871f7a130e593cda5c90c8e7674bf6afe37a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626959, "uuid": "0d68dac4-1a44-451f-b482-b97f0ecdc0d9", "comment": "Malware payload (Mirai)", "value": "12f0e3f35b975d46e333534c053e550926d8c43a331f12408e25b5929d64bf9d7f4a621caaf9822376d9fcd10d250a93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626959, "uuid": "f62d590e-e511-4021-a5c4-b08745e16556", "value": "T14804E809BFA10EBBD8AFDD3302A91B4139CC645722A53B393674D528F54F60B59E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626959, "uuid": "46d8c2c3-1d7a-441a-9766-f71c1516f8fa", "value": "3072:IpD5vdzHXx2jplrFdkWvK5tlty1M+3nni49Ud:IpD5vdzHIpJkWvgFL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769626959, "uuid": "b827c5c1-c798-4872-977c-28d21aa2728e", "value": 178212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769626959, "uuid": "0b8cac90-7e71-4372-b7f6-cfa940ee099f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626959, "uuid": "41160f41-9e9d-4f38-9b3d-7e495609467a", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b55eba9b-fc43-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1769602818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602818, "uuid": "afd29ce9-fc32-442f-8bd4-d91b78eb7c21", "comment": "Malware payload (AsyncRAT)", "value": "b61e47669459100cb8d0a0717ecdb9cc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602818, "uuid": "edec5b96-ed50-42ae-8e6a-1ab99476e632", "comment": "Malware payload (AsyncRAT)", "value": "1ff9bd3393c4f6e59980fac6e87c4695184117592b7926c5b491bcf666bdb760", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602818, "uuid": "1d88d3c9-3489-45bd-92a4-07a798b9d8fe", "comment": "Malware payload (AsyncRAT)", "value": "17c1f3ebb5000a7c99385c3ed5b4008fc2c91153", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602818, "uuid": "e921a86f-0949-4da6-9f5d-565e796ca66d", "comment": "Malware payload (AsyncRAT)", "value": "94622a48c5f4dd4577d398cb6888f996f1ac71f0956ce1a6485bbc699a12537d1b86de7577556d3f1c7267caed448155", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602818, "uuid": "1c4d2b2b-9e7e-47f0-a656-ad46327ab9a3", "value": "T1C8D22B08B7E48AA5E1BC5AB98D7291009375E9474C67DB9E5EC440DE6623BC9CF10FF0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602818, "uuid": "27977f1d-aba5-4c96-9b8b-75e9e7f2b72f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602818, "uuid": "8ea37bb2-e69c-4e56-acb0-620257f2e1ea", "value": "384:W+XhU18wMSMN+QKIcj9h93buUsTQxnCJf+jJGIjJIToA/+:WYhIoSMwQK/jjRbVB/jHA/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769602818, "uuid": "ac521672-01cb-4337-99ea-169bd6190354", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769602818, "uuid": "3fff4904-ce06-477a-8f3c-6bbe96ec4cec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602818, "uuid": "cb096b07-7203-4f7d-9686-5f6bcc7c2367", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b97fda7-fc7d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769627578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769627578, "uuid": "446c9e8e-ad1f-4cdc-944f-2102b774cecc", "comment": "Malware payload (Mirai)", "value": "d5b9740d0d0881b9b37ac5a1977a3678", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769627578, "uuid": "4084dd2b-da49-4536-aa68-be66ac620099", "comment": "Malware payload (Mirai)", "value": "22cd6940237ec732bf5abc6685f9f969492a0930b60ae14dd327310611298a77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769627578, "uuid": "e34821eb-f1ca-4c30-a2ac-db5b46c72a92", "comment": "Malware payload (Mirai)", "value": "f7c5e566621e30da1f69aa0f7d35dd6acbd3644b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769627578, "uuid": "64247065-d480-47e5-a1c5-00d5332317f4", "comment": "Malware payload (Mirai)", "value": "22f04f9e372c96f9000f1e93dfaa6737fd66903e852ce373f68e74cf550c72606a41af72726f7b2de11becd7ff0c34c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769627578, "uuid": "15be94cd-e1ee-4624-a56f-854b46a53e97", "value": "T13914C70A9F510EFBD8BFDE3342E9070635CC650722A97B363674D524F64AA4B4AD3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769627578, "uuid": "cba1224c-6c99-4f04-8a75-06fb40a393a0", "value": "1536:SFtUxW4oQqOWcDxRMeRpvz5WmYgWGOJeYH+n9rip+FfojECrl6xZ16zBzEII1OMH:Rqap471ef4rUAwM+Hh/OV2gv86GP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769627578, "uuid": "8823b694-0c15-4c07-ab05-5d188ef4e11a", "value": 206360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769627578, "uuid": "c48f7d3b-cac1-4697-ade6-4d87b6773ea8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769627578, "uuid": "171af2a5-12cb-4c7f-bbf8-f3661f95c833", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f1dd87c-fc39-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1769598298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769598298, "uuid": "863f7d29-f3af-42b2-b36d-7813eb01dc94", "comment": "Malware payload (Vidar)", "value": "cc55be5119f1fafc86ea1c2ecb366d1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "slmgr.sh", "colour": "#BBDE4C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769598298, "uuid": "3ac38b9b-1d5d-42e8-86d4-fba680c55fc2", "comment": "Malware payload (Vidar)", "value": "233d6f504b2556f774d9444b55ac240ba4c8a2d9279d443429e0075cfebfb5a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "slmgr.sh", "colour": "#BBDE4C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769598298, "uuid": "df50f71c-555a-4e50-b72f-10b4bb7045f8", "comment": "Malware payload (Vidar)", "value": "613dc126606db3c430d1c00423147eb464906a42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "slmgr.sh", "colour": "#BBDE4C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769598298, "uuid": "e695ffe5-3cbb-4b89-96b8-a74a26951031", "comment": "Malware payload (Vidar)", "value": "794d09c6ad51f8ce140b41d351d8c5b54adf371c777e1693b184c3c5d8d6db6c07dfaf3faac7dd8a80357b86482ef357", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "slmgr.sh", "colour": "#BBDE4C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769598298, "uuid": "ea00ec99-fcd5-4510-b721-03400beea14f", "value": "T19E265B53ED904A99C5ABE239E8E3224577747C490B3122D72E103AB51E377C85B3BB2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769598298, "uuid": "f4c1a27d-62a6-4bb1-8b3d-d642c86215b2", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769598298, "uuid": "42f2d9d8-d1a5-4b33-bb34-ba453f7df718", "value": "49152:GJhFnOmBAS8DxfxmM3J6IDNYJzQ0hT6yGtGFi1SHEYQ:G3GJtnCTBxdHnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769598298, "uuid": "c9f67c7d-2ba8-49f5-aea4-637d74ce61c5", "value": 4861616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769598298, "uuid": "8e685f2e-5023-4a4d-8c86-6e4a7b54bd2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769598298, "uuid": "75ca943a-7a10-4c82-a948-d5acd90ee9ed", "value": "4e6eb480.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d67ddd-fc79-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1769626043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626043, "uuid": "be9b1c54-ff1f-427d-9168-cd5d419f5c68", "comment": "Malware payload (GCleaner)", "value": "7aeac93c40bfe84f31ed9443a4e51a8c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626043, "uuid": "cb9b3dba-ff87-472e-b396-1cbb5b422ea8", "comment": "Malware payload (GCleaner)", "value": "238ec63883c46690b5f7f711a49cbfc831a80e27827f6e3c2dbc1254bb3b7cb6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626043, "uuid": "34866bb8-8438-448b-a6df-431dcd8f4c52", "comment": "Malware payload (GCleaner)", "value": "1487d019422a482c610f504331b9faf0b16fbc09", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626043, "uuid": "a69001d3-7e31-422f-9f21-3349be3b3ba4", "comment": "Malware payload (GCleaner)", "value": "89625a53cf96fe027bcf393819ed9a4070ab37f07f6a85967086362a71738cf6160f9577a9a23cfaeb02432c52460e5a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626043, "uuid": "5c5ab4ca-6cf6-4ab2-bbd7-99a0acbe4f76", "value": "T176057C22E1B18033E2631A78FF6BC77C98377E112938944A37ED29C91B767526416BC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626043, "uuid": "7ea6795b-0d84-45b3-804d-f5abe0ed1078", "value": "421f57ebeade5946b16f0c3c541d2697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626043, "uuid": "4f5aae6b-95f6-4d6d-bfe3-6b91c97fbf56", "value": "12288:d9eONBtJzhKJd6EPXNQyxbLSoxZR/ra9mUW3dIG:xnzz04EGOz7R/rUmn3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769626043, "uuid": "8c134edf-6d14-4571-a7f2-231a4718052f", "value": 802304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769626043, "uuid": "08240d5a-9570-4fd5-ac3f-6b6ee968856a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626043, "uuid": "af96ca1d-d758-4ac9-98e4-16e9f59b75a1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c6bcce3-fc2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1769594025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769594025, "uuid": "fe899d22-f2c8-401a-80f0-90d7526aaea3", "comment": "Malware payload (Vidar)", "value": "6cac19d5fe3a850b4fba77bcfe1082c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769594025, "uuid": "619a425a-040f-4158-a3d9-aa1a58b40375", "comment": "Malware payload (Vidar)", "value": "2439dcfe417faaaf06141dd64c0920dae597f8a427d99d4a8bafacfa1dfeb514", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769594025, "uuid": "a6625e57-7f64-4eaa-b4cc-3a269c3f29d3", "comment": "Malware payload (Vidar)", "value": "8898bce4d98e171f7fc8c737fea40b1d15196d0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769594025, "uuid": "666040e5-3d51-4a07-937e-1dd42ba05e50", "comment": "Malware payload (Vidar)", "value": "845dbf254c2cefe6f9a001d7c14218f73501f7ed21b996d22a37a849e2dff28e04591a9de4bd41c7115dc12f24235aa9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769594025, "uuid": "0b2014b3-2ff4-4181-9e4d-feffeb08757b", "value": "T16E065C13AC918DA9C06AD135DD76514A7A707C090B3133C72A53BB3A2FB7BC0627B7A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769594025, "uuid": "eca56c3e-41d0-4873-a363-0b71258fdcc7", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769594025, "uuid": "4fff5929-ace0-4fe8-8936-fa9c2cf73ebb", "value": "49152:THjRwTBnEqaGSo56dHlii3I/rhSkHStwXZ0SgLzl:TlwV4DdQi3I/lR6S2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769594025, "uuid": "ef1611b2-d414-4bc9-95db-046c1ae83021", "value": 3746520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769594025, "uuid": "09e4c302-55a3-4d83-ae8a-25e2523eb226", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769594025, "uuid": "5c486c74-3ad0-48b3-a19c-4f8e70409b7f", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a8dd58d-fc72-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769622825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622825, "uuid": "cf5fa6e8-3e87-4262-bbb1-c9d9306d0c07", "comment": "Malware payload (Mirai)", "value": "19c7c2f08aeb7c06708bbf0f668eb5a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622825, "uuid": "95a14b79-85e9-4877-a01a-ec075dc37116", "comment": "Malware payload (Mirai)", "value": "2448fa2db54cf9b8085da14503bc5691d013fdac091f9c7f8a5c10ee63c0df0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622825, "uuid": "0bd64230-06e2-4c54-ac51-54ae4386e10f", "comment": "Malware payload (Mirai)", "value": "3d1cdfb072a20ab7ba8efb8ce2082e2a096673a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622825, "uuid": "f1c26a58-0c85-4621-b60f-dc995d4a4a39", "comment": "Malware payload (Mirai)", "value": "39f82200883d329aba399adcbbd5e26e74b17777ebd85e25296f10ecf1967245b47762b186af09ee9eaf135e3a854c92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769622825, "uuid": "5fff6028-8d81-4ca9-b8ff-6263f8096b60", "value": "T117E3BF97B7476050C8E10BF84BCB5BAC292B21119E6B88F77D2E363A19775CB540B3E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769622825, "uuid": "740c7051-18f9-4864-af72-8940b150b2c0", "value": "3072:hmYCWAJ40/7fRvNW0GiqqG3ITge7dagXCZvCA+tq:hZCWAWMRs0sWn7BCZvCpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769622825, "uuid": "8a9a58a9-8dc3-41da-a8ff-3259d8d6ee38", "value": 157140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769622825, "uuid": "b8846351-30ac-47c1-b983-5f69bf3f3dd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769622825, "uuid": "e12adc5a-7bb3-4fc3-b333-93a126c0bdad", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "491b464e-fc51-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769608649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608649, "uuid": "aac2711c-e0a1-42e1-954f-0835fecd8c68", "comment": "Malware payload (Mirai)", "value": "fd47aef56a8bd77fe18a5290250d7331", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608649, "uuid": "99264720-4c18-488a-b2df-ff73180804e8", "comment": "Malware payload (Mirai)", "value": "2471023cf6b6dfcb2af3c9ee921d5416c8d460cb4875be863237d2ff9fb10dfd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608649, "uuid": "a1f279f5-3361-4f77-b32a-19eda6501a28", "comment": "Malware payload (Mirai)", "value": "c829cf235fdc86a471e77f577fe6b5007067360a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608649, "uuid": "4e7af040-b53b-4b75-beb2-5ff4ebbc77ad", "comment": "Malware payload (Mirai)", "value": "1ab355d75839bd3f631cd7f3ded7db210913352bed8beb70b88045abcd736bb4f0fd22d69caafe025e11ecc65f20a33d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608649, "uuid": "67d8a432-3372-4086-8722-ca2a3fa65687", "value": "T174C2D030E4819E54EEFAA87057EAE9D52FA11BC3AF33021461539B663112A4EB380EC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608649, "uuid": "4e00e577-1778-4df0-9f9f-d915754e69e9", "value": "768:Yp9xHwWfP3NpXgLEAcPtnnDOEUEqpdmgmR2+4uVcqgw096:Yp9uWH9RnPhiE/qpAxL4u+qgw096", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769608649, "uuid": "2ba5c661-a4eb-4679-90a8-48e78e7c9276", "value": 26400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769608649, "uuid": "fd9b95f0-c247-4f2c-b0ae-e86d4ba28035", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608649, "uuid": "046f1ffd-0b3b-49f9-993f-fbee0df42763", "value": "astro.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f26e2a83-fc63-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769616664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616664, "uuid": "6a7d2d54-198c-433e-8b68-698e42894ce8", "comment": "Malware payload (Mirai)", "value": "24c67f576ec6b3a654229b2de8c49830", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616664, "uuid": "b0e16fd5-6c7c-4eeb-b61f-25baed112e63", "comment": "Malware payload (Mirai)", "value": "260213564425a08e0540cea16ba87b2dffaac79e41ab08e43316f768d281197b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616664, "uuid": "28efd657-4896-47d2-9f50-ca7ed691423a", "comment": "Malware payload (Mirai)", "value": "3b6e927e7262053ff7a723744dc9f8de47a1672c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616664, "uuid": "164758f1-52a6-414c-9d55-02541a42d42c", "comment": "Malware payload (Mirai)", "value": "dc73e7d3d41fee747715f209ff6a4cea5a4bcec6636e58c5b4754e8f85d8546ea234dabf5d54682465a987e0e6727fda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616664, "uuid": "730c96c2-6736-4358-bb31-423063ef5982", "value": "T179333C4DF783E0F0DD4B0531115BF77E96349E025124DE7EEB98BE66AE32A02711B628", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616664, "uuid": "b4f5294e-2a16-4e9a-9660-43a9cf4628b9", "value": "768:9wHds+1eCZWUJ2SkpRflrFWwaTlFNB5azjYvzNeVMU2331ANA0B7RhuqDV98UN+s:9wDt3kpezwLMU431ANA0BLBCYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769616664, "uuid": "5f56ab69-fecf-457e-93bf-9f23d07a43e9", "value": 50476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769616664, "uuid": "ee385f1c-57c9-4faa-83b4-59d8545743f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616664, "uuid": "85a5742e-9208-4428-959f-c57cf87fce20", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9184a95f-fc73-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769623374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769623374, "uuid": "f8886e9b-33df-404b-90c8-90f83ce32ee8", "comment": "Malware payload (Mirai)", "value": "d61159bff133c48330e781416eb41227", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769623374, "uuid": "1b8c8e7c-2d83-43ae-88be-cf329d4eb060", "comment": "Malware payload (Mirai)", "value": "26f1be5aecca093750151d0b0f907e1a870e36d7ae747e33875bb90bd00d93df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769623374, "uuid": "d073ddac-d1b5-440d-83c2-83ff05f413bb", "comment": "Malware payload (Mirai)", "value": "1de976b9db9adb82dcb8a184a6e489891a284d04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769623374, "uuid": "e4ce3f5f-3c36-4af6-afe6-740481a4d4fe", "comment": "Malware payload (Mirai)", "value": "f7a70c3093aefae7d2d79ec8d9d8acb6963bb318f9750a364c5287c14bc3bc0a107b03e4253f0a5c2d7b363f006ccb0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769623374, "uuid": "94f90853-8ef2-4488-bcfa-bd186b0d80d7", "value": "T16E935D49F753E1F0DD4606B0115FB73D9674EE224024DE69DB94BEB7EC32A02A21B61C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769623374, "uuid": "1037aaa3-c5b5-402a-b788-5f856465493e", "value": "1536:6L+jK3ibsHd2AWausTZlMTDCypOkn/OhdtIGDT9Yjr6gU531IiyvCmr:3Yx92dtIlMTDnOksvTygSi03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769623374, "uuid": "68631734-ea43-4f06-8e0f-1c381e7d0a2a", "value": 96680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769623374, "uuid": "126d1ee4-ba85-4966-95dd-6b659e5e2234", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769623374, "uuid": "f69f759c-bfcd-40f1-bc82-a47afb9596c2", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c696a488-fc3b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769599411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599411, "uuid": "54690dd7-69f3-4177-a2a2-9ccac9b5cf8a", "comment": "Malware payload (Mirai)", "value": "77d7bbdf15d315ddbb6f5b3050a4cc31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599411, "uuid": "846ac9f8-c78d-4a64-b609-f4293abd9174", "comment": "Malware payload (Mirai)", "value": "27d4b7a50861563042f3ef30e8a72380f3fd93f1ad5346fe3e29327cffd9454c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599411, "uuid": "22310cc2-50a1-44fd-ad90-93a0ea5cacd2", "comment": "Malware payload (Mirai)", "value": "8f4d30e6d66e1babe8ccff4adf0a4cd2576c28ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599411, "uuid": "b8d30995-991e-4fbf-ba31-783519988c3a", "comment": "Malware payload (Mirai)", "value": "56e3dcc17abc9c49c0ed3b0d7d162e7a0088dd1dc11ef4b01d2ce7ba23dfcb8a168f29f80177041b43a65702c30e4f63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599411, "uuid": "9fad098d-d0cf-4bc2-bb8d-7ce5fe8f4aab", "value": "T1DDB3090AAF711EFBE4AFDD3345A50749299C550721B93B3A3674D81CF61A68F0AE3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599411, "uuid": "dc537f65-a760-48c2-8689-96153664605e", "value": "1536:i3JE/zOQu4gaP5/muoM9p8U3Wj0M9q9YCtvbVM81yxuJG/HencnZfqFX39wu7r8d:i5KB9pOgctv4v60ywdqxY+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769599411, "uuid": "46d73765-2d96-4b52-ad5c-667d6c484678", "value": 113632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769599411, "uuid": "4328b909-887a-455e-9850-8d1c35b1ec7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599411, "uuid": "76c92097-54a3-440e-abec-3dc9ee58ea59", "value": "nklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "596c6091-fc66-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1769617696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617696, "uuid": "2fb461b5-050f-48ef-9ece-e9002f15b960", "comment": "Malware payload (Gafgyt)", "value": "fe0904dca6ecb54a5acdcd1f7970a641", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617696, "uuid": "d935ed3a-17ff-4c83-a937-3f6556fabf9b", "comment": "Malware payload (Gafgyt)", "value": "280b5a76d8c2e870616db131e8d3942e38dddb16bb21a3e7725e0a08aec01274", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617696, "uuid": "a00fef4a-1408-4c37-8f64-d376069de45a", "comment": "Malware payload (Gafgyt)", "value": "cb22bda37d8843364461e50d756dda4b36466d6a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617696, "uuid": "59b725ca-e21d-433d-9bb0-e7baa9f4de23", "comment": "Malware payload (Gafgyt)", "value": "e9e30d543fb0e9c38c82716ad4cd7bf5cf5c3595da33069968fc67e9d6018b54a9d11b89c6496a31970eb3308e5eeed4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617696, "uuid": "d54befef-863e-4b91-a3e6-82bcb9e0df1e", "value": "T1E4F0BFFF01A04CAD2144FA4AF9E34E79A81A69DD54C60F4C9A9F2C393C8D9187835F5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617696, "uuid": "6619a9f0-9c16-46fb-b1d8-401997dbae4f", "value": "12:CLJoZDSLJhHWNCLsySLshHWNCLPBzvSLPBzMHWNCLPnIjDSLPnIMHWNCLPiDSLPQ:CCZeTWNCw5wRWNC9z69zGWNCzJzhWNC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769617696, "uuid": "22bf2f61-eaab-4952-9e91-71bb7b463b8c", "value": 650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769617696, "uuid": "ad471c34-c372-4a2e-a7d7-2ae66ea76da9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617696, "uuid": "896771a8-d0fe-4ddc-be54-6eab107ce435", "value": "lilin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d66f4ada-fc72-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769623060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769623060, "uuid": "7e9ab5b5-f063-4086-8999-7a31788de380", "comment": "Malware payload (Mirai)", "value": "a6a0b9a2a0f2f281f9d266d56bd4fb2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769623060, "uuid": "67618b19-c649-4da2-879c-eea8d252a4ed", "comment": "Malware payload (Mirai)", "value": "291725b2b9e8f68adafd42f2065106657c370e690c4cd9129856973c072a9d5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769623060, "uuid": "635385cc-a107-4e0f-948a-ec6d1b5fb73a", "comment": "Malware payload (Mirai)", "value": "09f42c646fd8014960e30e19c829d1c72a808775", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769623060, "uuid": "1fa6320b-139e-43be-8656-33729c141562", "comment": "Malware payload (Mirai)", "value": "23453c11d222096ae0fb79f5ee8a7d9deae6e6a52e043b011f05d5a16a44301eccfa22771bc0244998a585e47c9e4b62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769623060, "uuid": "57cb5e6e-2471-4bfc-ba9b-00592f62a019", "value": "T14B230160D4642B25FAFEEEA049EE04C226FA4F6BFB91C546D2C5E7603252637DF70484", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769623060, "uuid": "5fcf988e-1f16-4930-8bcb-a079466dcd59", "value": "768:MfRMmHNUTCiGJgOOvX6UsKGxVGc+XX/i2c5+hhzwbvd0V3B4uVcqgw09Uc:MfJyGJg7sKRcC/i/5+IvdKB4u+qgw09d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769623060, "uuid": "1899e524-04f9-4f3a-b9cd-959694d43da7", "value": 48472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769623060, "uuid": "6f74995c-c01c-42b3-aca3-23cf90c12561", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769623060, "uuid": "ae660499-15f7-4362-a1c6-53e0c69ed490", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7152f85d-fc32-11f0-a129-42010a9c0007", "comment": "Malware payload (SmartLoader)", "timestamp": 1769595402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769595402, "uuid": "6f931dd6-856e-421f-b738-d3008b216e23", "comment": "Malware payload (SmartLoader)", "value": "ca6468aed7b54a1d54266a00f6fd8fd2", "object_relation": "md5", "Tag": [ { "name": "Fake-Git", "colour": "#271630", "exportable": true, "hide_tag": false }, { "name": "LuaLoader", "colour": "#717CDB", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769595402, "uuid": "11ed13c9-ec3b-4fb5-b3d3-4e7b5a8816da", "comment": "Malware payload (SmartLoader)", "value": "29220ebfc242ac2dbc3cce2137365499cdc58497257c76afe200d50d9b0eb5fe", "object_relation": "sha256", "Tag": [ { "name": "Fake-Git", "colour": "#271630", "exportable": true, "hide_tag": false }, { "name": "LuaLoader", "colour": "#717CDB", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769595402, "uuid": "c35e6234-8dd7-41a1-b3fc-1520798036c2", "comment": "Malware payload (SmartLoader)", "value": "817f58a6043a4077404a536e4cbda079d6a3ed7c", "object_relation": "sha1", "Tag": [ { "name": "Fake-Git", "colour": "#271630", "exportable": true, "hide_tag": false }, { "name": "LuaLoader", "colour": "#717CDB", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769595402, "uuid": "0a53ba06-306d-4b89-be92-af9dbcdaf1f4", "comment": "Malware payload (SmartLoader)", "value": "6618960ed77d5a2cf3f03f23c2108912deb9d38cf09213501f60de48260e2aa874c3ac82dd49773ab697a4ea89c90121", "object_relation": "sha3-384", "Tag": [ { "name": "Fake-Git", "colour": "#271630", "exportable": true, "hide_tag": false }, { "name": "LuaLoader", "colour": "#717CDB", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769595402, "uuid": "b48e2202-6d25-418f-8a51-3267a7eb54db", "value": "T12C553387413C18C44F3D076767AF996CA2259AFC20070C776766446B353F3AF8AB998E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769595402, "uuid": "29acf8f5-29cd-4ae2-be63-eede59ced84f", "value": "24576:8oZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRXMU9Q:8oZ9bq+MmMEL+hcjXHC/wnwdXMU6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769595402, "uuid": "159d4ceb-c05c-4b4a-8c1b-f432cc37dcb0", "value": 1387699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769595402, "uuid": "935e772e-7af6-4708-9a28-5862bd52d844", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769595402, "uuid": "eca89b2c-ee8e-4667-899c-bea7774236c3", "value": "cs2-external-1.0.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e170c238-fca0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769642835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642835, "uuid": "16d27b02-6b33-4be7-a33f-c58093a10e08", "comment": "Malware payload (Mirai)", "value": "35f89d68f5090e9efa23f0567f3ee34a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642835, "uuid": "5c38bacb-4727-4e76-958c-51eae0d0b860", "comment": "Malware payload (Mirai)", "value": "2941184b51817d9c155d5f5491f695ef06afd9dd3a4bde2d3efaf8e5d7196371", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642835, "uuid": "88cddf6a-4e54-4fe6-8846-ec3c84f4a1eb", "comment": "Malware payload (Mirai)", "value": "18240f396136ef4aadd44b5ead213923b3f230cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642835, "uuid": "45525f59-d464-439e-8acb-59bbbff68e28", "comment": "Malware payload (Mirai)", "value": "34cf32a8d15b24face6f8efac3c43b31ba77226ea052f6ed0ccf9f388ba25b0545fbe22e55076d41f59f75ee43306997", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769642835, "uuid": "0b3908d5-1086-433a-8168-e0653d92afd3", "value": "T1B9D32B9ABC819B11D5D625BAFF0E518D33134BB8E3FA7103CD185B2A638E95B0B3B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769642835, "uuid": "0220c43a-0c72-4e9a-9b23-bb8933e8cac8", "value": "3072:zTcIlNmrvK6BEWvfK/kjNSTeKtNh4CamHqKPM/nTJ1Gfy0X0Xh:2K4q/kjNSKCamHqKPMPTaflXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769642835, "uuid": "3e34c845-665a-4bda-af39-6ac6aeef4e71", "value": 132648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769642835, "uuid": "860a61c7-71bb-4b96-be43-6cf8423b8c56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769642835, "uuid": "e5fab496-01bb-4a51-a138-14b60da40134", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f03827-fc40-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769601339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601339, "uuid": "8802a4a9-ab9d-46b5-8ef3-e0f013fd0f53", "comment": "Malware payload (Mirai)", "value": "9c7c2bdb1b45c6bee8f609a70c2bc740", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601339, "uuid": "cc33fd8d-db96-4073-9427-82d267292fba", "comment": "Malware payload (Mirai)", "value": "2c1e75dfa13fa242a3c1dfc98b7d6a6bb73263c66bf06ae25fd7aac621a1802f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601339, "uuid": "bd36d958-be64-43d4-a6a5-a106fb88cf40", "comment": "Malware payload (Mirai)", "value": "1c29def50a194e429218acf4c3c7826aba56bf2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601339, "uuid": "188db50a-a08b-4447-baa0-5bd9af0e252d", "comment": "Malware payload (Mirai)", "value": "73846e5399df0dd20af5f37ce778bea054527c9a715ed21655b4512952daca23c37ee39eb755ae6dcbbddf6117eb5fc3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601339, "uuid": "14f4f899-c1ea-418b-af56-d821f82fc00e", "value": "T15A33F1B4E5A59571E33A483AE9281D128297CA6DB175F43336E14FAC6DCA04CF3FA046", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601339, "uuid": "f34a4fac-29d6-4dfa-b4aa-a9bbf332b3fe", "value": "768:bNhb0w95Eh8MS3+8fxjAoDbqQZXayonNXJW7BWgRuFDsWW9q3UELHAMpdYpg4zi1:bNZ595EaFu8fb96JYWnFIGLgUYpg4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769601339, "uuid": "b2d47818-85c0-445f-9ef1-4666ae0af1c9", "value": 51212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769601339, "uuid": "4aef29d2-6049-47b5-9218-ba67268364c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601339, "uuid": "6c74768e-51f5-46dc-b77f-548cf0fbc31c", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e45e9275-fc44-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1769603326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603326, "uuid": "a29ea904-27f3-4847-be40-6c8f5520b122", "comment": "Malware payload (Stealc)", "value": "7b6771b140f8241ea207be008e5638e6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603326, "uuid": "af8c0a2d-50bb-48ea-b7b8-77c8a1c681a9", "comment": "Malware payload (Stealc)", "value": "2d86d5764d4e04e931c0cb222a1c79bc2a6213de1d01bd58a89d6cc9a6f55ce0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603326, "uuid": "2a6e9989-82f0-4f5c-8d01-610b334214fc", "comment": "Malware payload (Stealc)", "value": "fb49c22f9a9fa2176ffafcd424fc1a9d47887ff6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603326, "uuid": "10ffc482-71f8-48c2-8b6b-87c694b53c75", "comment": "Malware payload (Stealc)", "value": "385df11497d460544b25bcf6179cbe9c171e93b5da2c3f8d39dfbafc9674ed654013001dd10f4f8daddfe12219e3f925", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603326, "uuid": "2769c44d-96b7-43bf-bd9f-f7ed848f45df", "value": "T1E044239EE91CC87EC893ECFD23E5941571DAB09033E8F6CD445F82E010EBA676E54829", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603326, "uuid": "264697b8-142c-4d99-9834-e07c2f26967e", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603326, "uuid": "bbb6ab1f-dfc6-4f2d-bbdc-734e8a0d02be", "value": "6144:74vDjIylF3HxOVZYuq/PRom4yLutWKpNFtRlwMd/spTHxK:74vQylBHxKaX/PRN4vWK3FPld/qHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769603326, "uuid": "e623627b-2afa-4584-80e5-ea01af01389d", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769603326, "uuid": "23deb3da-46a4-4b22-b336-7f88b4cb496f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603326, "uuid": "852a2bb0-e7f8-4c12-9766-5b003170cfeb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4921904b-fc51-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769608649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608649, "uuid": "037abf03-e361-4efa-aaaf-f83871240d7a", "comment": "Malware payload (Mirai)", "value": "7ec09fe040b1717d7c8af6deeb6688fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608649, "uuid": "3bf496bf-4bd9-4609-a46f-f459c04a2f87", "comment": "Malware payload (Mirai)", "value": "2e360fb0621934ab23d044d867ff3d07ff3bddf863e091667fa099ab0426b644", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608649, "uuid": "27f226c7-45a8-4349-be0a-1f0d49c62af2", "comment": "Malware payload (Mirai)", "value": "e3404b676de4221613676333e787909485c6207c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608649, "uuid": "b6c42a56-7558-474c-831a-86dfb462c4c0", "comment": "Malware payload (Mirai)", "value": "85c94f8227823f28b64add248905756761be2ae925657f9cc91f3a0068a9e2d278328a96b0acb4a358eb23a3e852b871", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608649, "uuid": "3aba8d6b-2944-48b0-869e-f17c04c6b157", "value": "T135631995B841A626C2D113B7FA6F008E371857D8E2DB33538D255FA07B8A81F0D57F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608649, "uuid": "4de1ea60-55dd-44e4-931a-26b839e132b0", "value": "1536:nPtKn4eYCyktl7wcTUnQWdWhcuFJ8fhWfy5tNrNuW1:nPtKn4VC7OMcuFSp0y5V7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769608649, "uuid": "87b9b14b-8d2c-45e4-94e3-a682cedc18da", "value": 71560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769608649, "uuid": "3f34ac5c-c227-4454-9a78-6045c4cfe40d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608649, "uuid": "3c6cece2-c52a-4f9d-9066-7d5eea10f011", "value": "astro.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59064ba-fc41-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769602067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602067, "uuid": "644a4430-ac64-48f3-bf8b-7e686846f258", "comment": "Malware payload (Mirai)", "value": "d7e3d37e0c5ebb498bf5a6f3e1801226", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602067, "uuid": "f558ec5b-6ac6-4120-bcd3-f8090eb0e6cf", "comment": "Malware payload (Mirai)", "value": "2ebd09e601effd14eb25b4059f5fb59226a3feca88a6ee5ff6a893a76d181232", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602067, "uuid": "40bc0c2b-5ecf-4e57-b854-8ad208dea43d", "comment": "Malware payload (Mirai)", "value": "eac33212bb045e1481fe6544e7350626a363f608", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602067, "uuid": "d9b8023e-d88c-4005-a6eb-d6f040e6e5a3", "comment": "Malware payload (Mirai)", "value": "34dc2c8cccffddba4d7d965a4ff99fb1ad5c12ac1a986a419bdef8cdf7fc16bd24145405df60aae282a6c96b04be556f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602067, "uuid": "1e1304a4-5050-4649-a679-3229d27ff089", "value": "T1B1B31A0AAF712EBBD4AFDD3345A5074A399D550721B83B3A3574D81CF61A68F0AE3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602067, "uuid": "aea539c1-3cbb-4eab-8a9c-330b15845d23", "value": "1536:2onVE04Ocu4gaP5/muoT5WML3Wj0M9q9YCtDbVM81yxuJG/HeXIeZfqFX39wu7ru:2OF35WjgI47Kq9X3wQJFuY3Oy6OX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769602067, "uuid": "ce422936-ed51-43b1-ad28-b17c4244252a", "value": 113488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769602067, "uuid": "0137e74b-bdd6-4aea-a90b-c6aa9ad8d8ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602067, "uuid": "cfc65952-1360-4dc8-8064-d215226f9760", "value": "zermpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db113b6-fc18-11f0-a129-42010a9c0007", "comment": "Malware payload (DCRat)", "timestamp": 1769584068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584068, "uuid": "32477e39-381e-42cb-bb13-f5c7963e2b6b", "comment": "Malware payload (DCRat)", "value": "2575cac4e7d2f4613c15ccbb7f07589a", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "wmk77-com", "colour": "#33F251", "exportable": true, "hide_tag": false }, { "name": "wmk88-com", "colour": "#FFD915", "exportable": true, "hide_tag": false }, { "name": "wmk99-com", "colour": "#F3305E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584068, "uuid": "1881fd8c-5e1e-4235-b7c9-01c1356a1e77", "comment": "Malware payload (DCRat)", "value": "2edbb05408a450babfe1bde6104abe8c2ddf4a6aaa95ff6d3516835b48366b4e", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "wmk77-com", "colour": "#33F251", "exportable": true, "hide_tag": false }, { "name": "wmk88-com", "colour": "#FFD915", "exportable": true, "hide_tag": false }, { "name": "wmk99-com", "colour": "#F3305E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584068, "uuid": "a1abd3ab-5b1d-4e74-a284-c00d2e12772b", "comment": "Malware payload (DCRat)", "value": "97770be3e67be430527e592b9c333215ddc2fd29", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "wmk77-com", "colour": "#33F251", "exportable": true, "hide_tag": false }, { "name": "wmk88-com", "colour": "#FFD915", "exportable": true, "hide_tag": false }, { "name": "wmk99-com", "colour": "#F3305E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584068, "uuid": "64c360fd-2da1-4eb8-a086-31919d502407", "comment": "Malware payload (DCRat)", "value": "7c1590c02f0607909f5f1b03b05e3a8f194b114b434971e3d12e298bff1946030f76c49f034e8c9225e23b31dbbe4dd1", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "wmk77-com", "colour": "#33F251", "exportable": true, "hide_tag": false }, { "name": "wmk88-com", "colour": "#FFD915", "exportable": true, "hide_tag": false }, { "name": "wmk99-com", "colour": "#F3305E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769584068, "uuid": "c4ffbad7-2de6-4bab-8f38-be8b20a341cd", "value": "T1141633E89CC786B7B5CD4898D20FCB43C76C244E4EA6BF60149D939E0B535FC6A7844A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769584068, "uuid": "2e687285-7c69-4ac5-8b19-72d6d4f9cc67", "value": "98304:gqLVNe9DH+5G3rI9oUNcyzYVux/p5VhpCNnVD8pY:BmDzRXUxBO3gpY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769584068, "uuid": "62fec0e9-8f70-4680-87ce-dc95d4c80b92", "value": 4374774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769584068, "uuid": "33f83a9e-0500-4580-bc95-1c3a1e9220c8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769584068, "uuid": "31b726eb-7805-47d4-a3d0-c0cf8bc61acb", "value": "pythonw.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b23d772-fc49-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769605351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769605351, "uuid": "655bfdf7-f594-4ff0-9c2c-078bc2dc5efe", "comment": "Malware payload (Mirai)", "value": "00c68e9907f6e4f5d95bd8102de2cb8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769605351, "uuid": "58c10862-d6ca-46af-9f8c-64e3317c1c86", "comment": "Malware payload (Mirai)", "value": "2ef60a12f05e64ec3828a788f9d27075e31a74781d404a4d653725964045061e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769605351, "uuid": "090367c5-4d42-4f42-bc82-764127db080b", "comment": "Malware payload (Mirai)", "value": "0620707477e849940f92f7dadb8ce5d4563b4999", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769605351, "uuid": "7142d975-5b41-409b-ac19-cd3c76d69e5e", "comment": "Malware payload (Mirai)", "value": "e33c3cf98945a6fa6ef10b40350fef581addda4d4859903891586488ab65eeaac3d8362b6ff900f4e119863ed5de070d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769605351, "uuid": "4bc4e5f7-6db8-4cc1-ba9c-037942b97d49", "value": "T13D03E07386FE85CFE95E21391C3DBED51654E02CF46EC8F6FAC864622C67B46381A442", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769605351, "uuid": "26e7dd05-31ad-4115-8250-3cbdab70dcbe", "value": "768:GTlR2+fQEnEj5iLaAhLJnJrbPnfx9cp8gaT2MEQ7C97ZadhAnbcuyD7UoQRjC:sI+DnEj5yzR3T2M498hAnouy8oyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769605351, "uuid": "1d8be500-21ec-45ae-a2ca-1eac42d82e8b", "value": 40016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769605351, "uuid": "87a46750-246a-437c-aca9-3f88c5f97e83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769605351, "uuid": "dc476053-c43f-4338-aa25-3e7783bf7571", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007b9c80-fbf1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769567296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769567296, "uuid": "cf2ac239-8fb2-45fe-8ec1-d2e1fdd09b71", "comment": "Malware payload", "value": "f1b1020a0682fa1e5468d2bdd116bde6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769567296, "uuid": "4ffc044c-41e1-4c81-9b50-88905d7fd90e", "comment": "Malware payload", "value": "2fdb2a092f71e4eba2a114364dc8044a7aa7f78b32658735c5375bf1e4e8ece3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769567296, "uuid": "2270de22-fd6e-4f3a-b4fb-a17d8143c9b5", "comment": "Malware payload", "value": "0b162462d970d39714ddf8905e27fe9cea1ff95a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769567296, "uuid": "92b0b6c9-043a-4d41-a532-41e7402a882c", "comment": "Malware payload", "value": "6537e1eed50e2f1e8419a22dab0e9121f5e09c1e3c3211634e85b20f667788ace67a85b5df9309ead6c5ac86c56c61e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769567296, "uuid": "78221e59-4260-47cf-961b-764bfc4a0850", "value": "T15B13015FE9F90C78C41CB1797F89F59901D4E104CD8DC6D2DAB8649BB5B23C06A26B23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769567296, "uuid": "a87537e3-be20-418f-8991-07a7b9b4ee61", "value": "768:7oiPR50sFQj3ZXAeE0jC4Bid3GMTEuyaS8pRjcucpdMcU52/5/rKnbcuyD7UGQ/:7oiPLxF8ZQe44BiQMT46jc7McVrKnouH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769567296, "uuid": "2dfe565c-c009-41d1-97fd-269cb4f10dc9", "value": 41762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769567296, "uuid": "92267815-6ec2-4acf-987b-22f5fe19e9c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769567296, "uuid": "3d7bc681-1567-4d0b-8f60-c3cfdd0bfec4", "value": "zerobotv9.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d0729b9-fc28-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769590939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590939, "uuid": "8f1b1911-997f-4f5e-8bd5-bb22b32469e3", "comment": "Malware payload", "value": "cc4d68c579f1cbe53b191b541ea1de88", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590939, "uuid": "6e329d82-77a3-4515-a889-07a30b51aacd", "comment": "Malware payload", "value": "301ca145bb7c2e6eb036f0b1cabb5ae5236d08a6799ed24051911a5f85a776ab", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590939, "uuid": "a557115a-85e4-482a-8268-dce2652053e9", "comment": "Malware payload", "value": "684f3a19ffbb5f0f2786df4e533a9d9cf72f0919", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590939, "uuid": "819e300b-9802-4f7c-b2eb-3b48eb58f4ec", "comment": "Malware payload", "value": "790944f6d888be6f51b6286dfa1c212a6d09fe871749a05fc39f850b9657412f9d9c883ed170191a06876c4afa227538", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590939, "uuid": "69c6129b-0af5-4978-8a1b-b1c1f38269dd", "value": "T1C2133B473A146231CA86073199CED7E65F32BCA84F661013716AB38C3F72AD1577A4EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590939, "uuid": "6fb565a1-8a28-4433-8abf-160953f03e1a", "value": "384:1zWKVhUp8sGmiy3M5BCx6ey3M5BC0iEXDNXzo2C4VpwK3eshldei2WSx7bLW:pgRGPWMDCgeWMDCOZQAmbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769590939, "uuid": "ebf38c2b-98e7-4e82-9f4b-126c2e03eea5", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769590939, "uuid": "37017517-5c34-44b0-8647-ce81fd6085f6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590939, "uuid": "cad41917-83d5-4cc4-8876-105ef6f65c43", "value": "301ca145bb7c2e6eb036f0b1cabb5ae5236d08a6799ed24051911a5f85a776ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "063a68db-fc88-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769632159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632159, "uuid": "1bb01d58-6091-497b-8374-89459bc21280", "comment": "Malware payload (Mirai)", "value": "1d2b269b639d1101f4a637334bdb3fd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632159, "uuid": "4332dd4c-6891-44e1-9062-a3bb66777f7e", "comment": "Malware payload (Mirai)", "value": "302b5fb619b7df78b0629928158b561aef5dbca40d85274432ebec0e765904ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632159, "uuid": "94d04a2e-980d-4b2b-ba54-0a4ff14cb289", "comment": "Malware payload (Mirai)", "value": "8543111781b0599c9954ae25649ae71d4331873c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632159, "uuid": "8f73feb4-878d-41e7-ae59-39c2c35a3647", "comment": "Malware payload (Mirai)", "value": "a6555dfc422acf0cc8148e02857f838d50be0b689e9e6411b45bf56c37ea939c17af7c920e2d9e0a2113a8cadb572eb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632159, "uuid": "1ae172bf-f773-4774-bfdd-3e02cc5542fc", "value": "T16804AEF7B64F6460D46702F41BCB0B6D2A2314018F2BA6E23C6E763925765CF261A7E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632159, "uuid": "2ae0b541-597b-43ee-937b-bd5edfff3f18", "value": "3072:M89c26wIDbNjYM02X9V0c/3dieX4zwDUcazTqcXVfgRCBiV9DcXq:M6c2CeaX3ndieuwwBWclUCBiVCXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769632159, "uuid": "d272008b-ec29-4c70-9896-c93327620d4f", "value": 173516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769632159, "uuid": "36bac273-c06b-4cdf-aa8c-55e5135e18dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632159, "uuid": "af1265aa-ffa3-441b-b5dd-dc5c680bab77", "value": "herios.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e40fd4-fc40-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1769601334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601334, "uuid": "93107f05-7cf2-4334-90e7-217cc049ce4b", "comment": "Malware payload (MaskGramStealer)", "value": "23da33442162960c7374ccaed0010b54", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601334, "uuid": "36625fe8-ba16-4b93-96f4-3bfff87499fa", "comment": "Malware payload (MaskGramStealer)", "value": "30401cc5ee67082d0a2f9f8ea25a0b6e6a6173bf105c6d0c21100e7d090a12bd", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601334, "uuid": "15522769-1508-4632-808a-acebc87f003c", "comment": "Malware payload (MaskGramStealer)", "value": "5ae31b0018d04d52ba573b367e9d94814b5ffe4b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601334, "uuid": "240fc722-7af2-4a87-9da4-47cb0c56fd10", "comment": "Malware payload (MaskGramStealer)", "value": "c434d9e308d92f90be5c272484f4a7564e8d5b1560eb61d127a0e8d71c43809ded0d736f5409dd56f3358e125c39d3ff", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601334, "uuid": "d92721e8-beb6-4ba7-86ca-f7fc55a51072", "value": "T121B533398E355A80D7C7337133B385906FEBABF056C5862D0DA24E4AC15FD61E9A23D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601334, "uuid": "413b1787-fe65-4f7a-a216-be66e08b7521", "value": "dc6b57a7282f87959d9942f26d5c0b74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601334, "uuid": "0faa2505-8f73-4ab4-be4c-6d1183905158", "value": "49152:kQ/QHD/7bE1NM69nNHZ2Z3zL+yErdlqNzvX49vQZhN9ux:tgT7bONMGHZ+3zL8rd0vIWLN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769601334, "uuid": "268e71f9-ec4e-49f1-855d-faae9a396428", "value": 2413568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769601334, "uuid": "4750f672-2bda-4038-909b-8208b9bdeb02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601334, "uuid": "00280420-672f-414b-a127-d30fd551a07d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a133c68-fc65-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769617187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617187, "uuid": "665b314e-385f-4505-81f9-8991390b8a00", "comment": "Malware payload", "value": "f83a923f757ee751c08c31c0dfe45037", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617187, "uuid": "f745dbe3-87e7-4161-bf59-45ff6d7dd150", "comment": "Malware payload", "value": "304cf8764dfe0284d46446cc462e8f46d9820e2413b1ef9bc463a4f7a96d644c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617187, "uuid": "d7fca714-4bd8-47d7-beb9-d6d465bade82", "comment": "Malware payload", "value": "1af2aea968a47e2e4599c70beb18569eb92e0ced", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617187, "uuid": "5a12611d-4ce4-4c95-99a3-d753dafea131", "comment": "Malware payload", "value": "791bf4549c03625ab545a58c6ddeb6ddc6f130ebc29f6c42b504840994ca51cc364e8f67992b19215ed507379024b944", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617187, "uuid": "f2e5686b-3555-4925-9772-b6b6bcbe9572", "value": "T1AB72D8A57B11EFA7C16DC23006F3C5965BD52E952AE1C089B220F71C1E3121D692FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617187, "uuid": "1edc62a3-3939-484a-b79f-a0379fc26acd", "value": "384:4HO/yWWOQvaA4pv6oYB6Aa8mOdIDSLBsDP9F:4HyhWOg1006N8q+BszX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769617187, "uuid": "58a219f3-8525-475c-bc44-60c98e9133be", "value": 17216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769617187, "uuid": "95490f20-6eb6-4028-aa8d-37c9aa06c75e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617187, "uuid": "453b31fd-c566-496e-a2e0-b5b6b1a4adbf", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e9c227-fc5d-11f0-a129-42010a9c0007", "comment": "Malware payload (PXRECVOWEIWOEI)", "timestamp": 1769614013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769614013, "uuid": "f2738ff4-3a58-48a8-b414-60c61760be95", "comment": "Malware payload (PXRECVOWEIWOEI)", "value": "858e4a615ab17a0692a6e4864f2a6a80", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PXRECVOWEIWOEI", "colour": "#E5AC15", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769614013, "uuid": "dde9308c-d09b-4c95-b3c3-119f0ab10c36", "comment": "Malware payload (PXRECVOWEIWOEI)", "value": "30d2391235b157a81c33a2a7716c3d07bd897b3d1cd663f24f9838ec3ac2eec3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PXRECVOWEIWOEI", "colour": "#E5AC15", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769614013, "uuid": "7e316562-43e0-4dab-908a-199cecc96cac", "comment": "Malware payload (PXRECVOWEIWOEI)", "value": "2024e3b09cd2dec4d76ed6f4df735ac114b9b84f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PXRECVOWEIWOEI", "colour": "#E5AC15", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769614013, "uuid": "92ffbf6f-09f5-44a3-bd98-e93eedda6ddd", "comment": "Malware payload (PXRECVOWEIWOEI)", "value": "eefe4c5483d1176fb0d26349ad54a1cab8b0a8c404c77747b92b1ea9dd193fd6b178a01d4716860126a838792df9e8ff", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PXRECVOWEIWOEI", "colour": "#E5AC15", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769614013, "uuid": "38919172-fe0b-49e8-8541-598ef7c53072", "value": "T1983517914334856C6D1A5346B300A9D8EDD1802252CECE6DA30E5BBFEDF3B51C3A5BB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769614013, "uuid": "3bd52cc2-dcc9-4617-a6e5-b34eabfe9b0d", "value": "192:HCBrQxeCgPML43WwLPqPR2kmXgRN0kRjRXRxRzVgg5oOLRamb2XK82799QKuN4vf:iV2KlQlx+lBZ4vsXw98LtUM9Rfrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769614013, "uuid": "4f54c4ce-27f8-4f00-a5d6-95163f1b4877", "value": 1142311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769614013, "uuid": "629b3baf-9535-4f56-a3b8-183b78eded62", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769614013, "uuid": "e3bf31e9-b4a1-4e2f-b1fb-e8a1b54b8625", "value": "RESERVATION_DETAILS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41663c5a-fc6f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769621521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621521, "uuid": "d8f982aa-a2d1-49cb-8af2-475765829d2d", "comment": "Malware payload", "value": "47294263985eadad7175407f44ec0e35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621521, "uuid": "0ace517b-8e50-4189-a415-4a2a47b742d6", "comment": "Malware payload", "value": "30ef33b23e72f75da78575331694fcfc0019ccce5384b6f97ef38d0f6ef2a66a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621521, "uuid": "276a33ff-ba99-4986-96b4-abf704e12855", "comment": "Malware payload", "value": "de78f15d8cd375772bbcb741c4b95cd25de6a9ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621521, "uuid": "d85b016f-fb21-4d55-94a4-4eab02804b2c", "comment": "Malware payload", "value": "8f2b3301ebc046d08cecf4317b37929a548a28ea329015f1818e27e59d42426dc1b68ab4ececcb75664119240be3701a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621521, "uuid": "071584a2-f96c-48a1-96ba-b04cbde25f6a", "value": "T197F312C90C20477F9BD43460797D57956E51CD7CAFF2E8A2C8DC10E0AAC611E3AB49B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621521, "uuid": "7a1b34b6-c49f-4fe6-a81d-12b96d89c7f5", "value": "3072:7+A/7KMH/87zfQz9Alf6UAsfFkaWeym4AQ32k5RkmQY4MRTd7XKVvHCTDq:6M+HO9AlCUAXzn2k5RDsMRNCvgq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769621521, "uuid": "02eae9b7-22a0-4876-a876-a055abede8dd", "value": 164805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769621521, "uuid": "5ac19f4b-4831-48f6-a97c-ca8ad6fa7eaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621521, "uuid": "3cf471e8-9ff9-4aae-a0f6-d92f1f3038e5", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "026b8d3e-fc64-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769616691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616691, "uuid": "51fe288a-1481-4223-84a4-12f5516f7b6a", "comment": "Malware payload (Mirai)", "value": "5f95f59eaa200adce53cb4533d2ed5dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616691, "uuid": "faab9e9a-53ee-44af-a1d7-0d124e72062d", "comment": "Malware payload (Mirai)", "value": "314d8048e47ac591eb9b5d9e34b30178bac5637cbee3f58f845334b3cc4f5d83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616691, "uuid": "f503ef46-c636-41d8-be19-358222d38af0", "comment": "Malware payload (Mirai)", "value": "35473c7e543e1537092b326f030130df5fabce86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616691, "uuid": "7187d49d-35a3-4ee7-98ff-dbd02e397825", "comment": "Malware payload (Mirai)", "value": "266c7e7276f9eedf33c6fe61b485142675bbc5958273a4d92aaf9661add7de4e3599ab08929af485ab60fd50ee2faccc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616691, "uuid": "19822862-8ea4-4990-943f-7c86f5581fdc", "value": "T12093F749FD416B10E8D635FAFF4F024973934B6CE3FA7201AA245B2123CAA5B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616691, "uuid": "e2bd9b63-8dde-4ba1-9de5-3142877b4aa2", "value": "1536:AanhE87HLYwltK8hljfyUgAaA1QQOauqKlM4Nvi/EpgTTKoZ0Yq0z:U8ow3Z7byUgAaA1QQOnUEpgTTKoSF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769616691, "uuid": "9b7dc370-502f-4dd4-908c-4fac030c55f4", "value": 93244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769616691, "uuid": "507c31ff-4b02-4614-90bc-fd3d95926bc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616691, "uuid": "15d62582-75ff-498b-a03d-8e8b7ad886f9", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649ce3b3-fc1e-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1769586791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769586791, "uuid": "1d8fcec3-5c90-42ba-a124-5d29ae814ed2", "comment": "Malware payload (AsyncRAT)", "value": "ab1eec51a74512e108080cf4768f587b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769586791, "uuid": "0ee4a9a0-b4d4-4ce5-ad6a-0d8de4fda9f0", "comment": "Malware payload (AsyncRAT)", "value": "31dae3d16305ba91009a29e4037f62c7e3cf444588ff388c45ecaa20afef4e69", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769586791, "uuid": "faae367d-0c42-40ec-821e-f3c36bfc0346", "comment": "Malware payload (AsyncRAT)", "value": "d7504b1033f868f563decaf4335bbf3d45252f58", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769586791, "uuid": "ec2ae8e6-9004-4fa7-be4b-878bf43dd3f1", "comment": "Malware payload (AsyncRAT)", "value": "65d157733fa4977963dedce0412035aed66e54c1569af1a1dc6d19b536adf97327cc753a5e5bb180da7a6a7661c25b22", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769586791, "uuid": "4320456b-0d00-4ad2-91b8-0ad34e1cdae6", "value": "T1C9D22A04B7E48A65E1BC5BB98D7292008376E9475C67DB9E6EC440DE6623BC9CE10FF0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769586791, "uuid": "60ffdbbc-c653-496d-b3a7-a687ef989e3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769586791, "uuid": "1ce0254f-51db-49f1-a250-446cf8be7578", "value": "384:VO8KXlkLEzwjSYp+QKIcjdh93buUsTQxnCJf+jJGIjJ0qoX/+:VO8ElBUSYsQK/jDRbVB/j+X/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769586791, "uuid": "a101d9ee-7767-4751-9692-d7d5084a7461", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769586791, "uuid": "15e69e5c-7b5d-4315-ba57-7cf47c3a9391", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769586791, "uuid": "80cf8e51-62fb-46a1-a96f-71785a2412ed", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c2d2cd-fc1c-11f0-a129-42010a9c0007", "comment": "Malware payload (Heodo)", "timestamp": 1769586125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769586125, "uuid": "9b5d7a1a-eeeb-41e8-a6ac-342666632554", "comment": "Malware payload (Heodo)", "value": "be9b0b43cd8eb7dc9bb1ca98783d1ee3", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769586125, "uuid": "48c8632b-ac9d-4159-b9c3-10ae72246c11", "comment": "Malware payload (Heodo)", "value": "336e78c28e49944b8297223669695b7560c1404c58b7b4fcd50f80cf6f69c89b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769586125, "uuid": "9f7bbfbc-4f14-4474-aa2e-c4e5fa8c7d2b", "comment": "Malware payload (Heodo)", "value": "5c458e4f1aa5655143c1f849b810ac13aa71d899", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769586125, "uuid": "37bde1dd-9444-44cd-9a7c-a3e479cd14eb", "comment": "Malware payload (Heodo)", "value": "d4e0bc8c97943a0264dd87bd3d473f88b0ccdb37fec560a239aa7f071ddf977077a9f154851eb85f6cce8404b3dad539", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769586125, "uuid": "b2095407-2d5d-4a55-8b02-c6129f771450", "value": "T145083358F1E90ED2A88CFBBA36039BD2C8C59ED61A6D94D1170E7E54F8A4D8F700F461", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769586125, "uuid": "947a0fc0-2bbe-418d-a304-f524cfad7ae2", "value": "1572864:LEq3hn1V95NVPV95NVYV95NVdV95NVdV95NVtV95NV1V95NVqV95NV4V95NV8:LD3XH5LH58H5hH5BH5xH5RH5mH58H5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769586125, "uuid": "0db198aa-f61d-4870-a3e5-ad0b0387ec3f", "value": 82752969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769586125, "uuid": "28fc5b10-eadb-4d3b-992b-91817c379662", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769586125, "uuid": "3d20c216-1d1e-4429-a324-72cbc18cc75d", "value": "Dokumentacja.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cb56057-fc88-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769632170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632170, "uuid": "4cdaa466-0e09-4fd6-8a68-1002f0b60428", "comment": "Malware payload", "value": "ac7284212f1d73e06889c31299cbce24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632170, "uuid": "d14fc993-f7db-4b09-945e-ead29b666641", "comment": "Malware payload", "value": "33961e7893f0e03b96850974db145e6917d06ba15b2428bf398a2df39f0c7dd3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632170, "uuid": "708c831c-6834-439e-90b6-8ec9d0e4a5ad", "comment": "Malware payload", "value": "1f1ffb42305f0bff003ab9465c0b67771b110af4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632170, "uuid": "5441fb28-d5ad-4fbf-921c-489fc242b719", "comment": "Malware payload", "value": "91b0cf8b61e9878db7ba869eb957775a543436273c6eb30fe135021dc6375dcc2674a0ac0b49569ec2bc4dd6335a16c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632170, "uuid": "fa5b3d61-6aac-4c7b-a0a4-9c05de80adac", "value": "T1C1C36C86EB43D0F0FA5A05F0206BEB388575ED310026AD5ADFF4FDB6AC61641625B72C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632170, "uuid": "5ed526a6-898c-4a31-98dc-61c285ee7974", "value": "3072:/nFO4wzeGnfJV6tgVI6W1WcmQyrD4Njw:/A4wzeSfJV6tsI6W1Wb3ANjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769632170, "uuid": "47b908d1-3fe8-4f32-a3ab-edb24ba88c92", "value": 123808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769632170, "uuid": "5e6ef944-2af8-472a-8838-f88956a04482", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632170, "uuid": "a6602059-1777-46dc-82c3-2489145e6a91", "value": "herios.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c6055b-fc56-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1769610684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610684, "uuid": "6c2a54fc-7818-4d4f-9e18-2854c4bdcbe7", "comment": "Malware payload (AsyncRAT)", "value": "f981bc81c17851fe484cab06bc6b9e68", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610684, "uuid": "7b99a90a-fd9a-4b78-9566-db41c06b7179", "comment": "Malware payload (AsyncRAT)", "value": "339d4048c2de701dc431af119bd3eb9c6737360cf7b00c11aca8409ce3ed8750", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610684, "uuid": "21369825-88c9-4794-9ca7-426a46733495", "comment": "Malware payload (AsyncRAT)", "value": "b735f7a16863641cdd42602de7eb1110805d3faa", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610684, "uuid": "2072061c-fa6c-496b-9642-d7c04d001d39", "comment": "Malware payload (AsyncRAT)", "value": "5c5ded18295eddc6b06edd7d412dfce4f258c70e700c68a6abe5147fbae2f6ba9ba1f8a2273599f4871c0d23d0e7c86d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610684, "uuid": "ec590bd1-cd2a-48f0-adc5-b6ac5a295060", "value": "T1A2C47D26A36401FDE07BC175CA924907E7B2F88A43719B9F13E15A921F276709F3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610684, "uuid": "5e233d4e-f882-4d04-8fbc-093321a5d64d", "value": "732b75baf88f2bf477b3ee42dbbe1d57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610684, "uuid": "6a57364f-c337-4575-a041-0c3b44787a9d", "value": "6144:u9RmAYTNmfyurwIFOL9Iqh5Nt/jxPWPVtnAwhaNGu7a0DK+4RtQstSJ4wQu6eqe:ORmAcsfykg9IqbVIazW+4c4SJ4wQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769610684, "uuid": "13201b4f-e639-456c-b4b5-bfda55c6f874", "value": 588288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769610684, "uuid": "9afc188f-765d-42e4-9225-3c6a64623f2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610684, "uuid": "d90a5934-6222-4e1a-9b8f-0ef12c2f77ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c874dbba-fc3d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769600273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600273, "uuid": "61a1f8b0-fd86-4865-855b-2e400285b1a7", "comment": "Malware payload (Mirai)", "value": "15cb0d553e4d502bbc5cd278dab93035", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600273, "uuid": "871fd9f8-0bab-429c-9a45-147a3edaba61", "comment": "Malware payload (Mirai)", "value": "339f93f38a57d167306494d9dbe28ab1217f8663f05355b393a90843ef01e7f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600273, "uuid": "652cc945-152e-47b4-a486-a8a4a0096939", "comment": "Malware payload (Mirai)", "value": "8d95911391377e089350aff53e9d5258aaf4ad4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600273, "uuid": "f953d2e8-8f06-4694-b6e2-3f341ee16864", "comment": "Malware payload (Mirai)", "value": "8f8ffce8b39edbdbf823ced81c415b7b17d9a86a0b3a755e0a2d02f6f31a5cdfc92a8b97a6ee3a1fae7d4554f0c8d0d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600273, "uuid": "d9389fc7-333b-4105-ba64-f87b4137fc79", "value": "T16AC3F80ABFB21EBBD4AFDD3745A50749289D554622B93B353A74D81CF20A28F19E3C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600273, "uuid": "41f2c7b1-a096-498f-8b50-0bc127a8756b", "value": "1536:ebmgc0+vNuUg2X5/amonJOtG3qX0U5qRYChMbh881+Bu1u/nSgDuZfqFX39wu7r8:e6xR+JOCjDw3JyQuZnPcKQ6huTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769600273, "uuid": "56f95bab-0cf2-47e6-b679-af40a304db22", "value": 122608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769600273, "uuid": "9f16fe3f-4fbc-453a-bd4a-5b5dff2c17b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600273, "uuid": "3f630d70-9aa4-4f4c-ac13-418c0aec4a58", "value": "splmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee7454cc-fc26-11f0-a129-42010a9c0007", "comment": "Malware payload (VShell)", "timestamp": 1769590458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590458, "uuid": "16b67d83-028d-4873-b028-374abb7cfa82", "comment": "Malware payload (VShell)", "value": "b5d65d2f9dddb6a9f3c955ff51f409f0", "object_relation": "md5", "Tag": [ { "name": "dnsuptime-dns-army", "colour": "#55CBAA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590458, "uuid": "80705efe-7eff-401d-b972-58da05fcdd9c", "comment": "Malware payload (VShell)", "value": "345f2f3d3cb863c9004504ae89954828057832d32488a278cb88940894a3c562", "object_relation": "sha256", "Tag": [ { "name": "dnsuptime-dns-army", "colour": "#55CBAA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590458, "uuid": "849710a9-b60f-4c65-a07a-4b88d9f68639", "comment": "Malware payload (VShell)", "value": "f300d14c76d3bc88862c70a61209d9886bf9c125", "object_relation": "sha1", "Tag": [ { "name": "dnsuptime-dns-army", "colour": "#55CBAA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590458, "uuid": "6185262b-85da-43fa-a06c-3d28819da9b6", "comment": "Malware payload (VShell)", "value": "e44f4498c41826517456ad1027b353de44f4441d80cdd4e8b8a302cfe3658cbf1b8e49b42dd3cf72a379ab2c053bc3a4", "object_relation": "sha3-384", "Tag": [ { "name": "dnsuptime-dns-army", "colour": "#55CBAA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590458, "uuid": "69d52016-dba6-47ff-8bdc-6bc313fba180", "value": "T1BB965B17ECA140F8D1AEE2708A629263BA707C4D5B3133D72F50F6642F76BC0A979B54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590458, "uuid": "5b6f81c0-2a41-419a-8bb0-2839e5be23ca", "value": "98304:T0v6hmir/Pc0YQbVnJLMwN+NbEZauDtY2Q+Z2/:BEkc/GVnJPHZauL2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769590458, "uuid": "7e9230a9-a759-42aa-80d3-c8959921fa22", "value": 9293824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769590458, "uuid": "06a2b941-4205-4e58-b0cf-0cc6ccccbbbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590458, "uuid": "7b442200-5564-4f1c-9a74-04d87ca555db", "value": "maild", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9fc51d0-fc2e-11f0-a129-42010a9c0007", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1769593914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593914, "uuid": "406486c2-0527-45a4-aa4f-d4defb85f5ae", "comment": "Malware payload (ScarfaceStealer)", "value": "251e2471f9005ed36c92edd49ec5a189", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593914, "uuid": "a0d133a3-b43a-40ec-b602-a81797f8ce16", "comment": "Malware payload (ScarfaceStealer)", "value": "34bf38875030dbee3e231dcfd05505fae829475e68dd2db2f0ec204593cd3212", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593914, "uuid": "5378b085-bd9e-45ab-8eda-16b6594ec9f7", "comment": "Malware payload (ScarfaceStealer)", "value": "efc831804bf7f5f1b22c3ef73530e34059f95589", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593914, "uuid": "dfa1d062-5a7f-42f6-aae7-f668750ec5b8", "comment": "Malware payload (ScarfaceStealer)", "value": "8c7ebb335a7214e4645c4fa3e40b1a05d2986959af647d4777906bb0bd7ecf13ff667b30db33dfa8a13f20e12f457396", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593914, "uuid": "a274e994-9794-4ab7-ba26-9e8829389efc", "value": "T17E266C53AD9449E4D4ABE339D8E212853774BC09073232C76F507AB51E37AD41A3BB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593914, "uuid": "b4279ce8-6235-43b4-bc2d-591b87887adc", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593914, "uuid": "d27f4b38-4b80-4143-8d41-3c14fd04dadf", "value": "49152:GlqL/dqN+r+v9+ptXV3atuXM/YE/811oOeLnQi5sII044Gl:GqQytE/C1oTUCq4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769593914, "uuid": "46ccc736-f1c7-4d3b-b7bd-b2041e324dfd", "value": 4578992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769593914, "uuid": "e5770a75-5629-4a52-888f-69452776e419", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593914, "uuid": "668569b9-c2b1-4fa3-b971-5bb3c926a183", "value": "AmongUsModMenu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca01dd8-fc9a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769640304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640304, "uuid": "c40c3e1d-ee1e-4ae5-aefd-acbbe2c4fe67", "comment": "Malware payload (Mirai)", "value": "5aa1e97d6dcd1b63d540ec033398d06b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640304, "uuid": "0b497179-55d8-4815-bc32-4e85527aa130", "comment": "Malware payload (Mirai)", "value": "350430cdd91a8796e3bd68e2eb2a0e9d7c44e4e434bbc645da507c5b3c3a1a01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640304, "uuid": "35630e31-66e4-4e19-a6ec-7828be3eda06", "comment": "Malware payload (Mirai)", "value": "e42028e4af5b131659cf0e002189e03e2e160fa9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640304, "uuid": "e9575558-d5c6-41f2-858a-132fcf9d8394", "comment": "Malware payload (Mirai)", "value": "e5639d273b7284590d67528a085f98d4304b004fede4a42a31156e3d11af43baa9283bb599ba935ca162cbeea6270986", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769640304, "uuid": "c7452a0b-5e60-41f6-87ee-2b1e38fd7eb3", "value": "T11AB34901B3690447F2A74DB1283F6BF593EED1A221F0F285694EDB0F8175A321596FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769640304, "uuid": "2204212a-75cf-4670-a65f-f9699dfa6a97", "value": "1536:M9zcHjOZNjcn49ekrLYIHiv29lqXMS0uwmyMxzaxVyePg0ay6arrGTqe+ZrX3T:zOng4NqvAMCC056Z6X3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769640304, "uuid": "311f7e1c-11a0-4033-b0b6-edb91b848313", "value": 110404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769640304, "uuid": "a9382870-9ee6-480f-8583-000cf9b0b1b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769640304, "uuid": "67b78aaf-cca5-4d52-a4f2-8dc993f1a623", "value": "jklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cbe88f1-fc5e-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1769614319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769614319, "uuid": "191d9bd4-5553-427f-8ef1-f8dda8e023b2", "comment": "Malware payload (Vidar)", "value": "b5d1f3283ea4d021f02dd7624735d4d5", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769614319, "uuid": "b4f71891-94d8-4ad7-9165-61eb3e714617", "comment": "Malware payload (Vidar)", "value": "3508e94df72fffcdf781c993a3b627674cb272126ab39e11b5f102eb6846474f", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769614319, "uuid": "8865ec68-12b3-4169-8470-e21d09595bb7", "comment": "Malware payload (Vidar)", "value": "6af93d2a9edf45e306c0a416068e7373930507df", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769614319, "uuid": "c0cc8a7d-7d6c-47cc-89aa-3d5a5cdd7ba9", "comment": "Malware payload (Vidar)", "value": "7b820d57737d07d8c1a2f980aa251b1f7ef0445adb4371790ac03d5861a5c4ae9c66330ecf728d71e5c3d1c50101f97c", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769614319, "uuid": "55e9586b-9cf9-4294-bcc3-7b923f2c8364", "value": "T1B2663A3B62A5812DC26EC23EC0A7CF40D9F371B51737C2E752A207699F569C19E3E261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769614319, "uuid": "01f96abc-cd70-40ef-8356-c916d42f79ea", "value": "9692762365b0d3385170e1ababcdaa1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769614319, "uuid": "8cace242-9263-4198-ab6b-e274e5e8ea30", "value": "49152:zLcLOnXF09KKdYbIK4KdgL7dPSXceQJQ+4KJL6gH4eY2FKTf5hQn23vhlkZh9k5p:Xswkn23pS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769614319, "uuid": "e1646857-100f-44a1-83ea-342da5aca7b5", "value": 6848000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769614319, "uuid": "5542a508-64ee-434e-9544-6455aa8eb7fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769614319, "uuid": "2abd56d4-1283-4cd7-8b76-7f4bca72b1a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ef0c939-fc64-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769616927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616927, "uuid": "97a67bd6-2e93-4d8d-9bbe-1fae97d1cb63", "comment": "Malware payload", "value": "4ee00f36e317c6a2008e5f49e996b369", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "niggaware", "colour": "#452BD1", "exportable": true, "hide_tag": false }, { "name": "Stage2", "colour": "#B66196", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616927, "uuid": "41afc945-28c2-41e4-80b7-f471f837386a", "comment": "Malware payload", "value": "350b1b7f1556a04e33dfbde3354b02d907e67e9c00d73c79670ea5e20f0bd1bf", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "niggaware", "colour": "#452BD1", "exportable": true, "hide_tag": false }, { "name": "Stage2", "colour": "#B66196", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616927, "uuid": "40225acd-3aa2-419b-9a9a-9ad34c8d881a", "comment": "Malware payload", "value": "447faf3ae066a88e040a46b5efb1d689663e184d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "niggaware", "colour": "#452BD1", "exportable": true, "hide_tag": false }, { "name": "Stage2", "colour": "#B66196", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616927, "uuid": "ee6e5709-5700-415a-8f3f-6c3d4bd4cec1", "comment": "Malware payload", "value": "34e021cf58e1e7756ed585257cf77e01ab18c08063192c80bb8b7c60f9cb7ab55e5badd44fdced005c91e7ca06bea3ba", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "niggaware", "colour": "#452BD1", "exportable": true, "hide_tag": false }, { "name": "Stage2", "colour": "#B66196", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616927, "uuid": "da626177-1eee-4c4e-baaa-ddd9fb05a7f2", "value": "T1EC472363A9D9D939EDBB21B261C201A3753F52EDE40B80290AF47DC69933D0B5F507AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616927, "uuid": "9c9653aa-9ffd-4641-8598-b15c08e8f9af", "value": "786432:Mz2zOzw7YPCJKS6Rnc0rmrq6A09OAEmslXXc6d1h:22asqWTuc0rIq6A09T/sbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769616927, "uuid": "67c98652-30b5-4cb4-ad09-575d4b897f51", "value": 26420408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769616927, "uuid": "2a936ee8-abe1-474a-9433-924c1e4ebd16", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616927, "uuid": "95a67e3b-5558-4bea-92bb-bc030e4c0380", "value": "optimizer.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3b59b9d-fc6e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769621391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621391, "uuid": "93fba5f6-f426-420f-b3c0-b1d271cc0c02", "comment": "Malware payload", "value": "36e641f6f5aec5f0a787202e18fd9d69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621391, "uuid": "ba475bd8-c5b5-408a-94f0-220e1f9129c6", "comment": "Malware payload", "value": "36f43124c47cc2ad5aef5bee90be2760d5f4965af1c6c78756e1e2feab1fb33c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621391, "uuid": "24306725-e3a9-4846-bc33-2367f36effdc", "comment": "Malware payload", "value": "a197a884584ab335e0468f37894a14fe909c39e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621391, "uuid": "06e9ef56-b1e3-47d3-a92f-243b8e82ce9e", "comment": "Malware payload", "value": "647ea87fe61aa844fa323b66b7279e846d1e4d6083ab579cdebf75922ad4d05e78690be7a56b8973da2ad07628978174", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621391, "uuid": "4f94e3b5-b7da-48e7-9668-995a2da8704a", "value": "T1B4E31945FC519B16CAC662BBFF4E428D372A5768D2EE3203DD256F20378B95A0E37142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621391, "uuid": "fd716be9-f60a-461b-99e2-74600b4695b1", "value": "3072:Le4xyQkeipAxA66jn0p5BPGK4NErAn7cwVMLopy7K:q4xyQOpAxH6SneK4+rA7cGeok7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769621391, "uuid": "977c8fbe-d3c9-4315-8024-ef21db6a26d5", "value": 150232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769621391, "uuid": "69f99507-409c-4668-83a3-049572287cd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621391, "uuid": "ea953bd6-ecc5-4e7b-b107-1a47eabe1eb3", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d247e2ec-fc40-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769601578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601578, "uuid": "29bf351d-0082-4a70-a4c6-ade78250ef93", "comment": "Malware payload (Mirai)", "value": "d1c747e92d65227662a7b569b274dcca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601578, "uuid": "55421622-8bdb-4c32-bf5f-0e482a83590d", "comment": "Malware payload (Mirai)", "value": "370229274d88299cafc47bacd0e23ec2d9a7f4c7e552232cc6f53d7f200b0c78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601578, "uuid": "49f5bc84-34ed-4d31-b2d5-b1576b25ea80", "comment": "Malware payload (Mirai)", "value": "3ab8920f9ae6db83aa529fc8e1fc36917aef2e22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601578, "uuid": "d2a24094-4a7e-4c05-9cc3-ee00b73b6bfa", "comment": "Malware payload (Mirai)", "value": "b5cc7a3d858757b305b37c19047672c7322b24cd6a2e60683c93de023030b589dcb036d5740950bda97370b311d8a311", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601578, "uuid": "f829db21-04e2-4968-b43b-8689b148819d", "value": "T17B834A4173690447F3A74DB12C2F6BF193EFD5A221A0B289694FDB0F8175A321586FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601578, "uuid": "70680d6d-1874-436e-aaec-51114a87bc4f", "value": "1536:J2Ia6f5HbO76vA2NUikrLYIHiv2r5fFJQAgN8g7hL50aqpaRqcG5HXT:cEFO7gAJzf3jgx5xyXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769601578, "uuid": "3d16c3f7-3660-4634-9ddb-8c89043a6082", "value": 88436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769601578, "uuid": "30261c48-492f-4ab0-ac7e-329623f9584b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601578, "uuid": "8a9ed837-e41d-49c2-a446-59c05d222eff", "value": "zerppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e926b9e2-fc3e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769600757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600757, "uuid": "89b35a60-dc6e-4078-a8d1-d8675b16be57", "comment": "Malware payload (Mirai)", "value": "5d3b402437e85e35de75fe27a5269d48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600757, "uuid": "df79a349-49dd-44c8-ada7-e9d241972793", "comment": "Malware payload (Mirai)", "value": "379e45edefa23373e47f94f29346f8a0085b695c9781f6c200f7c79dd2e9fc92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600757, "uuid": "9c387778-b8e8-46b7-aadd-e48234c75baa", "comment": "Malware payload (Mirai)", "value": "a9681803f9e9670576293b1d041600f6f340ae4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600757, "uuid": "a7976dc9-1a87-4682-a9ae-cde132366c9e", "comment": "Malware payload (Mirai)", "value": "c7059f245fb96d42e906eaf83fef454569324ff5211a95c3853b29801c510969cfc6439b9532573db9beb94dc47a87cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600757, "uuid": "75aa1666-89b6-4152-b407-1fc92e2b4167", "value": "T13A933A25ED391D27C5D0723B51E34A30F5B6439926BC5A0F7EA31D9CEE14720313BAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600757, "uuid": "86144103-7555-490c-bfd9-a0f6dd7fe9fa", "value": "1536:cAovE7G2HYpXOn9rhMsomDOsHgD9sW4blBrgiNMSnj:BkM5HYperxqKldtnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769600757, "uuid": "79402be1-492d-40e7-90d9-1e35cc1345e2", "value": 91536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769600757, "uuid": "4d40ef73-a8a2-4a57-8219-c4ab8d2ef720", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600757, "uuid": "4d38798e-1083-46b2-b4d8-dbab6a94df2b", "value": "zerspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2728de7-fc91-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769636341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636341, "uuid": "42011ee0-cc04-457e-91a7-7e6498cb8b79", "comment": "Malware payload", "value": "e07d066e50ba5a716fcf2e54cddf0133", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636341, "uuid": "33391886-ddba-47d3-a337-6ddb78576cc5", "comment": "Malware payload", "value": "3856e9afc74e6993c4b1434efe71e861182250dd7e574431eeb103af5d4f6bbf", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636341, "uuid": "55aec818-d804-427f-b6bb-8fa8f1c6b64d", "comment": "Malware payload", "value": "e4873c6c30119caa715a75b543b6052ed516ac2e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636341, "uuid": "6fee247d-7a66-4fa5-8b1f-2c97e55eba5e", "comment": "Malware payload", "value": "caaa1d99e35e0653f8cdab3b2e60182389df64e140728abe942f9f8675216a8b7f8c1075c46249767e47a92d0a09b35b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636341, "uuid": "ccbb241d-e099-4822-962f-b906ff28cc48", "value": "T1FF336333D410FE0641A1EE55A2799B04D672D97748AC6418B60C4E4D0FCA9EA3BBFF4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636341, "uuid": "7281f3e8-8633-4e32-85fd-dca9370f512a", "value": "1536:CcHg5AjywdIDFSD4zNq94AbluKlAGRhl0IG0O1kA:C2tN/NOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769636341, "uuid": "3964a224-d0c6-4c4b-81de-d3fb18ade89b", "value": 55045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769636341, "uuid": "b8bb43b9-1cbb-46a5-8450-52ebb47fc03a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636341, "uuid": "1fed96ac-6c76-4aef-80f3-9dddd155615f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "921e7fe6-fc45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769603618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603618, "uuid": "0f202b10-534c-4ab3-9fda-57990ada9ace", "comment": "Malware payload (Mirai)", "value": "5a70bdadef3b74d5bb247e8b421c7b4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603618, "uuid": "f4f59e1a-0471-4479-9aa2-6576037d211f", "comment": "Malware payload (Mirai)", "value": "385be8f5c4239f7c481b72857e369ed7e30c3c8719ac26e11b5f87401d51f2f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603618, "uuid": "e9f59c6b-f2bb-43f3-99d3-55a48b52a702", "comment": "Malware payload (Mirai)", "value": "343d9d719e4a24fea6c35384f19b0bb4c74f1ab8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603618, "uuid": "153a4efd-e46a-43cc-8515-e499dac9cb20", "comment": "Malware payload (Mirai)", "value": "f8652509656c369b470dc484b1496650afaf6c8660dfe11b88ab27290da24d0bc935cae9ff2f1ce848b46ab683fa202c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603618, "uuid": "f828963c-6f2a-49d9-b570-1a1f6f19d534", "value": "T1D2735AC0A242E8F5ED490174617AF7377632C97841B8FEE7F76816724429AA07287B4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603618, "uuid": "e99ef2d0-c8ce-48df-9d7a-b169b39667ad", "value": "1536:6I2dsYevOUPfCs8C2kdgxULRt24TU09/FLCREpgyUdNKFVaF60HXWcs:5ohs3nCsb7pRHTd9/ZCRO50gbYpZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769603618, "uuid": "0d13fe7a-1819-4759-89bc-65773ad63603", "value": 79028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769603618, "uuid": "033d79f7-d08a-4355-870b-1ff418680863", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603618, "uuid": "7269bc08-501d-4d1e-b8d9-1a9d0c5aecd2", "value": "nklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b76a1b62-fc6b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769620001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769620001, "uuid": "72c7b004-97b1-425d-81f2-eb748047d605", "comment": "Malware payload", "value": "b0f20bc99d8e460d5daba898b983a18f", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769620001, "uuid": "71d1218f-90b0-4936-addc-ee4b98694c84", "comment": "Malware payload", "value": "3874ec28eecb895c2d05a58c3c96adaa0a8cf445c8c9fb4e5c638adfd392f966", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769620001, "uuid": "1fd959f4-88ec-4960-96ff-f7dda52e979c", "comment": "Malware payload", "value": "8814a042f52de912c3d7455ce960ff745b35c4e5", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769620001, "uuid": "0b373679-9f98-4632-a424-0fa1d2b0f7b7", "comment": "Malware payload", "value": "bf2d8c1191c971627b726a092a088950e88b96382dd1cf7862888898273129180ae4052f70f69f330ef8246fa6d2733d", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769620001, "uuid": "b59fbd6e-52cc-4d66-9aa5-00264b512e7e", "value": "T1AB233B01DA009EF2DA7F63329C93581496A06B256B34261F31CD6E9E3F75391CEC12FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769620001, "uuid": "6d6b2a10-adf3-45ed-9a44-cdd6c41c4534", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769620001, "uuid": "065f3fb4-1d77-423a-b98d-c4bebf1d8741", "value": "768:K9HkQk6rQzzh0nGDiYKzjG4SENEnrK01950nLrLBS+j7:G9r00nGDiYKW4SEenOU95d+j7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769620001, "uuid": "1a8c22ab-e913-436b-ba71-006b9a65d1ed", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769620001, "uuid": "dba60ee4-c8f8-4a07-a4fc-bbe26e803e91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769620001, "uuid": "336f8133-93f7-4c88-bd47-b768d3680161", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c11a05-fca0-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1769642675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642675, "uuid": "ffa7f5d0-ef5f-4305-a3c9-841a2e9a7119", "comment": "Malware payload (CoinMiner)", "value": "ed8371ab50bcab2f954c110a5233b2d3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642675, "uuid": "c7a6c263-e893-40ef-a001-578ba2d30d0c", "comment": "Malware payload (CoinMiner)", "value": "3959c2dac290fdcf6dbe84a8571fcbdb9c2527cb6e894c873cc2279f0690856f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642675, "uuid": "a5171a7e-79b9-42b1-b4de-56c308f6400d", "comment": "Malware payload (CoinMiner)", "value": "a90f1d1c7977b92bd59f513ca6b99de16fe19bf3", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642675, "uuid": "5156e223-6fcf-43bd-ad16-05d7cf33babc", "comment": "Malware payload (CoinMiner)", "value": "f89d39ddfba064e1400d0a15ca26727bfd339b0296268700b64bf487570b45996be8de5e3a09e85b7f613792de8cd159", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769642675, "uuid": "79c9b516-fb9c-4fc8-9971-d22cb9c19585", "value": "T1F2873344FB2666E6E62695394422D2F31B93B8E43B4852CF1B7EC6110F0B7D0DEB8761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769642675, "uuid": "8187466e-451c-46b2-8c2c-2f971d801089", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769642675, "uuid": "047fae93-532c-4bd8-b920-cb2a62e3b506", "value": "786432:DfyGRcui3NVaPvC0kqzl0JINorknVlEWunU4CIzjMEfhWyVm2Ez:DfZDcVQvtkq50JINEDoI0EpWyVvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769642675, "uuid": "94d0fc0b-88cc-495f-b0f2-00ae161df886", "value": 36984371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769642675, "uuid": "ad1dcf49-df8d-4d62-82bb-901efa686582", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769642675, "uuid": "90bffe64-650d-4d32-903c-23b3eacc4966", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e81aa3e-fc88-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769632388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632388, "uuid": "1abf178c-9c14-4634-8889-7cb7f410bac7", "comment": "Malware payload", "value": "37e410c17da99f7d2797e59727803b05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632388, "uuid": "bd2102a8-89d8-4994-bef2-aabea22649f8", "comment": "Malware payload", "value": "3aabfdab06c4f70a9f4ffb660947a6ac15c06595f26b1c27dbc578406407cef3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632388, "uuid": "c52801ee-f8a2-49da-a9bb-bf679fedd611", "comment": "Malware payload", "value": "b052d5573955143eed72aa9a18f43d84b4ec1200", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632388, "uuid": "af4a32a3-0385-4ba7-a68f-3b8af087ad50", "comment": "Malware payload", "value": "f79d69cba09b0df613f87c1db85e1f676a61072238dc756ba80590cadfbb32e4130353407d9171f91ea5d09284dff50a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632388, "uuid": "27eeb058-c5b8-458d-9a85-cdadb9619bc8", "value": "T166833A229A78AA2AD0C0F13715DB0771E4F70F8625A09B6FAC644C6D7F2E3C41779761", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632388, "uuid": "5dfc9c03-3c36-4290-b14e-a6fcf77a22ef", "value": "1536:W1nBeSO13XfAH/E0xBA9vQWmHZzJNqlAFmI9NTAr6:W1ne13A/E0x+pw5FN9Ne6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769632388, "uuid": "e4571eca-71e3-489c-afcf-c02133003496", "value": 84800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769632388, "uuid": "9836d099-288f-49b0-ad67-87c67f9c06c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632388, "uuid": "1bf2fe24-fa77-42cc-a336-d313e246c439", "value": "herios.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a8f5bcd-fc4a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769605592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769605592, "uuid": "401cae24-22cc-4885-af35-6a76420dc794", "comment": "Malware payload", "value": "0cb5c8b0b6ceaea2b27a5fa230cab60b", "object_relation": "md5", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769605592, "uuid": "f938eecc-5f51-48b4-aa73-d26074253579", "comment": "Malware payload", "value": "3ab9eb12e5f75cf27bfff20847c4823fbbc0be089852566d8948e45b3277c82b", "object_relation": "sha256", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769605592, "uuid": "f715b356-8655-42bb-86c7-5f9abbeccf5a", "comment": "Malware payload", "value": "35ea62531778f5d11916cfcf9d11d4de302b8aee", "object_relation": "sha1", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769605592, "uuid": "cf5c90e5-1297-47e4-94e3-a2b879ed075c", "comment": "Malware payload", "value": "b63bb24dfe1ff6c9a4572370fb3937d04eb628f81d393f106fc2ae86e4e9e76720d362baafac58c36c4524b5dc6a8818", "object_relation": "sha3-384", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769605592, "uuid": "bc1a38c3-3089-446f-90c2-53fc60943d57", "value": "T1639733816A5256D3FE777630F6B12778436441248A75CEBBCD0C03D92AD3FC5ABA092E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769605592, "uuid": "e55835b9-d74c-4b26-a7f7-5177002183ca", "value": "786432:N3TWPxSwZzOnxHQuV9luSuE1WtYWh7o/mbe3XV0dXaFs6g83BlrAF:BYxSwxOnZQu7QhWWJougF0dqKQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769605592, "uuid": "011be042-5242-4324-a0a2-1c0126c6b560", "value": 40242750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769605592, "uuid": "342ea4cb-72af-48be-a4db-9e314c77fe63", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769605592, "uuid": "1a6b63c2-d39a-4ca3-bfb5-48aed7e5b7fd", "value": "limit", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c3d9dcd-fc1d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769586267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769586267, "uuid": "ad1d4424-c386-4dd0-92b8-92b2e25c531d", "comment": "Malware payload", "value": "6aca4593d9588d2970293f9a679f9dc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769586267, "uuid": "450958f8-c057-4b90-8868-34bba2185f0d", "comment": "Malware payload", "value": "3bd237be22b35f2e662c6c2add6aaf3f5847a07a1030d64776b9239cc5073fdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769586267, "uuid": "9c7e2fbd-c693-4ca6-86ec-5c1a13d5d9d6", "comment": "Malware payload", "value": "b6215af086f4b681b59dad22a0b68fce9123b773", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769586267, "uuid": "598c71d5-a878-40d5-a166-ed9795617df1", "comment": "Malware payload", "value": "ce7512c89580551a958eb16213664bce08d12789e4e4301af26026cae9f595c7bda9e6c3a2f3a29cf51e27f9dd4cede7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769586267, "uuid": "94627062-615a-424f-8e53-74fc34e263fa", "value": "T10716BFCA92AC41D4D9EFD079C107490FD7B2F8558231938B45B44B8BAF771328E2E7A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769586267, "uuid": "2b871363-8c23-47be-8c6c-c15161c38766", "value": "315909e07c935b7298339a8dfc4ff685", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769586267, "uuid": "40443b31-5c09-463a-84e3-7b4bb8dc70b4", "value": "98304:51E6j/B6SuKPz6MK13fwjL1HV6rol1P9o2xaN:cA4SgV1vwtH22S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769586267, "uuid": "8a302b4d-3cb0-4f64-948f-57a3a4bfb6ea", "value": 4166411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769586267, "uuid": "623f2041-ad1b-476f-ae0b-d059525cb976", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769586267, "uuid": "1b2caac7-9736-4aea-892c-6af6a9eaf991", "value": "image_2026-01-23_888-888.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a1f3c6-fc6e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769621151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621151, "uuid": "0d6451fc-631e-475a-90ef-6482a053ba08", "comment": "Malware payload", "value": "f2d477a844e685be83118396709f281f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621151, "uuid": "7f4ab2b6-c019-459f-b072-804cfc2f7ac8", "comment": "Malware payload", "value": "3bd5484954ad2efcdc3c2dd108d12eadab50841926d244df052df20171fb3282", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621151, "uuid": "26169061-4f2f-4cb9-8d2c-0167662060b1", "comment": "Malware payload", "value": "916fe20a24747d0cd52441a30d41c8831f373625", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621151, "uuid": "4a9f1d84-1041-4a45-aeef-797cad121419", "comment": "Malware payload", "value": "85ffeea772011f3b9076dc72453e248ecbd34a1cb5b247ad97f0f07ab342c89738e0523e142ee75c5805fe98d4f7146f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621151, "uuid": "f9fddfd2-dc2f-4132-9699-fc95c062be79", "value": "T1C952D81B96FC0269F1BE0B3C6976462407BA7D430E76DA5C0B88945E1F63790C9A1BF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621151, "uuid": "1cd981c2-4e1a-4fcb-a852-3e62b9a96a95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621151, "uuid": "d9e9842a-e87d-43c4-9169-795a93ca9eb8", "value": "192:7aNu72XzsOWtdAjWaDDyPy4njdlGrAHpZO8O0afnRyUDUCBkH:xezs0jW22PhJ8rqZO8O0afnt4+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769621151, "uuid": "56c32ca2-e656-4bb7-a511-8d000b2dd1fd", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769621151, "uuid": "d53e7c42-cdae-4913-9c4c-6e053c140dc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621151, "uuid": "3a4327fa-7bef-426d-93ce-6e3eb9403cce", "value": "SecuriteInfo.com.Trojan.GenericKD.78672759.27260.29468", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f01b54f-fc9c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769640925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640925, "uuid": "ead4347e-1e01-4d30-947c-918f413e7ddf", "comment": "Malware payload", "value": "72fb3ea6742453d6af42fa55355bdb79", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640925, "uuid": "418103d6-7657-43d0-a3af-17f20c374446", "comment": "Malware payload", "value": "3c95be1a7b69293c941e4fc0633326df8cb5b5e1abe3d1f76ccd9fa7cccb3a44", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640925, "uuid": "3fa42844-0839-404d-8b8d-cfd2a58f48ac", "comment": "Malware payload", "value": "047e2d87f4521251da88a531e8559cdb2f804526", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640925, "uuid": "dae0539b-44cb-4c68-8338-e68635e44c19", "comment": "Malware payload", "value": "6840e6c55158b53b5155f2d9cb4f60be0c237828bae29529444ba9f3b02c3e86816c7d8b2745e7c8b559b79bd06ec439", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769640925, "uuid": "97072ab1-1546-4f84-9097-d4bdd313831c", "value": "T144336333D410FE0601A1EE55A2799B04D672D97748AD6418B60C4E4D0FCA9EA3BBFF4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769640925, "uuid": "2afe63a7-7ce9-4a72-9227-96ec349ee78c", "value": "1536:gcHg5AgywrIDFSD4zNq94AbluKlAGRhl0IGGSOP:gttN/PSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769640925, "uuid": "6249fea7-b347-4f75-a110-d70e0d2a62fc", "value": 55015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769640925, "uuid": "6526a425-c59b-40f6-a1b6-48d5d185863b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769640925, "uuid": "49569e8d-93c3-4b8c-989c-ba7470e3de35", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e896b6-fc7f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769628392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769628392, "uuid": "a177f22d-11ba-4838-847e-2d129ee0e9f7", "comment": "Malware payload", "value": "9881297b86b2522a7af9c3f0c669c9ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769628392, "uuid": "b2a91aec-a313-437c-b8cf-60ab6226ff9d", "comment": "Malware payload", "value": "3d06251735184814c5eb1f1b3825ee005073e1e53cbbd4ec01d2a44c2e603315", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769628392, "uuid": "d5d0978f-c2ff-46ab-9196-8a5f31c36dc8", "comment": "Malware payload", "value": "78ca3c6b134d5ff36097f26a24eae919755b4446", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769628392, "uuid": "0d6203ad-034a-4388-a583-381173042807", "comment": "Malware payload", "value": "3a55faee07edcd39f4653a4fd2e18be791dfa6570377ffc2dfba6b7733582d718551b719d73c854f725caf0cd801e017", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769628392, "uuid": "f8c577f0-a998-4d66-83ff-038eaba6bfd5", "value": "T146E46B16E6E401B6E167D13889935A66FBB6B81503219BCF07F063772F27BE05B3A710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769628392, "uuid": "02fa961b-3bef-48e1-9d13-84032367f7a2", "value": "0fb986b0d1f788551cc587be5740c379", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769628392, "uuid": "1ff04649-afe0-43dd-a2bc-2ffd6d8fb2a8", "value": "12288:7uKlfzxRSgKL+IDV5PsS/IGCPX9awUcH:7uof+PLpDTeGCPXAw/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769628392, "uuid": "c25bfed0-b768-4f02-aa4a-40c0e3ebe1db", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769628392, "uuid": "a276c361-2fd2-4b18-8471-2412dee6ad66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769628392, "uuid": "8449249c-88fe-493d-9f30-78f2a7dfe6ba", "value": "ProtoInputLoader64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49e94391-fbe7-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1769563124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769563124, "uuid": "4277f60c-6936-4f7c-be7e-041eb46a9136", "comment": "Malware payload (Joker)", "value": "70c9a95f065473bc5eddc5c7d92df676", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769563124, "uuid": "debdb366-7a0c-4a39-95b2-a5d6b0c79a80", "comment": "Malware payload (Joker)", "value": "3e700f5772e75eb7cc72c80e16266e547807377f2b9612b9fe9ee0293d5c0def", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769563124, "uuid": "37187e57-50bf-4eb7-9e09-9c7c75bf266c", "comment": "Malware payload (Joker)", "value": "0985e808bcbb21ba349893ef10052007eaee5bae", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769563124, "uuid": "732a30c0-39bc-48b3-a325-c5c854cc8a84", "comment": "Malware payload (Joker)", "value": "dfb6441cf2d8564d82043756b5ea3cfadd3adcdf506d25b5bb2eec79029a101b1a689c0ea69c76dbdd0fc1086a6b0bba", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769563124, "uuid": "10c6a776-f3ca-43dd-99f4-9f5cca610191", "value": "T1A3C61209EB0CA81FDEF6B0799F18C1A3703AB05A8550C34B6924855EFAC77C45EA7BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769563124, "uuid": "f6fa79cf-161d-417b-9df6-69a55b9ecfaf", "value": "196608:pVe3i8JpyxVVIpI/R6NmxkQpXwXiixJwD0rYyweP7eo/rdDnT7OXV:OiCp27KKxXdD4YyBrdDnT7WV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769563124, "uuid": "7e6c6fe8-37a0-467b-aedd-e9fc782a6680", "value": 11664285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769563124, "uuid": "6b5cfc36-8332-4b95-bf90-ac1270a3d2a1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769563124, "uuid": "3eb4b0f8-65b5-4546-96b4-421f0c8f329f", "value": "Private+Chat+Message_1.0.12.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d4435cb-fc7e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769628064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769628064, "uuid": "89c71f21-762a-456d-b49c-113dce818997", "comment": "Malware payload", "value": "6b921836f458d5df0e13f0681d987e6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769628064, "uuid": "1eb0be73-6c6d-47fa-a601-c1f9ddc01ea5", "comment": "Malware payload", "value": "3ed85c60a5587bcf3c5c7cffd46c90491dfc3e3e74f91aac3f91c429a63c1792", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769628064, "uuid": "530f7ed9-53c6-4085-99fd-8bbdad555a15", "comment": "Malware payload", "value": "b46651d72a79ee7b925961d51fc81272dc19f379", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769628064, "uuid": "8754bde5-14e1-4b1d-b812-045ae8a6e1a5", "comment": "Malware payload", "value": "e90d77a016cc15e6b0942a8746ff223909e7c04ce260be85712864eaec3415c47c0d5d0c4365848bfa8a359161f94862", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769628064, "uuid": "7f98e4e7-ea31-4109-9741-3b4e1958c9e6", "value": "T1EFF4CF0413E88648F8BE9B349177371147F0B41AD97AEFAFA3C460B91C36B949697723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769628064, "uuid": "7c68e41d-71a4-4b0c-a0d6-dd01ba734087", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769628064, "uuid": "db2cbffd-760a-4ff6-a151-73e812a915ff", "value": "12288:HtDuCnolCsoYdAA9mJadBeFZYBpqEC1xv0oi7QcKRhktfzwLM:HVufMs1hsAdBen2pqpPPTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769628064, "uuid": "bbcaa1b4-99ed-4cbb-a34c-f43467945716", "value": 755200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769628064, "uuid": "2de4f440-0739-4568-aa11-57c5238d9f1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769628064, "uuid": "4e25e533-5701-4306-92fa-f427d03b631f", "value": "RFQ_QUOTATION MTG-189-89791.pdf(93KB).com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d756d0b-fc35-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769596657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769596657, "uuid": "6fa8ff4a-615a-4bf0-a997-ba7456ab5c4b", "comment": "Malware payload", "value": "81c8271cd5e161174675fb39f1a54aef", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769596657, "uuid": "e81dfb0e-4a74-4d45-a074-6d72a4d9f6d3", "comment": "Malware payload", "value": "3f015d491145c8cee52a261b9a0b4e057f5d685859615528cd572b75fdbc50fe", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769596657, "uuid": "640dc27a-b80c-4b55-b912-241175586571", "comment": "Malware payload", "value": "e0ff7a4828bf9c6cd61d0a6b07b838047b23cedb", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769596657, "uuid": "de1409e2-f87c-4318-afdb-3cb2754eea28", "comment": "Malware payload", "value": "e376bad47e3074701d9cd369abbd9b7e6c76ee96d2cf0494bb4bfa71f3cdefcf0e72f52b2add8e667341e212b97b7f5f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769596657, "uuid": "f65dfad7-9846-4d65-a8f2-62ab39d6cacd", "value": "T114283356F2F901E8E07BC178CA5B5617EBB23859172097DB12648A692F37FE05E3E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769596657, "uuid": "8e755c9d-03fd-4852-a5f3-e69b974eb5a9", "value": "b5d3ce44460b794187f3e238adc502a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769596657, "uuid": "f5ae0766-088d-4333-8112-c92305170733", "value": "1572864:j6k9nV91g2XPpNqt1R7ySDZJKXk1iRFVsasl3rmRqfGzA+e4iUT2O:jVP1g2RNy1ASDZYXkCFe53S4TpiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769596657, "uuid": "a91a108a-fb3e-484a-828e-7df5a5ca200d", "value": 96007869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769596657, "uuid": "d0a14b1e-1c6d-411a-b0e6-774b44fb8fd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769596657, "uuid": "f91227c3-e36b-4bb7-9efd-2454ed94134e", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d89268bd-fc9b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769640673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640673, "uuid": "ffb5fbf2-4975-4329-a272-2f8773d95876", "comment": "Malware payload (Mirai)", "value": "942df14331f848e48271d4fa934c373f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640673, "uuid": "d8e623b4-e420-4c33-ac5f-4cc9865e6e70", "comment": "Malware payload (Mirai)", "value": "3f0d64a6bb8e252e6b43d084b1e178a08d3c5dbe004348c3b8d49c2d8e42d08a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640673, "uuid": "c40ce85d-2b4a-47c7-99f9-6bf2946f2d7d", "comment": "Malware payload (Mirai)", "value": "f00c8dea1ff2c7ae9e1f75223abf5b6bb679bf92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640673, "uuid": "bf89eb78-18b4-4d87-87ee-b4a00677ab26", "comment": "Malware payload (Mirai)", "value": "6346c523c84fcedde75a418fa8d1448b762b8b223b5ff54c945ffd46631fc3564c86c8fabf4df282751741a254e7b6c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769640673, "uuid": "112a90fe-3d22-4f28-8da9-b63eabe96f7e", "value": "T180C31B96BC818B11D5C115BAFF1E518D33134BB8E3FE7213CE185B2A578A86B0A3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769640673, "uuid": "c619ccc6-133f-4bd4-a6f4-6e1b9760cb4d", "value": "3072:HKGFvdboY3Y5EU3fmrXdKkjeUFXja/0ybK/uz8LvHuWW0PXA:D3U+rXdKkPja8cK/bvOwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769640673, "uuid": "a02d6919-173f-4202-a1a9-d929fd1e1469", "value": 120192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769640673, "uuid": "016fe6f2-cf3a-4dcb-9e27-cfa962ffa3a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769640673, "uuid": "d644f9b4-e13d-4f22-ba43-884342ec23be", "value": "splarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a10f8b7c-fbe3-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1769561552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769561552, "uuid": "f6f2392d-19f3-4946-99d4-1dc6e991a883", "comment": "Malware payload (SnakeKeylogger)", "value": "6b0109b07e37e6908df413622d9ec765", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769561552, "uuid": "32cf45ec-d390-4505-b8d4-32ff06c6272a", "comment": "Malware payload (SnakeKeylogger)", "value": "3f30eb884452a6b86c47244eaaf528b7e517b6ac85a6c85099e57d7c69fd944b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769561552, "uuid": "299ee38f-9951-44f7-9fae-b07a83206beb", "comment": "Malware payload (SnakeKeylogger)", "value": "b16a19ee0c5d2af86b30cdaf4c3e9a3988824246", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769561552, "uuid": "21f9a13e-a5fa-40f6-8fcd-f7a3623623f7", "comment": "Malware payload (SnakeKeylogger)", "value": "0abe1d030e8ae72d98aa2fcbf5210cb447f6d391e23fb6e834b00c157273211c1f8dae4166cce220b1cd505e9102926c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769561552, "uuid": "56b5024e-658b-4281-99b2-1e4f0fa80751", "value": "T14E769C14A3E804A1E42BD734CA65C733CA79BD925635C14F095CE2C62F73A628F6F726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769561552, "uuid": "fdbdbfac-d35a-4bdb-af30-e0d3b29e7a15", "value": "6f8fd20d11d9dd31ea97fe501752096f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769561552, "uuid": "54e4f9cb-86d9-4eee-88c9-bc9946e78934", "value": "49152:TRpaKNaeVAbuw3Rp+ROPVmvC3hm6KhJ7n/byFq1WNAvQPjarPQAylUFTAXmCudeZ:F+Z+j/rSFsroQdexM7TFIWzCM+oKB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769561552, "uuid": "6bc2c4ec-6097-4eaf-a690-9600bb1ddb60", "value": 7258112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769561552, "uuid": "a64d1345-3d01-4129-a4b8-b7216b52116e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769561552, "uuid": "83c59d10-ac52-4a24-b30b-a608c48c632b", "value": "Vessel's Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38369bf3-fc3c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769599601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599601, "uuid": "a809ba82-fc8c-432c-bf29-613dff3d59b3", "comment": "Malware payload (Mirai)", "value": "b53b99ef983a89bafd1e848b582e102e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599601, "uuid": "834684c6-54a0-4632-945e-5ba889cf1883", "comment": "Malware payload (Mirai)", "value": "40076b0ebf7f1872b907eec89060a39705f55710971647b10a5051d4f4f0f2d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599601, "uuid": "60b4255f-2f33-4489-a437-e7478a0738b1", "comment": "Malware payload (Mirai)", "value": "f229777e19bd3bd7faefc94d8035ca7ae16a8a1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599601, "uuid": "e609f02f-b116-4bd5-93d8-77a19c5a139e", "comment": "Malware payload (Mirai)", "value": "689582826f127f20a6f7223ba2a78de09fe94e7e6bcae9b9257ef6a86eb80caeeb2cf5abd4e659c46ba6149a9b491de0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599601, "uuid": "f3bbacd0-a309-40b9-8c49-4b934b0d0bea", "value": "T171E32905B31C0A03D1A32AB4363F2BE197EFEAC125E4F641255F9A8A9672D731449FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599601, "uuid": "f6e45dde-71d4-458f-b80c-0e6ef9437950", "value": "1536:K+UmCydrfX0yF6WpmoxclxW/a5cjWHjvA6mDwWpp1CWwq5vnbaqzDc23pKV8:LkZLkclxOW061CueGV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769599601, "uuid": "9596ab9a-2271-40a9-87df-c96a414ea56a", "value": 154392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769599601, "uuid": "67f41c7c-f963-4a44-8947-42b932b473e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599601, "uuid": "fbe896dc-298c-42b5-b863-1c1307928218", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a76a57d5-fc43-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769602795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602795, "uuid": "2735d2c0-28d6-4392-aeb1-4e7f3355973a", "comment": "Malware payload (Mirai)", "value": "51b0b3154a3c298b6b0f450629c14126", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602795, "uuid": "dc972add-9d87-49cb-b74a-5dcee0b3edf0", "comment": "Malware payload (Mirai)", "value": "40109fb1fb263a1875be3f5ad4268f33ddfda632c182d2a524e7161bf7d83548", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602795, "uuid": "6b053264-7295-42a8-9692-9908cabe439e", "comment": "Malware payload (Mirai)", "value": "75be16220202ad9ee522967c44dbb2f631cfdf51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602795, "uuid": "401bca58-a14b-4ca8-a9c6-09bd26c05945", "comment": "Malware payload (Mirai)", "value": "feecdfb75aafa79701a4568474ac9170cc6a59c4ca67a7991b2912aa0cbf6f26ea3dac18a6f9dd632208dd414f8340fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602795, "uuid": "6644a4a1-5441-4b5f-824c-98879d8f3b7f", "value": "T13893298ABCC5C702C6E0A1B2FB1F558E371643A8E3E6B107CD19AF29675F8670A37151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602795, "uuid": "2c5c534b-9aae-40ed-b13a-7a5b8bf213b5", "value": "1536:WffF1G0ie3r1NQO24gyi4FPekNqEs2CUq5oe0d/ZDPEvvX:6913HP4451elEseq5o55ivX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769602795, "uuid": "bf20a927-3b63-4848-a8dc-64bf477fc1fb", "value": 93072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769602795, "uuid": "fa536b59-5f08-4207-bc98-20d0e7d0996d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602795, "uuid": "f81a144e-d109-4f09-b181-9bc6a2601e17", "value": "nklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178027ea-fc57-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1769611143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769611143, "uuid": "81e1e06e-b34d-41ce-a7c5-bd912e4af8be", "comment": "Malware payload (SnakeKeylogger)", "value": "6b092b190f4c218d5d7870d83a661c67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769611143, "uuid": "f010bee8-52be-453b-81b3-259ce2a8a7ea", "comment": "Malware payload (SnakeKeylogger)", "value": "401807d43ef232e8e4109f2a9c7ba1c464376904a01cb92532d49277a0b4e140", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769611143, "uuid": "822df84d-0282-42d6-9450-7d0603f41e82", "comment": "Malware payload (SnakeKeylogger)", "value": "dc024de55e59a9a9e9963e299e3d911295540fb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769611143, "uuid": "7df1982b-af9c-4e3b-8477-6cd9f820e926", "comment": "Malware payload (SnakeKeylogger)", "value": "457d9d587f476f5e45166b620a78a06e376e059519866a6a321943b01d21230f5f1e0a69e786eb1baa7d81017f7cef3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769611143, "uuid": "b0fa33bd-dd00-45ac-a2d0-c361bf71924f", "value": "T19955AD04E3D412B8D677DA74CB925232EA7575855391A9CB0A5CC2052FB3FE06B3F722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769611143, "uuid": "ab2cba57-8c90-4b8c-b2bd-ac20d2decd2e", "value": "495d99c55511ef0f138ff0785ef0322d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769611143, "uuid": "ea4dfaeb-8ae4-4ff6-b5be-993f635e859e", "value": "24576:nfNkzfNhhNivS0ybDAOtVuPjGhFc+VtIG4TxtT7o:nVk7NheAAOt8PjCFH3X4v7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769611143, "uuid": "3afb7ab6-e6f1-4f97-bc42-258b00c7c7a6", "value": 1342976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769611143, "uuid": "f4404ea8-f33d-4f14-a1f8-efe979297807", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769611143, "uuid": "0995e978-52c7-4398-b892-7af81a1e1662", "value": "tcl86.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37eaa627-fc89-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769632672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632672, "uuid": "4c1a3c83-179c-4d4e-93e8-87861821e3a5", "comment": "Malware payload", "value": "75aca2c720c569c87b36f5058d739c3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632672, "uuid": "9fccee9d-c9bb-4dd9-8b27-9e9f736e743f", "comment": "Malware payload", "value": "401db719f5d9a11c3c84cfc58e8fcde5b08c666470e00509b40c48f2d24caf83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632672, "uuid": "8632435a-2b67-4409-9161-7eea5cd78d42", "comment": "Malware payload", "value": "0b465a55e7a48e1013ab88a64c56c8c426dc7f22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632672, "uuid": "ffd5d51a-65fa-4dd3-96d1-220022f33393", "comment": "Malware payload", "value": "204109d85dc1814f36718233ab5bbc92d0f38a4f7fc90be8c967e23b8369c714cbe2c474aa7cd1265f9bc89154fc4784", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632672, "uuid": "e8cbd169-6985-439c-bc4f-e2ab90b212f8", "value": "T134B63313D57BCCF0CA234678D6E10A467B4A058A9C5AB8D4F588633E55D34ADEF38B8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632672, "uuid": "c0d6502a-1770-46d0-93ca-aef58e9f19fb", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632672, "uuid": "6822324b-217e-4b95-9040-cd8ccf0a48a3", "value": "196608:xaZk+wb0rsRTjTtR43PG8PZHj2BPFOsti7A95R8jsFp29XaIT030Hy05s6r8Ar8T:Vnb04RT9R4PkE7Ap84p29qIT0Z6rXr8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769632672, "uuid": "1b4ba391-2263-4269-9cf0-e7a595ae3f58", "value": 11055728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769632672, "uuid": "e1b2f439-eb68-4b63-a800-67cf3590acdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632672, "uuid": "f2b7ad96-0d36-4c03-8a2e-6867a9ca37a3", "value": "document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a47fee99-fc1e-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1769586898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769586898, "uuid": "87425e4e-bf82-465a-925a-71b3e0365d8b", "comment": "Malware payload (DonutLoader)", "value": "4db77d10134b7106476a810a92d4896d", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kid-lidiia-com-ua", "colour": "#4041F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769586898, "uuid": "b0358e4a-5f43-4c41-9b17-5ac9f49cdfac", "comment": "Malware payload (DonutLoader)", "value": "41210a2ab3cee95a240a8d5df13176f78e73f449b6b1f26dee6554631cc905a5", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kid-lidiia-com-ua", "colour": "#4041F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769586898, "uuid": "c43295c3-846e-40fb-8c98-e4613852936e", "comment": "Malware payload (DonutLoader)", "value": "4670e14e7f2e0eac5c9bef3cb09159ff0c712a2a", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kid-lidiia-com-ua", "colour": "#4041F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769586898, "uuid": "f4374b2f-4180-42be-8f3e-55adca3adac2", "comment": "Malware payload (DonutLoader)", "value": "a64c3a6288e1688d8b494c9575abc49b3f6bd7dd65bd8ad9b658627f621ebbb1e3c44d98e231586ba099dc2eaa1dad8f", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kid-lidiia-com-ua", "colour": "#4041F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769586898, "uuid": "58a84f5e-aaae-4d67-980e-7d8783c60918", "value": "T1FBA2E70FB20394D8D81BC2749AE98373B5B1B81166676B2927E0C6710F60EEA5F39709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769586898, "uuid": "69866d84-b60e-4479-8732-1320c72bd029", "value": "5567b8d80b91528b32e3af4cecffd666", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769586898, "uuid": "ca129f33-f286-4e55-bbbb-ee554c51c3d4", "value": "384:RV26sHSpvKnr60TmyUL8v6QcYCjE3xM1e7:P26sH8vKnTvW8v6QcXKMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769586898, "uuid": "283ef42c-d799-475e-b787-8d7831d5e024", "value": 21504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769586898, "uuid": "e4d1986c-7724-4950-878e-01d2f0663063", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769586898, "uuid": "dafd7d50-adf4-4b60-938e-6f3910b7a8b1", "value": "41210a2ab3cee95a240a8d5df13176f78e73f449b6b1f26dee6554631cc905a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ddc523-fc9f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769642190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642190, "uuid": "e89015cb-9280-4e60-96bd-bfe9ac58bc3b", "comment": "Malware payload", "value": "e302a766dded9fc1943c8e750a305ff8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642190, "uuid": "cbd6800f-2eb3-402a-b489-d27a663d366f", "comment": "Malware payload", "value": "41a128bbcf125ea0cd153624030aad41866014739600d9d539d4df13e418141c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642190, "uuid": "026d224f-ac7d-4e1e-aa1f-72c8be20a6ca", "comment": "Malware payload", "value": "20bec7f60663aa7ff18cec55e024fe593f81aca7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642190, "uuid": "59d0a6db-3731-4503-90ab-0c58d16d6052", "comment": "Malware payload", "value": "0f8783cf0c095a4b06407656c5c09500417e2802da16fbadcb774618eebaad4169cda3ef3a0734cdadc8f5f1e73c8c62", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769642190, "uuid": "1963a62d-c35b-4ee7-ae3c-6034e4849e03", "value": "T1304733E887F04C69D86BED37257906C3D36035B41461B69E1E49863827BF1AE943F3B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769642190, "uuid": "31a2bb97-dfc5-4a04-87b4-532bc56ce537", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769642190, "uuid": "c2a3cc9c-3b2c-45a5-ad49-b5b3a229df17", "value": "393216:vV3Y1YFINDS2ICzleFByZ6lrA+BGAPxo0XY1wNKxqXSlVQ+sZPA0ucR8DcjkOH8z:ttFINSW4FQ41oAPxoC7qXkPAY4DEotHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769642190, "uuid": "fe51f5d6-38d7-4c18-9b36-8cde505e9a0f", "value": 24997888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769642190, "uuid": "cb2851d9-053a-4144-a200-3ce31899a3e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769642190, "uuid": "13c9a69f-52fc-4efd-a0b2-5daf069f1b54", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ca47a5-fc41-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769601832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601832, "uuid": "67c34f9b-75b4-4e9e-822e-867cdf07fd3d", "comment": "Malware payload (Mirai)", "value": "b5075652fb5b9037e446ac7abe7e1d33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601832, "uuid": "72632ff4-c5df-4e1b-8bf7-8df973eea9a4", "comment": "Malware payload (Mirai)", "value": "43aa65b2a3d9971e9f26b5f04242ee83629eb141b4fbd41e7929c1ddea4d35d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601832, "uuid": "f9f4b703-0c15-48af-a4c2-f8c4511f6250", "comment": "Malware payload (Mirai)", "value": "8b01436a2259356be32ee296f23ace00b4765d32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601832, "uuid": "03b8a8ae-fc7e-4683-8db0-5b0d0f0e121d", "comment": "Malware payload (Mirai)", "value": "e151e9b2b3ecf1145464bfe39adb507ee7b162fc14800e928afe2658beaf0c1116141cc981722e5c4d95c71d655b94e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601832, "uuid": "4195bbf0-cbbd-4b50-a2a9-d4e8ecbbabad", "value": "T1C3435C41B3190983E1675DF43D3B2BD0839EA6D112F5F349760FAF4A91B2E324582EAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601832, "uuid": "0321c223-2b88-4609-8f68-7517b5629de6", "value": "1536:PxKstRro7TyarGWbzU4FsQ4vtDq4cDTCXn:PxKsUrhxFsB1Xn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769601832, "uuid": "9f8771a7-c256-4576-b8d2-8e60f2c5a9c3", "value": 58860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769601832, "uuid": "415154d6-7c11-47c0-8e4a-dbaf28549bd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601832, "uuid": "8d0cbc76-90ed-4403-8cf8-e7e48b9f04d1", "value": "nabppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e21f0515-fca0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769642836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642836, "uuid": "06b15bf7-7c43-41b0-8fb0-48c12a9aa2c5", "comment": "Malware payload (Mirai)", "value": "eb6c53879352c1eb73b057cae3bac8ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642836, "uuid": "56f7f7e5-802b-41c7-a947-68f0b5a64925", "comment": "Malware payload (Mirai)", "value": "43e5b41e762555bd3b3af1cdd32a1eb7137470ceb4175e380e70a4118bffba5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642836, "uuid": "04e79172-b808-4529-b012-adc0cf38f41d", "comment": "Malware payload (Mirai)", "value": "235696ed1bf1058df734bd4d04e0790ae0fc34ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642836, "uuid": "e4b6d72e-6f15-4148-baf5-a0ead0b44c6d", "comment": "Malware payload (Mirai)", "value": "24902510f24f04673a534e6a2a066dcf6d1ab03c5da4d72d446703b16c4c8cd154c482a5b1e6d2bb6e133ddf93d2f680", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769642836, "uuid": "98c0476c-1581-43bf-b70b-7f089f80fb8a", "value": "T19AB34B21EE396D37C5C0753A51E34630F5B6439926BC9A1F3DA31D9CEF14720312BAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769642836, "uuid": "b9587f0e-1db7-4fb6-9e4a-c93bc9f77aac", "value": "1536:qwHorQChEcT3d6zQjuuuI2lkN3+erySa1G/Yz75WgCAp4t0xn96op:zHzHcrdDjD29ermzV3Rn93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769642836, "uuid": "e831259d-1b61-49c4-bea9-754c75bff8f0", "value": 107924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769642836, "uuid": "fcdddba1-d6f5-4049-87d9-b2df795f84aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769642836, "uuid": "891dae54-ef07-4e97-96b1-d8cec363440f", "value": "zerspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72bf3e8-fc39-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1769598633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769598633, "uuid": "394c5fc8-d806-4e72-90c4-8ef09f68d644", "comment": "Malware payload (QuasarRAT)", "value": "72a75475be80e2f09acfc76197da3581", "object_relation": "md5", "Tag": [ { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769598633, "uuid": "d367d43d-8a51-4365-ad6f-5413f8a95be1", "comment": "Malware payload (QuasarRAT)", "value": "4409a082e2b18f4b19668b7311ee4a882c8bd76ddad7272b1f042d0e5f828e82", "object_relation": "sha256", "Tag": [ { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769598633, "uuid": "45b61ec5-13a6-49c5-9f16-724585d71840", "comment": "Malware payload (QuasarRAT)", "value": "273f78431be2f48464465a35e0c5e8cccc7bbaca", "object_relation": "sha1", "Tag": [ { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769598633, "uuid": "f56d91ad-e4fe-4cd9-9361-de1e67412d5a", "comment": "Malware payload (QuasarRAT)", "value": "c44dbf7950c3bf58dde80ec4db4c3c3645211f46dc3632505ebe531749ae6ad0c7455b749712b698b91af1a6f4d8a406", "object_relation": "sha3-384", "Tag": [ { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769598633, "uuid": "ed53076d-840e-4565-a4d5-a77076e8eca2", "value": "T107E55A543BF85E32E17BE6B3D5B0545267F0F82AF363EB0B2181677A1C93B4098416A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769598633, "uuid": "a0b568e7-b508-46f2-8573-8e8908780fa3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769598633, "uuid": "c98ba4b9-e17a-4b0a-919a-d452f9058880", "value": "49152:Fvocc2BYawds+PblOhTRVV1G41cCwLtlJRom5ZoFoMjoGdDJTHHB72eh2NT:Fvhc2BYawds+PblOhT/V1G4e5ZoFfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769598633, "uuid": "19cd23a5-14cc-4221-9695-21035abfec9c", "value": 3267584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769598633, "uuid": "f0a1615c-c84f-4d13-915a-45f1e0c7bc1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769598633, "uuid": "0394c5ef-ccdd-4f65-9f60-d01e55baf455", "value": "Client-built_version1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa35fa70-fc63-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769616677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616677, "uuid": "dba39c3e-818c-4e54-9cdc-b69efefbab34", "comment": "Malware payload", "value": "84b3d27a68685a01b403a19b150d0f8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616677, "uuid": "1072eec1-a182-4f92-b298-d0f12303857b", "comment": "Malware payload", "value": "4409b836f4cf88418edf137bfd5bf61beed5df870cdf7c5cc9c10ab5c6b2efa2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616677, "uuid": "cc64361b-630d-4100-aad8-a77a5894fcbc", "comment": "Malware payload", "value": "25a087df1a2f18a2b7b771f3797f12af40399200", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616677, "uuid": "8f8c3d30-dc93-4cf9-affc-829c940ef143", "comment": "Malware payload", "value": "ee91578091274a66c26df7728cf51d860de99a6961320d0dc14daad8a8fedf9d386b78c36ad15f5e378e4cd4a01bb9ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616677, "uuid": "e118cdb2-71ec-4a7e-8909-aabc95e2e0cd", "value": "T16932D517A7BBAE1BC4D0377B0193072162E95F916024472F7D0D1C8E2E9A3412D3FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616677, "uuid": "e269965f-d9bf-4602-9888-e852ab03d5a3", "value": "192:xvrOR1CQOsz1NxfAz9H9iG0GhWaDpU/O7Q89AGSybKqeif:xvrbCzfa92GwIU/kwGS1Uf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769616677, "uuid": "9d60dd7f-b4f4-4202-b3fc-a4b85d0406c9", "value": 11024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769616677, "uuid": "ed9d85d1-82eb-4788-bd28-3e4dafc5b933", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616677, "uuid": "bce26be0-debe-4222-9728-66ef844af4e9", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c21173b0-fc83-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769630327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769630327, "uuid": "a8289301-8bb8-44f6-970b-97ee3a7c5042", "comment": "Malware payload (Mirai)", "value": "221e735c0f1f881605c3dffb9f8d927f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769630327, "uuid": "c61e6f77-e6f3-447f-9365-a04a502c92fa", "comment": "Malware payload (Mirai)", "value": "456ca33e942e2eab9bcdd3bc52dfa4dd7d05b5a052d4a3b7201263b4832b58f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769630327, "uuid": "c7f72d2b-03b4-4ea3-a287-c07212395a8f", "comment": "Malware payload (Mirai)", "value": "70954e448d73600a972603a23201620004c5434c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769630327, "uuid": "5ccba127-6b35-4609-8ddf-96ed0563cc99", "comment": "Malware payload (Mirai)", "value": "9f6c2bf8d80331e5861ebb06cd59e574cfc2c79f1f6da242d2497484050b219f114e2d1571e0dde930f33191154f5a32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769630327, "uuid": "90042fb1-c905-4055-b25a-95a5c473b7c1", "value": "T1C9B35C22FD395D27C5C0753A11E34631F5B643E925BC995E7EA31D8CEF24220312BAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769630327, "uuid": "833e1ac2-e5f2-45cf-941f-5461902ae3b5", "value": "1536:BuG/rROZQkhhG9Ij3GK8swO/rv/zTSrsH7lTZ01SW75GNYYgGJ2t0Hfdnq7u:kykSOGq3GKDvb+rsrxWVAPn4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769630327, "uuid": "5f96334c-a037-4513-bda1-238c600a0742", "value": 116168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769630327, "uuid": "b4623c6e-96f8-4e4e-a692-7b073795558b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769630327, "uuid": "a7348477-5ab1-4a0c-a911-186d3acabec4", "value": "jklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e90d9a72-fc93-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769637264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769637264, "uuid": "7ecaa5a5-a9f4-448a-91b0-7b7dc7d4f10e", "comment": "Malware payload", "value": "49218be7e6c8db38b2fa8992ccc02daa", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769637264, "uuid": "4355fe47-57d7-428b-a0b5-500c47f2ec59", "comment": "Malware payload", "value": "45c134e27b6dcc91976419a1bb4984218671b72f9a5b9e546405b16912d6ad66", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769637264, "uuid": "2aa54263-b893-4aac-9160-ed6c067598ee", "comment": "Malware payload", "value": "982b8928fb8d23d69ee4adce4806d1d958222ec4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769637264, "uuid": "adfc8207-9814-455a-aa9e-b333bf3ec52f", "comment": "Malware payload", "value": "25f2d87ea858d96ccf84beda55e20c62ca4824e57c0e88e8344e55d74e0a17d1e1bbb92c385af360856a266b10bd58d8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769637264, "uuid": "266b6a77-0cbe-4144-9655-f40b741d0890", "value": "T1EB336333D410FE0641A1EE55A2799B04D672D97748AC6418B60C4E4D0FCA9EA3BBFF4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769637264, "uuid": "2f7d0ca2-eb0e-4e95-af3f-b491e7f5fc22", "value": "1536:CcHg5Ajyw7IDFSD4zNq94AbluKlAGRhl0IG8O1kA:CQtN/5OB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769637264, "uuid": "86b01e9f-d836-4d6d-8ce2-1a15469ea3fb", "value": 55045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769637264, "uuid": "d77dd800-f343-4a34-928d-94f56d7069e0", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769637264, "uuid": "645dc970-9aa9-46ba-8f18-6c44916b85ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e14e08-fc48-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769604755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769604755, "uuid": "7241683d-d721-497d-8441-d515538ae179", "comment": "Malware payload (Mirai)", "value": "bc9e8f1474376d629eb8b26828e11a44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769604755, "uuid": "278d6bfc-4c3e-4a1a-b1a9-ef247dbe7e59", "comment": "Malware payload (Mirai)", "value": "45e8f91daa2633c959445a8c2f54d0b11ab738917ec782720c7369cb1241e54c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769604755, "uuid": "1c0ffbe5-f782-45a1-8f66-4fb5c2623a50", "comment": "Malware payload (Mirai)", "value": "30446ead1ad5fb9ad1daf0ccc19eb2d001ab2dff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769604755, "uuid": "6096f1c4-737f-4d3b-9329-27b04d66c136", "comment": "Malware payload (Mirai)", "value": "349c4906c213d80f7faecde615317ad317892972d683bf2664d685d6c770281a13c13014125cef86c1f54bf1a14dbd6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769604755, "uuid": "9c32445a-5a3e-4f50-a634-f60358bc21ad", "value": "T1EAF33ACBF801DDBDF80BE37648170909B530B7E251924B372257B96BAC7A1D90927F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769604755, "uuid": "1b1fd0fd-6025-4e25-a508-8122f65ae156", "value": "3072:EPtZemo+FvEFIrX+7zov+yyjEkKVYjbiQLqUsAxme3KMEYAyx5/nc:semo+F817zo2lEkLLqhanuyxNnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769604755, "uuid": "a1f3b499-6e9c-46c0-9f35-9e2a77a330ce", "value": 167616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769604755, "uuid": "5c612aeb-5820-41fd-8324-2b2d1e260536", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769604755, "uuid": "685c7bcc-901a-4c38-85ef-01fdef6cda60", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6705bc0c-fc1e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769586795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769586795, "uuid": "955db0aa-ff37-483a-82d8-1275f3f0be2d", "comment": "Malware payload", "value": "a86835ffca2fc13be309c1c3c50d8bd3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "kid-lidiia-com-ua", "colour": "#4041F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769586795, "uuid": "47382f8c-fec0-4bcb-8200-98a17dc1db23", "comment": "Malware payload", "value": "46a259062f364437256b0157946c8fb1f3a215f707454ec75e2351caf9837fdc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "kid-lidiia-com-ua", "colour": "#4041F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769586795, "uuid": "db96ea6e-443d-4ed8-81cc-9f6bd46ea91f", "comment": "Malware payload", "value": "e8a3d63a173d981bfb025fefe9f509f8f5de8e0e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "kid-lidiia-com-ua", "colour": "#4041F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769586795, "uuid": "54c1764d-e7d8-42c2-9de7-3ce7c83c268a", "comment": "Malware payload", "value": "f990c99013e21f9041dfac45abc686da1778f0a9aaa8ea265ad98171c70eef504579ee57e9bd306806ecb4d4334802b8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "kid-lidiia-com-ua", "colour": "#4041F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769586795, "uuid": "0941545f-6d18-4dfc-b521-e0b6c3f54e70", "value": "T19571100BA7E84657E46B07346EF3032727B8F8948B73973E0980821A6C716244D72BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769586795, "uuid": "f3219334-728b-4a22-9529-b0d460abe472", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769586795, "uuid": "9e414c0e-29cb-428b-9f22-b6b720dc0a00", "value": "24:etGSS/ecRGOEwUnV4pcvTSB2wdBIwCUK7tkZf3reSWI+ycuZhNmYakS3NPNnq:6A2neu2Fiw3J3S1ulmYa33Xq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769586795, "uuid": "a90634ee-8970-4c2e-bbee-8dc55199c442", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769586795, "uuid": "d81a6b9a-a96d-4988-9fec-ebbe79bf48c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769586795, "uuid": "f79e2294-2bab-43ee-b258-4c0b5e6356d9", "value": "3zycxeho.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "551c75a1-fc3e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769600509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600509, "uuid": "e5ed1d76-94c6-410a-9ba2-1524a01ffe34", "comment": "Malware payload (Mirai)", "value": "6e970e5606939b393ddd9f00116eec3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600509, "uuid": "17dc81ad-bbe6-4f7f-aada-01227ddbb6bd", "comment": "Malware payload (Mirai)", "value": "46c13265c206dee5e50dda28a87d669fccc4d063342189a15be9642cf0081502", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600509, "uuid": "23b4eb0d-4fa5-48ff-9116-023abe99994d", "comment": "Malware payload (Mirai)", "value": "435443adf4d6fc55700cf33153e51cbd8abeaf20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600509, "uuid": "36495397-c64c-4620-8a37-e96bd0e09b9c", "comment": "Malware payload (Mirai)", "value": "91f3f67dacc5721c1f6081f040f8fae920ee415366a287995505847c9b5e96a7f0584677e1d12d150f5da2d43b71eba9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600509, "uuid": "b365e73f-1ec1-43cf-8d7d-4aa837e2e5fd", "value": "T1C1934A4173690447F3E74EB1282F6BF193AED5A221E0F285695FDB0F8135A321586FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600509, "uuid": "2d264c7b-597d-4327-b835-994db4c2f6a8", "value": "1536:A/1uCnHoOg1khVnVkrLYIHiv2c0FMFzVbkfXIBx5g9Mk8qj6vgXN2Z:su9Og6PoFMlBkfe52rXN2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769600509, "uuid": "906d7959-786f-49c2-a15f-da7a4b6b2ccf", "value": 89828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769600509, "uuid": "4050d541-526b-4f9d-99f4-8c3c743be42a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600509, "uuid": "a13db53e-48c9-4e80-9bed-de247a95debe", "value": "nklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b1da81-fc66-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1769617819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617819, "uuid": "3cdb4e18-e803-44e3-848d-9f68ee4b4868", "comment": "Malware payload (Gafgyt)", "value": "67e94b9b6bdd9c65196fb67d8831d385", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617819, "uuid": "e0cf9be5-8a30-4720-aa3f-37902f8f2c9b", "comment": "Malware payload (Gafgyt)", "value": "47b6dfc07a4ce2522a338e98ee97946f5cd74e92ea376b12105707f30d372ac8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617819, "uuid": "d53a753b-68d4-4734-9ec6-cdbd419515e2", "comment": "Malware payload (Gafgyt)", "value": "624c5653bca79a9d65746c2d7502c7fa2d7aab45", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617819, "uuid": "317cf690-a71e-4006-98f8-93b053f3e6b2", "comment": "Malware payload (Gafgyt)", "value": "8979ceb399f5791c539620bc112f35749d21a168147c0be4103fae39ac537d1b84c335fd74b917a2951501057892480b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617819, "uuid": "6c14c936-eb09-4c14-939e-dd3133025ebb", "value": "T1D8019AEF01A44C6D1184FA4EF9F24E75A80A7ADD64C50F4C5A8F2C39398D918B835F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617819, "uuid": "2e04ec51-0be1-4601-8a4f-18720e47d70c", "value": "12:t9ILJoZDSLJhHWFLsySLshHWFLPBzvSLPBzMHWFLPnIjDSLPnIMHWFLPiDSLPDH5:t9ICZeTWFw5wRWF9z69zGWFzJzhWFGeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769617819, "uuid": "cc960cd3-55fa-47f3-8b1c-6cc6145c5c9a", "value": 657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769617819, "uuid": "56bf9f10-8164-4929-901e-939ae3ff7abf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617819, "uuid": "e55d81e3-aa09-430a-8366-be02d636e89d", "value": "dvr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c2f9031-fc7a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769626291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626291, "uuid": "8417f15e-6409-465f-9c56-fafd16f5004e", "comment": "Malware payload (Mirai)", "value": "5c0658e47e3c8f76baccee56913678a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626291, "uuid": "b80e2f22-0aab-42bf-b0df-0e7264487b57", "comment": "Malware payload (Mirai)", "value": "4872a279d1feaa7c78348339dba8c8e181af5299dbb9034844e9650d9d77003a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626291, "uuid": "86062765-df2b-463c-bbe0-ba5f87bd5366", "comment": "Malware payload (Mirai)", "value": "973a935ffa61498fdec5a756d75598a5cb23ab6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626291, "uuid": "654aa3b4-384f-4bc8-9484-84fa339b0284", "comment": "Malware payload (Mirai)", "value": "acee0fe74bac772620d598b0d271321e27723adc12d82a123de9d448503d4cf1a68a2b7ae4fe3a0fc794fac363d0baa5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626291, "uuid": "f3a92004-49b2-4b07-81ac-29706dadb079", "value": "T185835BC9FAC3C4F6ED1702766132E7768773E16A112ADF47C3ACA526AC22940D90B35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626291, "uuid": "ab469b6f-77c7-4c2f-b3c2-c243b6efd488", "value": "1536:S4gzTKkDjxo3lrJHVe6CMehAbOeKHUHOSwHS/MSK:SfPfZo3lrJHceehgOeUKXwHOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769626291, "uuid": "364edf6e-36b6-447c-a9cb-5741c363cb1b", "value": 82888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769626291, "uuid": "aef24615-0b0d-4b19-bc4c-907ec572c936", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626291, "uuid": "0d283977-a8fe-48c4-932b-9e453cb1873e", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6acc4a08-fc18-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769584224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584224, "uuid": "0e2c0127-85cb-4bd2-bc61-0ca2b9414c83", "comment": "Malware payload", "value": "e6d5eccf7400afb450843163b2610045", "object_relation": "md5", "Tag": [ { "name": "bknoww-com", "colour": "#F8EF07", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wmk77-com", "colour": "#33F251", "exportable": true, "hide_tag": false }, { "name": "wmk88-com", "colour": "#FFD915", "exportable": true, "hide_tag": false }, { "name": "wmk99-com", "colour": "#F3305E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584224, "uuid": "1ba1066e-5bfc-40a9-83bd-16abca4d076b", "comment": "Malware payload", "value": "487a718afc173510afccd83813bafb7d5e0ded2e2848d01468dcce873f785687", "object_relation": "sha256", "Tag": [ { "name": "bknoww-com", "colour": "#F8EF07", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wmk77-com", "colour": "#33F251", "exportable": true, "hide_tag": false }, { "name": "wmk88-com", "colour": "#FFD915", "exportable": true, "hide_tag": false }, { "name": "wmk99-com", "colour": "#F3305E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584224, "uuid": "4937e4de-e804-4750-b596-a7feb92d0c88", "comment": "Malware payload", "value": "7a80865408202677add8b25a12fe470ca346e1df", "object_relation": "sha1", "Tag": [ { "name": "bknoww-com", "colour": "#F8EF07", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wmk77-com", "colour": "#33F251", "exportable": true, "hide_tag": false }, { "name": "wmk88-com", "colour": "#FFD915", "exportable": true, "hide_tag": false }, { "name": "wmk99-com", "colour": "#F3305E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584224, "uuid": "d9a21c1e-6c70-406d-9b57-d1d5bb66f06a", "comment": "Malware payload", "value": "bbea0f16de7a3806b587bec89e5d4b9d6019aefb8b09531ff69cbd7b129b81b0a76830e64b31f0c266a4b9665f37085b", "object_relation": "sha3-384", "Tag": [ { "name": "bknoww-com", "colour": "#F8EF07", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wmk77-com", "colour": "#33F251", "exportable": true, "hide_tag": false }, { "name": "wmk88-com", "colour": "#FFD915", "exportable": true, "hide_tag": false }, { "name": "wmk99-com", "colour": "#F3305E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769584224, "uuid": "d42083be-8918-4fb0-94c9-97fc157bcce4", "value": "T1F2A59E24A3E401B8E5B7D734CAA68332D5B179D69330D14F06A9C6492EB3E915B3F732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769584224, "uuid": "c19f56aa-5fb6-43ec-9f9d-fc6af089e31f", "value": "091edfe3147290054b3545fa059aa32b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769584224, "uuid": "6ba83ef4-21ee-4f3d-aef7-7e4ebb2cb3c9", "value": "49152:1i2MCb+0Sq2YrqVxGSft/E3CNSZYdYv8ajVBNdCtg:sLUUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769584224, "uuid": "5799ac40-a2fd-4372-86aa-3f7eca21c64f", "value": 2209280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769584224, "uuid": "63be0f01-7862-4199-9657-24310f858973", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769584224, "uuid": "584fac9a-367c-4a27-83c1-455fb74ae673", "value": "python311_core.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "730bd988-fc54-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1769610008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610008, "uuid": "edf3a5e9-a527-4dab-b208-a1108e86a9d1", "comment": "Malware payload (NetSupport)", "value": "fcd2c3a57963660c517cc8270bb8fa90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610008, "uuid": "1242923b-23a8-4d75-b29a-fa20ff6bb934", "comment": "Malware payload (NetSupport)", "value": "499252ad2d4e44ff699fbc6418da823e3111ef8a0cdc7174de06754819056739", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610008, "uuid": "d80f48b2-0cf8-47c8-8e05-7dcdacf8b57d", "comment": "Malware payload (NetSupport)", "value": "72ef525b07e80e77265aeb6b459b8ef290102e58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610008, "uuid": "e634d067-1eef-44b7-b315-0e3f388d4095", "comment": "Malware payload (NetSupport)", "value": "3947e648bd63debe9d2135e69b57caecc4d65f99ecf5aaa16efe2f2950bdd2f469c3e71099c0855cd0d6256dbd747ddb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610008, "uuid": "4ba9667c-eb21-4214-82f6-3a7c975763b1", "value": "T108963399A3A009EAD867593F9965A063E3A1F8210760D4DF1FD4871B3F5B1EE3C3A311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610008, "uuid": "01369661-16b2-4473-a2bc-f2fbb337fc6e", "value": "351592d5ead6df0859b0cc0056827c95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610008, "uuid": "1642dfd5-23d0-4536-a18d-9d182e5a9614", "value": "196608:qmpozv3rPtbW897GXPHMe81SF2RPUewlbtKZ2SHsMRqWbRgFKDU:NaTP1wPsZg2KeOxK4SHsMRqWbYKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769610008, "uuid": "51f1cabc-5dac-432b-9871-e990a095e715", "value": 9412438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769610008, "uuid": "73c9987e-da66-4d12-8b73-0262f7102707", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610008, "uuid": "364e97fa-8be8-43c8-b1ca-084a9c565cc5", "value": "499252ad2d4e44ff699fbc6418da823e3111ef8a0cdc7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b44d7c3-fc51-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769608707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608707, "uuid": "edc1193b-b244-41c8-9e66-945aebd4c309", "comment": "Malware payload (Mirai)", "value": "4207847c3c93a365edcaebc1c695e4ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608707, "uuid": "53c97295-0009-4040-927d-870983196b7a", "comment": "Malware payload (Mirai)", "value": "4b5be396292b965f7a4a74381a42062a5e3dc604031a8b7f608a6c116ef155e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608707, "uuid": "14f1e22d-bb9a-4692-bf1c-5d777594faf2", "comment": "Malware payload (Mirai)", "value": "8f418969b3ee3a7caa0d61faefba79f8042f8bf0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608707, "uuid": "97c30d40-4ad0-4938-aead-93c9da76b8c7", "comment": "Malware payload (Mirai)", "value": "5833006ec0e230f5c32667f1453512917632ac431a08d48ac76487f64ddc4f37e6bb08da4525c4ab84be3daa6c64ec8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608707, "uuid": "4f077fa2-be4e-44f2-a695-eacadc46b967", "value": "T1B3530891B891663AC2D0577BEAAF108E3750A7D8D1DB3353C8240B907ECA94F1C67F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608707, "uuid": "d2bd6574-c2cf-471b-aca0-5b7dc62010eb", "value": "1536:G7AEvoQyE1XijWg1XQm4XEMgfiSvhWb5z3SQ:G7AEvohpKgfiKO5OQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769608707, "uuid": "243a1a07-4029-4cda-a9cb-3b810d826ca2", "value": 62696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769608707, "uuid": "66cc0b69-0d4c-4b52-a64d-13fc01bb723c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608707, "uuid": "3c748996-2b26-4371-a8ce-0b18fdbe32bd", "value": "astro.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80ec74f-fbe1-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1769560812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769560812, "uuid": "0dbc9fb0-d5a4-4c47-92bf-49beb8fa9d4d", "comment": "Malware payload (Stealc)", "value": "d43b7470c1a35b0bb8438f517260c042", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769560812, "uuid": "546a7a1a-50e7-4104-bddc-20d7cdbb103a", "comment": "Malware payload (Stealc)", "value": "4d60481b15d3c0fe5f925a702fdf67b5efc016dc360407189f3d30429f205c31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769560812, "uuid": "da3204ff-eaa5-4629-9a72-686a34023bce", "comment": "Malware payload (Stealc)", "value": "b5e2f5f42b8b4acb5a5d0be2eee8c9bbe86d9868", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769560812, "uuid": "53df2d06-7210-4b59-ab99-45e4d3a165e7", "comment": "Malware payload (Stealc)", "value": "34992b5846c4171a72268ca7bd0603f9c59e4666396bd40f0c07e039574ec95dce1d87d31bde4d8ad76326728682d365", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769560812, "uuid": "3976c1f2-b648-4211-b122-828db8af5989", "value": "T1ACF48D5AE7A602F9D1BBC178CE424553EBB2B8155770978F03E10AA61F372A05F3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769560812, "uuid": "2cc5a0ff-4db7-468a-9497-65ae79f43129", "value": "baedab261d9b0ee2285b2ff329a5eaec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769560812, "uuid": "8a5af822-1db8-496e-9f7a-f235192f90c5", "value": "12288:qU8VHX4ZPBuvzkOkW7UE+YTRqwJ4DS6ALSQTbAK4lVA:wVH6BuvbkW7xXVVmDSzQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769560812, "uuid": "9ed6ea21-5095-4bea-82f5-b010bc63b467", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769560812, "uuid": "5a45bf71-b4bf-416a-933d-2ff9f8bcd5ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769560812, "uuid": "c4aefa58-56ed-4957-8606-98a7a0b53e67", "value": "4d60481b15d3c0fe5f925a702fdf67b5efc016dc36040.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "494cdead-fc38-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1769597912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769597912, "uuid": "a1e48cd1-d7fd-4bf4-b1bf-b854d5fc5873", "comment": "Malware payload (Vidar)", "value": "a4bc5cdbf10d7aeb76a39c9ef5355bfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769597912, "uuid": "9b12c652-2b4b-4995-928b-089c9c1982e7", "comment": "Malware payload (Vidar)", "value": "4e1baad7afe5efde61e520cf18c3daf04eaf09bf5017118e13755789bda3004d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769597912, "uuid": "7e0419f6-80c1-4e35-ba30-6b1caf577ab2", "comment": "Malware payload (Vidar)", "value": "946e187e8567371e8b3903a202d02701aad97d06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769597912, "uuid": "170f2fbd-494d-48af-85d5-f477da7b908e", "comment": "Malware payload (Vidar)", "value": "e09fc7b622dd4b4d754ba7050f70336a2e5b48d8f23809379c0d4051242250d2c6b6171c4c56d558e100745e1c9be075", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769597912, "uuid": "14dd05f0-6b43-462b-962b-a41c65f57bdb", "value": "T144266953ED904965C4ABE239DCB3A1417A347C080B7136D72F927A752EB7BC0127BB29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769597912, "uuid": "3ea1f9c1-dbe9-4fcf-a17c-d79d375fa68b", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769597912, "uuid": "34a5e0c9-7aa6-42df-be28-f6e7c0cf28e8", "value": "49152:GVTinzft5ZkhyxUluZRoJkhq4YbxkkEJ3V:GZ6XqDbekUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769597912, "uuid": "0c6a0b90-8970-4fa3-98b6-3661e0835695", "value": 4508336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769597912, "uuid": "67f3e3b7-5282-4acd-9003-86e9fd0f9267", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769597912, "uuid": "39d03aaa-3703-4e93-8e56-e86a6accc456", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2163574c-fc3f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769600852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600852, "uuid": "37de8319-c963-4741-ba7a-bcf153f8c05d", "comment": "Malware payload (Mirai)", "value": "543ddf85aebaedf72787ecf20e6e6ef2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600852, "uuid": "05636ca9-0bb4-4fd9-9e02-707391906977", "comment": "Malware payload (Mirai)", "value": "4f555fb649aa4632ec420b52bd34e69d5cfe86f1245f4ea7f7fdc6f10a955bae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600852, "uuid": "da5e4d0d-a03f-4b22-933b-ec3d7a85bb06", "comment": "Malware payload (Mirai)", "value": "581d7d19f4bd0f319a0bceef20ff96e36c90c234", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600852, "uuid": "f943ef13-9079-4171-92be-a9614794c92a", "comment": "Malware payload (Mirai)", "value": "ef32d8ced83afee98b6306373cd1d36921d9f38a8e8ec187a050ce99699bf47c22fabe9fc28278c20d80e1845eb3dc3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600852, "uuid": "05971ac6-0f76-4001-8607-80d8f00d776b", "value": "T1CB837CC19543E8F1E9084278223BF3377576CAB80178FDF3F769697684299A0A14774E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600852, "uuid": "6117b7a7-f9ff-4754-8314-1960cd7da44e", "value": "1536:vXl5zfemDz9T4U8TfJyEEhD5vy2Rm+a6t4qwEW/cTXrQlU0RK9Fb3CNF:v1pFn54UeYn5vjm+aehwZETX0ln47QF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769600852, "uuid": "84cc6183-9f7a-4779-87ea-d6827dd3185e", "value": 83956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769600852, "uuid": "1e1b6114-d3a1-452d-bb8e-f8e980c42725", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600852, "uuid": "1de79c5f-0e0f-4b76-865a-03ae28457b9f", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f877bb-fc3e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769600376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600376, "uuid": "9be76243-0592-4f49-b5c6-59f0fc478173", "comment": "Malware payload (Mirai)", "value": "e2b2bd53894d8849245264cf7aba263f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600376, "uuid": "918dc8f5-cf4c-4e57-8a38-b3a0bd3a5a31", "comment": "Malware payload (Mirai)", "value": "5043a5466b9db58f8447782a2b157458a6925fb6c265c29269725400b8ffa50d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600376, "uuid": "080ff5a2-e4ad-4aad-9555-01e4880aa9cc", "comment": "Malware payload (Mirai)", "value": "5a852f3dc8f1a80df802068cce0a6364725aaa1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600376, "uuid": "0b16583d-c266-4b7b-951d-ffbb894792e9", "comment": "Malware payload (Mirai)", "value": "7acdee26a29c2212f4076f6a50f6445c6c89aa3d14696fcb5603db2f9a6ab99a41494170c1927e5ef1b1fe2b5a35d2a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600376, "uuid": "74f0402e-ae0a-4705-8647-86bbe86f744b", "value": "T1D7A3299ABCC5C202CAE061B6FB1E558D371643B8E3E6B107CD19AF29634F86B0A37551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600376, "uuid": "1abe08f7-4ddd-4946-a453-45dcc38f17c7", "value": "3072:IlUwxuMuH/dKgNFKiYoGTQx8u85QglO+oHX:OUnMiFnNRYoGTQKPOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769600376, "uuid": "0a2511af-ab93-4ba2-9285-fcdd873c33f4", "value": 99720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769600376, "uuid": "fb3eb9fa-c040-4243-bf75-c7754416961e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600376, "uuid": "d796e5b4-ef5e-4d0e-bae9-99cc09dcadf6", "value": "splarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f59745-fc34-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769596454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769596454, "uuid": "c7de28a0-8365-4d1d-a861-2efb1fc8ed16", "comment": "Malware payload (Mirai)", "value": "4f36ad572a3e12e18eb2885639d1cded", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769596454, "uuid": "2ba3ec1a-d50b-4d23-b7a9-bbc92393df38", "comment": "Malware payload (Mirai)", "value": "50940e6c84ac9278bdd9e85b8edebb9052e5444a7abc0e7e89e52e138a20b2d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769596454, "uuid": "7db6666d-a76e-481d-8265-3fb8b644ea27", "comment": "Malware payload (Mirai)", "value": "7298c52f8bbd8329e4f095e704170c5fdd175526", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769596454, "uuid": "cb9840a2-cd6f-4045-a022-73b695763749", "comment": "Malware payload (Mirai)", "value": "ba1569d0fe72823872da5be15870b7142bc664f86e626636f58ca1b164cd0ebe2e4c0fcdc1bd8011eb191e2cb913bc0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769596454, "uuid": "1697aaae-daa1-4bd1-b27f-aeae590f5e34", "value": "T1F0939D12CCB65D9CF03A6E3010B9DDFA4717E489A90B6CBB3C438655005BAD8F5A7BB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769596454, "uuid": "6cd94efb-3b95-4930-99ce-f36f9d7c109c", "value": "1536:Dd42IGWNE4+E+AnlnvUT0yaD32MyK64np0Ikw2eCB3vKlX:DdhI5H+E+Alnvw0pT2Xz43kw2eQfEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769596454, "uuid": "d0863314-fd85-4ffa-b154-9096be454535", "value": 92460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769596454, "uuid": "54b99ed5-472f-4353-92a3-997f5407a717", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769596454, "uuid": "0edd2ec1-0157-4d20-9c3e-4ad2a03d95b3", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f3b51ad-fc30-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1769594540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769594540, "uuid": "f50f1355-e1a0-49c4-9802-3f8a6803ec3c", "comment": "Malware payload (PhantomStealer)", "value": "d5507056411ae271ece3d228c0de7ad7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769594540, "uuid": "76085212-e1c6-4801-af3f-b8153f68a063", "comment": "Malware payload (PhantomStealer)", "value": "5147397623337963d66ef5d84ae383c9e72c06da6f9836c6ce1771d4d0dff4f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769594540, "uuid": "3b802ed7-b1bf-4823-b162-24be5e825d2b", "comment": "Malware payload (PhantomStealer)", "value": "8ed84fea3babc16f3360755440917a8dd175db65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769594540, "uuid": "0d9aee30-3afc-434d-b2a0-70e986cdf283", "comment": "Malware payload (PhantomStealer)", "value": "108a04fe94d7ef335ace9b883ce922599f73416ebe81fb1a7d8082bc4ceaf0df51335d88584dea3ba783bef8ea535b34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769594540, "uuid": "ff771172-8641-4a99-8904-9fd429dd7796", "value": "T18785E0027391C062FF9B96334B66F6115ABC7A260123A61F13981DBDFE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769594540, "uuid": "5f93f8d8-e09d-4cfe-8c51-4c67078f336b", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769594540, "uuid": "549efccb-7ae1-463e-9159-591ec31bdc24", "value": "24576:I5EmXFtKaL4/oFe5T9yyXYfP1ijXdaCpRouSOYrpCZohAhPi5mO9Ab9l849:IPVt/LZeJbInQRaCp69CZohAup9yo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769594540, "uuid": "bf34164f-145c-42c5-bbba-fd552968ca26", "value": 1722880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769594540, "uuid": "ac2e6c3a-5d54-4597-8f62-701664b6881a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769594540, "uuid": "cfcbdfec-50cc-43f2-8384-e3df3bc25db8", "value": "New Purchase Order \uad6c\ub974\uba54 PO#3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1095805-fc2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1769594194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769594194, "uuid": "376c81dc-c8ae-4a20-a631-95807dd6c905", "comment": "Malware payload (Vidar)", "value": "4ec036a0b6d4a1f15aca42e5ccd8a46c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769594194, "uuid": "52f14b1d-0c88-4d6c-8b26-e5ada0e96564", "comment": "Malware payload (Vidar)", "value": "51a9cf8442bbc8998dc027f524b0828385b3cbc98db364d27fbfa99f3bbbe20f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769594194, "uuid": "2973a14b-5f16-4dd7-bb29-d7b7d1abfeb3", "comment": "Malware payload (Vidar)", "value": "0375cc00e463425a1c9f5dd872d28e43f71c75ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769594194, "uuid": "b94cebd0-bbbf-44a5-9a39-72150ecd8bc3", "comment": "Malware payload (Vidar)", "value": "45e4cbbbb2b74c244bc0290288fed8887e6c600d85400701fa626e86cdece0cdfe326e0b99476067a48e87b663a26fdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769594194, "uuid": "82938114-6945-47b9-8c8d-6fa282c536dd", "value": "T1C3365B53AD6046E9C45BE239D8E212863774BC480B3136D73E507A762E377C41A7BB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769594194, "uuid": "a9154ab0-fba2-4e60-9fd4-81b6383f4022", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769594194, "uuid": "8788f921-9567-4522-aa21-d4911deefe78", "value": "49152:aA3O7+mKhQXHg2EHhcmHoAHHKhavuH4rA0n:auFzFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769594194, "uuid": "98190fa1-0acb-4965-ba0d-b43531f623dc", "value": 5130416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769594194, "uuid": "9b25a90d-e2a6-42cb-8bb0-de2b73e450e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769594194, "uuid": "4e7dce20-53c2-4fb8-aa6b-957ce8576c69", "value": "CrimsonLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2edf7fff-fc72-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1769622779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622779, "uuid": "cfd7aaf0-8afb-4dbb-849e-dbe74da02836", "comment": "Malware payload (Adware.Neoreklami)", "value": "29cd9be4f7a82347606f5059f7fb52e9", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622779, "uuid": "8a38ba31-1dc7-4be5-9d94-46a6b3cb7dde", "comment": "Malware payload (Adware.Neoreklami)", "value": "51c50b3b704e04b4349de88357eb55d3df0d5ebc6706a2739d0d82f380eaadbd", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622779, "uuid": "6fe9aa25-b89c-4f89-a759-74952e6eca90", "comment": "Malware payload (Adware.Neoreklami)", "value": "04b2ff3d2d819bcd155c2069f8bc744b1b2d8c49", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622779, "uuid": "472dd11b-b580-4b68-8e02-3d4c3e6ca758", "comment": "Malware payload (Adware.Neoreklami)", "value": "878d70854ff57f7e22652903c1b44ec74acfe9fa89f2d40bb10b51751bb216e05aa20386f42047b9a8c5ec63a21e25f9", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769622779, "uuid": "dbe6181a-6bd2-4210-9cf9-b6e80696258d", "value": "T1007633E83ED5C1FAC220453ACEAC5FE852D0F1F11EB18C534BA9DA5F95B9247282472D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769622779, "uuid": "93d58786-57af-4b22-982e-1a251204aef4", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769622779, "uuid": "c7f000ce-bc2f-4bc3-9f55-a5fae68fa578", "value": "196608:P1O//+g09zQKjJWR3SkhEJfDG+ibL+W7fk9Yn49c5EEy9Ca:tOHv2zljO1hEboiW7fsYnGme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769622779, "uuid": "c8560d1d-e229-43d7-81d2-c457ca3ddc94", "value": 7529899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769622779, "uuid": "1c2b8d33-1e25-44d4-a385-bac2bcfe3963", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769622779, "uuid": "d89e0ba8-1535-4756-a996-c3c8c904f241", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c80545-fc40-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769601238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601238, "uuid": "1f6dd3dc-73d4-4f6f-9167-eb19a4845069", "comment": "Malware payload", "value": "0ad4d35d255a9e63e275eb6657a7fa3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601238, "uuid": "426c60f2-55f2-48c7-b74f-815dbe75a4f3", "comment": "Malware payload", "value": "527c199cfe563ec94e3a6a291040b3009b79d3a542a24b62f765947ebe95417d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601238, "uuid": "499799c2-c2db-4652-9d8f-2f2fd5b0af6b", "comment": "Malware payload", "value": "39b62e90a05b535ab4f99bc424cb0d31c6072488", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601238, "uuid": "52fa212b-460b-4626-9609-f822daaf519a", "comment": "Malware payload", "value": "0c72a9d8ec7334f20f42a0bdd2c51b24c67ea48fcad0a31329500c855c7e27256ad245a08d3c0ad07fdcbd762c8ba1a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601238, "uuid": "0f850c88-226b-49e3-9f19-baa8e35f3972", "value": "T1256533E3E76B99A083DB32D2FF1F544F86211594C9C5E476706E0EA833F8498B5C6326", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601238, "uuid": "db07c824-dc30-49cd-9113-e011e1c27efd", "value": "24576:2ZK3pvVNC+7XxNOa5mquYtBmuH/NxKuBc9IEHahhV5znuA2Sf:26oqXzZ5RtjH/ZYIEHahhVVuUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769601238, "uuid": "7f7adb49-5696-4068-95e4-bffb8f5e68ba", "value": 1511733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769601238, "uuid": "f0acc373-1074-4696-a6fd-83761399ccea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601238, "uuid": "eeccfef4-794c-4217-a1b8-f433fe103fea", "value": "avx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a59c5029-fc68-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1769618683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769618683, "uuid": "6fd4812a-975e-4447-b318-96ef8d3d037c", "comment": "Malware payload (CoinMiner)", "value": "07a8b2d9fd21fcaf82b768ebf0c1a555", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Sdum", "colour": "#358298", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769618683, "uuid": "d35c2343-0245-4282-877d-20b715588cb1", "comment": "Malware payload (CoinMiner)", "value": "53f471d2c3d01cd2edbc7ed12979f4011037613bc4521bd8c605eb895fb4d88f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Sdum", "colour": "#358298", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769618683, "uuid": "90c2cfc0-5df4-47b2-9bc7-090da5a7d6bd", "comment": "Malware payload (CoinMiner)", "value": "3d45c25d1486216d917db81c7e2c32dcaea8b5c6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Sdum", "colour": "#358298", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769618683, "uuid": "ee3a179d-38cd-41b2-9654-84172892c021", "comment": "Malware payload (CoinMiner)", "value": "72366fc7e5a959f8b053917d3adab14a1b035368880fff6af31f4b5479c7902b974ec47e44bd57f5ce396f86e4426788", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Sdum", "colour": "#358298", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769618683, "uuid": "f92f6c94-2314-4f02-b124-7e0c38945482", "value": "T1B3669DA9A6BC00A5D8AAC1BCC6975227D772B85517F057CF1A6486FD0F23BE01A7F700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769618683, "uuid": "953a0187-114b-4b08-be00-0fb27579d835", "value": "9e4772de76ef9e299ea33f07a14b4338", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769618683, "uuid": "4e0d4adf-5521-43a4-9f3e-4a755a212220", "value": "196608:ED2AoplvHObLIPH+wZGZ5sKIBkOwxlnIo:EDNoplvHObLiewZGZ5sKIBkOm5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769618683, "uuid": "875ddd1c-dbf5-4872-a97e-47161f61a89c", "value": 6902272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769618683, "uuid": "9674e65a-cbc2-4f81-aad4-c0acca1375b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769618683, "uuid": "820907e2-e705-4384-a89a-f7d24beed0b5", "value": "svctrl64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af3ce74b-fc2a-11f0-a129-42010a9c0007", "comment": "Malware payload (Phorpiex)", "timestamp": 1769592070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769592070, "uuid": "e12fc881-5108-4c75-bbf6-edde1ce1f5a9", "comment": "Malware payload (Phorpiex)", "value": "53583c76c1f5adc86b9f8d574db74a55", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769592070, "uuid": "1d8b5ccd-6f6b-4e7b-96ee-9ba42e4edfd5", "comment": "Malware payload (Phorpiex)", "value": "54b55b164fef227508f635391c37d23daaf6af7c599a83b3ee17c74263f9d4db", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769592070, "uuid": "08525d3b-bbe4-49f5-8f33-1f9dd9054ab5", "comment": "Malware payload (Phorpiex)", "value": "105a549368af12866a05e79a66072ce9df8210ff", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769592070, "uuid": "72329d74-cd4c-4d0f-8e95-b01fc2c49cf9", "comment": "Malware payload (Phorpiex)", "value": "7c3c1e4e546b5671a26063d46b63a4dc461bade47d66ca46a8b1a0e205c3532589f356fd182da718e871b9731bbe00dd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769592070, "uuid": "96c1f599-8614-482b-9b5d-94820ae11e98", "value": "T17E123A1B3E8A0071D3A14DF066B84B9D8B7D542327D661EFF773C29A1F64385A0472AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769592070, "uuid": "125d5f4d-caa4-4930-9e52-727e95ff00e8", "value": "9db3169f0849392a7cd91364b6f1368b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769592070, "uuid": "8de0eb5b-fc20-4a23-b41e-94971afb6b7a", "value": "96:+I4iMmZ2ffYt6FRs3oBPyYdUDi8Z+Z8WrE1UnsnrKFJxGE9b+z2FFhRC7tCEZZFK:+jgEffYwsoBPsZ+C0WKFJxTZ+zmFhyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769592070, "uuid": "5902cf82-5592-4d9a-9387-d30621ce3b88", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769592070, "uuid": "15a0d638-e3a3-4c75-befb-e0867a5c3b31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769592070, "uuid": "159a7738-9c3a-4509-a946-9210127fa090", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c2b033-fc47-11f0-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1769604342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769604342, "uuid": "ae04c2b8-087b-42ed-8cde-1e95887827ea", "comment": "Malware payload (SantaStealer)", "value": "e9343d609687b4818ed103ee29546339", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769604342, "uuid": "d18c97bf-4917-4d29-a1a9-9f4c38f03abd", "comment": "Malware payload (SantaStealer)", "value": "56e06eeb1593d5b3136646ce9a5419cfabab19f054ed1e44b0a0119d5fcc68b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769604342, "uuid": "f65c5141-be75-4d22-b846-8966a7798892", "comment": "Malware payload (SantaStealer)", "value": "51dab2ae2dbae7b476e85443da5d092d05d90c07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769604342, "uuid": "a67d08c9-4324-4537-8b73-f3ae61811ccb", "comment": "Malware payload (SantaStealer)", "value": "8388c950ee89be70fee83643987094b4da8dd7329523ccbae03bb3de040a0a05547dc52e179a55e0c7566249aa97a027", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769604342, "uuid": "4c54b742-9430-4b1b-977a-2b44f32184b9", "value": "T125552B37E66348BCC2ABC074A793E7B1B930FC1901387A6E0A99C7213F55DA0575E7A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769604342, "uuid": "ba888ec8-a976-47b8-aee9-5ed5821e2ea8", "value": "263513f931b9f401c30f73770a19a3e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769604342, "uuid": "71f18191-ead1-4cee-aa95-886f0c8ecfda", "value": "24576:H6fxXJb/e6w0GSUGf24i2BZNfsRwl70rdczd3pzpZopvprZypDlIepkpPpqpK1yw:aZZb/Rw9Gf//Nb70red3pzpZopvprZyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769604342, "uuid": "0d126b94-df8f-47ee-bed9-04a786665868", "value": 1297408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769604342, "uuid": "e2389f21-ba7e-45e8-95be-89c4f220c451", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769604342, "uuid": "0d3e7200-2713-4b36-a626-dc0208c308f5", "value": "santa_clipper.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "254bbf57-fc70-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769621904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621904, "uuid": "e674ede3-b5e0-4730-bcf2-b9547b97ef7f", "comment": "Malware payload", "value": "6951d4ec8e4f50acdd28ec384875fc0b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621904, "uuid": "33b878f7-e130-47a3-92cc-901c32cb4657", "comment": "Malware payload", "value": "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621904, "uuid": "ac10951d-c60a-4742-8697-9346e4a0e040", "comment": "Malware payload", "value": "cc02071297ec87b2a61c0cb613803a4daebf9a67", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621904, "uuid": "7f70e791-e59e-4d30-87ab-93536b15065e", "comment": "Malware payload", "value": "c8dab360a73106785e576116a123a7150c2354af37ef4820b2d2c0151e937b1851a6d9bdc036f4c323edca4164e1c4c2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621904, "uuid": "78011384-3b27-41c3-93bd-8defe74c497d", "value": "T1C48633039BD34130E3EA4934A079D860AF36BD7688DA741C7CF6E25C14B96C28E36B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621904, "uuid": "46653ed5-69b6-4b62-903e-31bfbd5d7004", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621904, "uuid": "139c1eb3-5d97-4d60-ace6-2f6f1fe78254", "value": "196608:B5O2zZx/4O/DH/B3vhJMyK0Z7EPM1qjFTYGhYLgqLxj:BgwzjKyWE1qjegq9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769621904, "uuid": "d6d1e905-93aa-4191-a5ce-942d086f512a", "value": 8355943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769621904, "uuid": "d9f99d97-9bf0-4357-aabd-97d508dfbf63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621904, "uuid": "9c3b95ae-68fc-456a-8e3c-a553a16b93da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91613300-fc45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769603617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603617, "uuid": "6d293409-ff07-4621-ac73-42d76b35558d", "comment": "Malware payload (Mirai)", "value": "4b4cc30fdd6cd737bf5c7966eb4e2209", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603617, "uuid": "2181d269-ea30-4ec6-84f9-d5446e193486", "comment": "Malware payload (Mirai)", "value": "588344923e23bb4b0e4f7ae929eb29e7cbd01b4a03a50dfa0c23fc416569c8d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603617, "uuid": "d14671d0-cb75-4312-8a2c-8e0bf95a9060", "comment": "Malware payload (Mirai)", "value": "e0d1a1ed18de1626eb22c7bf73fce97d293a2065", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603617, "uuid": "6f491c6c-e23a-440c-b2c7-9e286fa8c1d9", "comment": "Malware payload (Mirai)", "value": "a43ee09cfa2a2270670bf1c2cf65f0de852bba8af34cab0837f5cea409168318149e9444b09b2c82f408bac0c217861d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603617, "uuid": "c28b61fd-c28e-4a40-8069-d767559c3314", "value": "T163330275654179E2F2105A7BE579FBC662B4B1FC46203E860B714FA2E24DE2B33B814C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603617, "uuid": "7abc14b3-ae16-4566-b2a8-bc50768429be", "value": "1536:ll3pbGPz3o4gShEJIwri0pjxCeANEYYCc33zzQ:/3RGbo4gShEJI2imxC7ev33z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769603617, "uuid": "744b412b-d4cf-4144-a836-ffb577761bc9", "value": 54336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769603617, "uuid": "3d5349f7-e068-4bfe-b097-5856b5bc327f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603617, "uuid": "aa57bda9-9e5c-479b-9d28-e5315d308dd0", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c90a0096-fc93-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1769637211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769637211, "uuid": "42ac09cc-002b-41d7-8df0-9c50f022928b", "comment": "Malware payload (Socks5Systemz)", "value": "242067bd2370b61ef82c6537832f6723", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769637211, "uuid": "82222902-92a3-4790-b57e-1899e84b4a0c", "comment": "Malware payload (Socks5Systemz)", "value": "58fbbfcca7922754115159b100feffbb398c4c778f573a77c21e5a07d20f4edb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769637211, "uuid": "f898bda5-bc16-4edf-b6f3-2db2d93f6daa", "comment": "Malware payload (Socks5Systemz)", "value": "0d3585b6151778861ed2f4e628158fbc0e1b6a3d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769637211, "uuid": "e8a2739e-d322-4560-a777-4512a62efbda", "comment": "Malware payload (Socks5Systemz)", "value": "2a3f83faab25b02142d94278e7491ef524f94aa12a6d39d23d09c05aee5821ecfd339e2929956ce659a4bd7b3726cd75", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769637211, "uuid": "d69d1a49-9477-4b97-a255-dd7458194169", "value": "T1630633A29735C5F4C1A2F77128215416CF3EB1CB99A020E6379D861C2B6FBF1984FE85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769637211, "uuid": "e2d7c134-4e07-4090-9bc7-0df92bf56926", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769637211, "uuid": "3806b75c-b397-4aae-9df4-26b25d440439", "value": "98304:MuZd55nMWJ3eyDCiwt474FM7BULTY1GC9P0dZeIR3LYlr:hd55MWJ3xCpBE8TY1r9sdb3LYlr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769637211, "uuid": "c16b35e9-160b-45c8-a939-502230d757ee", "value": 3704896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769637211, "uuid": "aed3ae41-0095-4c76-b197-a2bc21618c0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769637211, "uuid": "033e7c4f-0a51-4f7f-9307-932b74a8d7ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b8ff819-fca0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769642718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642718, "uuid": "75ec3d27-e313-4250-b20f-1c62f8da4a82", "comment": "Malware payload (Mirai)", "value": "fd5d5ce67a538cbb3ab206151e3f5845", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642718, "uuid": "b34dabb9-cc34-4d12-9992-f064efda472d", "comment": "Malware payload (Mirai)", "value": "5928140052c6bb89630654415104c0ab08aef9024614dfc04dd876d23364ef63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642718, "uuid": "f2253493-059a-495b-8d82-9d7492eb91ec", "comment": "Malware payload (Mirai)", "value": "4b37566bb6d69e7c0b3960f0146dcb5b5e926a02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642718, "uuid": "0e7880bf-5e2c-43af-b28e-4ceabb29a6aa", "comment": "Malware payload (Mirai)", "value": "ca6bce92e3ed4fd27cc1b32e012651ed230cff2c5f0d0cc6ebed1e36b0259573b3ce8eed631bd38a37e9f5db2f64aa70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769642718, "uuid": "256f9324-b36f-4df6-9384-305cf101ff5c", "value": "T147D32B9ABC819B11D5D625BAFF0E518D33134BB8E3FA7103CD185B2A638E95B0B3B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769642718, "uuid": "aa4c2b36-6066-4b17-9fbd-8f59a6ae9b5d", "value": "3072:zTcIlNmrvK6BEWvfK/kjNSTeBtNh4CamHqKPM/nTJ1Gfy0X0Xh:2K4q/kjNSbCamHqKPMPTaflXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769642718, "uuid": "ff97e258-0b5b-4d51-aee7-4c7ce9dd8bb2", "value": 132648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769642718, "uuid": "2577f7fa-7cc0-47e9-ab77-769d5ea3387c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769642718, "uuid": "7e861b42-748c-424c-85fa-8fdce290eebb", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb0dadb-fc66-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769617812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617812, "uuid": "eeae2143-1535-4a78-b60b-e9cbc618e751", "comment": "Malware payload (Mirai)", "value": "627f79e935ac3bb81e7a7487070d66b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617812, "uuid": "c3e136c2-ca86-4fef-8cb9-95567c78a45e", "comment": "Malware payload (Mirai)", "value": "5a2f439cbeb1481de5ee95086d4119fbf28a8d8b89ae9a93ee9dd45472cf5f78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617812, "uuid": "9069f55b-a663-478d-9dd9-396d44ffa46c", "comment": "Malware payload (Mirai)", "value": "8af47621584dbbe6e953fcff18e1833207390f1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617812, "uuid": "11e09d70-04e3-4d34-bc26-39fb2e755204", "comment": "Malware payload (Mirai)", "value": "96c1061833a7b768c76dada84e6769b20ffd2869099f484acd7ae507262c3c39813f5b2779fa6a116cfdc2a02c09adf4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617812, "uuid": "699d230f-2453-4455-8e43-25421c121a56", "value": "T1F1634A41BD819A12C6D112BBFB5E428D772653A8E2EE7303DD256F2037C782B0E77245", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617812, "uuid": "2c84fa80-5b7c-4c14-9bd1-1cc18187f9ff", "value": "1536:REIhcXWJCLMcKB5CCsaXmb/ivgMZODwh04NkNYNXASus:REI7CLMc86aXmb/Vl8YNuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769617812, "uuid": "f5ffd893-0f20-4f89-9ff4-f4f9e1f1d821", "value": 72108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769617812, "uuid": "5527460c-211c-494d-aba9-3cf58562363f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617812, "uuid": "fe9486a2-a3ed-4ed7-aaf7-5f77047dc949", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c73897-fc65-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769617182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617182, "uuid": "1b5f4bdd-1c28-4b95-99a0-d138c69c879a", "comment": "Malware payload (Mirai)", "value": "4628df2191a930f6ec4ab3748504d6b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617182, "uuid": "bf38d408-98e3-49da-ba83-40d64d02e006", "comment": "Malware payload (Mirai)", "value": "5c979df6813a58cafd7b452932d7a73268b677c087a90d7a5eb8b91c2a644844", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617182, "uuid": "62d825ac-c3e9-444a-b30f-1f890e741479", "comment": "Malware payload (Mirai)", "value": "badcbda4e4eee627ddd220ef6a61f6f0b228a881", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617182, "uuid": "9061d083-f69c-4196-94fe-eca18e7f399e", "comment": "Malware payload (Mirai)", "value": "45ad6d175568244f3f7505f0b084b53bcff0f1ffce18b391d9f4a200383446f0e94858ca80a66234c7854f70d65f1302", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617182, "uuid": "0903b57a-5f71-4356-8e13-009d553d4edb", "value": "T1DAC2E1E07726FA31C420AC3DE52B4C8A3A51067C81FF353664199D359EC1A9B27F48F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617182, "uuid": "42df0d82-1ee0-4c10-ad3d-68caa2939126", "value": "768:DMKyhegCCMqfizjoNpd2vJdX6vwrh9q3UELu1:oKy4qfqoeJdXWgULo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769617182, "uuid": "f57276bc-1fd9-47f0-8e66-2db473bfa847", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769617182, "uuid": "9a9cb6ff-a277-421d-9355-38c3701796e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617182, "uuid": "0832e123-e7b5-48d6-a0ba-f0a53e79ff68", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e965f1b1-fc9c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769641130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641130, "uuid": "bc413f3f-a375-485b-aa75-7528f3921496", "comment": "Malware payload (Mirai)", "value": "18fbd40d44610cbab23f949e28eea5c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641130, "uuid": "a8ce25b7-ecfe-4c55-ab07-e122f894eb56", "comment": "Malware payload (Mirai)", "value": "5d8eae4e5e510e43aca1ecd9784eef24384aea127121089d76848d73d5a2b9b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641130, "uuid": "9efc3ea4-d979-4e89-b3ad-a3f5fcf6ebdb", "comment": "Malware payload (Mirai)", "value": "a191729ed4a1a98d4eada5a3be2d6ba6740c34a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641130, "uuid": "b414b639-78d5-4b92-abec-dced2a5c6375", "comment": "Malware payload (Mirai)", "value": "5a997a9a7c80da1c7d6baef8712420450e6066b73e72c4561edb7a7489d0f38369ab604b2978c03dafe77e6fcb335be3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769641130, "uuid": "b48e6896-eb8e-4402-bc89-861451345671", "value": "T1D1B32BDABC818B11D5C165BAFE1E118D33134B78E3FE7213CE185B2D638A86B0A3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769641130, "uuid": "2c8bfe12-c9e3-431c-a15d-30b7b2bdfe92", "value": "3072:jKGpYuAvGVBExGufuCzDOEzeSIjNa0IXZe18C29jmslH8Xf:WG88CzDOEjeNatXZ429m28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769641130, "uuid": "d53b091e-cc2f-45bf-bda1-b8198cf55640", "value": 111996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769641130, "uuid": "5dc4f188-3f6a-4ec0-9fe7-9c0b8da09ac8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769641130, "uuid": "73eb3784-695f-4820-90fc-08ad405ac775", "value": "nklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "486401f5-fc51-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769608648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608648, "uuid": "42f42d4b-84b1-490e-80a0-bb642e5a1c41", "comment": "Malware payload (Mirai)", "value": "d5a893e4cc0cd53049adb61c1d512244", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608648, "uuid": "7381d7da-fe67-42fd-8cd6-062aa37d1e2d", "comment": "Malware payload (Mirai)", "value": "5e6a632db94d564bafeb5faa0c59dbc2bf3a64fd3e2e5182278a86735bbaed06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608648, "uuid": "d23f72b4-e2af-443e-855e-8e0e8a905f43", "comment": "Malware payload (Mirai)", "value": "26734b20fa0ef2c445c6c3499469ffc0dee9f4e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608648, "uuid": "2c6c276e-503c-4991-b8f5-1b8a2ccc0b5d", "comment": "Malware payload (Mirai)", "value": "3ae2dde5852be97aaef6f5b73f811a5a9dc4f24a2a4185ecbd0914fb2d7bd9e140ff120fef41fa66d789a4b6afd0fe85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608648, "uuid": "18939568-d758-460f-a7a5-4bee601bcefc", "value": "T1AA732B25B9391E26C0D0B57E60FB8A15F6E227CE26B4C50A7DB20E5EFF146006512FF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608648, "uuid": "71c2ba85-964e-4992-b977-05bf1e8d9a7a", "value": "1536:pl6M6lb7d83FhnSM9ouDC30ZKSle6vnBuJagrcm:3o9MmUCirvnBvgQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769608648, "uuid": "46f2ef2c-8e84-4384-acd8-7d7f132acadf", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769608648, "uuid": "8d0362b5-39c1-44ed-bd4a-e657fc5b161d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608648, "uuid": "fc8e3496-86bc-44d6-8433-866336568f23", "value": "astro.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc4ecf55-fc41-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769602078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602078, "uuid": "627b659a-f905-491f-a10d-a646d08c74b7", "comment": "Malware payload (Mirai)", "value": "61239f2c1e247468a293fb49ae919b06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602078, "uuid": "512c6720-13f6-470a-8395-741d4bb0326f", "comment": "Malware payload (Mirai)", "value": "5ea975fea990334429f92f1d4e27b527ff018d9a7d9b1ec5bfbc9c4edc18a49f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602078, "uuid": "6c8ddb18-1d9b-4ebc-9e6f-d3ff9211920b", "comment": "Malware payload (Mirai)", "value": "d2246bcf9b47e72cc26d5cc0c32868405e63b853", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602078, "uuid": "654db5cf-c070-4256-b7a7-699ff1399a0d", "comment": "Malware payload (Mirai)", "value": "fdfe776010e5025f2cdeede7bcaa882f95e73be12cf517adeacdde3ccdc234f4e37a332e49c14942c413171cbebb8edd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602078, "uuid": "dfe8abe0-155a-4b90-9c9c-c6104dfe1879", "value": "T1C163075AB9919B11C9C156BAFF0E518D33035BBCE3EF73129D246B24678B42B0F3A805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602078, "uuid": "5096149e-2821-4116-8ae1-fe29a27c4cb5", "value": "1536:ron/DY7urVs0YIeUowRDuriufk2svMRi+BVFy7ovw7FvYOX:Z7urVDBen7BVFy7ovwxvZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769602078, "uuid": "e107eb40-dd9d-4c29-9cfb-958ee193136e", "value": 71036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769602078, "uuid": "d20187ef-dc57-4bd5-b720-2017cd66cc4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602078, "uuid": "bbeb101a-caf0-450a-b9f7-8bdadbb26f52", "value": "nabarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa57f5db-fc41-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769602075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602075, "uuid": "3aa59ec5-ad86-4b84-807b-41780bcf4646", "comment": "Malware payload (Mirai)", "value": "90ae40889a7ef6a9ce437506854a6e55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602075, "uuid": "3dfd42ae-c662-4d9b-b7ac-ec42941063a7", "comment": "Malware payload (Mirai)", "value": "60237c11c2f8e8376ccc4eb305667820eb5349047aa9d34688ba1ddf88385d8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602075, "uuid": "d48a38e6-34ec-4126-9214-fb633b1b82f5", "comment": "Malware payload (Mirai)", "value": "efdcfe0450265f42b041377c5a34a921c47f6200", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602075, "uuid": "cf34d07d-3358-40da-9d09-7e82cc90cbb3", "comment": "Malware payload (Mirai)", "value": "e05339866987063dc61fcce907111acf614a59b5488ee81d40961ab81d67529f8b3826866c9fade53a85673dc12a091b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602075, "uuid": "3ce64f5f-1d50-4075-8f70-1c3c13b2efc2", "value": "T10593194178819A23C7C11BBBEADF005E3720AB98D3DB73429D146FB43E8698F1D2A755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602075, "uuid": "3e832130-4dac-4e05-ad44-f622f4a70efe", "value": "1536:FNvhbZUxGVU2O0170yoVzyMNKHwNKnJeZWovjHJkKN42rPjnDS3GAuLiH+:FNvhbYNKJwpvj3O2rPjnW3fuLI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769602075, "uuid": "51a2a0f3-25cf-41e9-9e36-137a0af6e2b9", "value": 91081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769602075, "uuid": "150c8402-03c6-4850-8a77-cabea23e8361", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602075, "uuid": "90e91f5b-0ff3-4a53-833e-6a332a2d8508", "value": "pandora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "616f66f4-fc76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769624581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769624581, "uuid": "4808bb38-012d-4fb1-b500-c60d7ff9b9d3", "comment": "Malware payload (Mirai)", "value": "42c46f190cc52df725b17cb55794c04f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769624581, "uuid": "01494824-52bb-43f2-8285-1166190d4785", "comment": "Malware payload (Mirai)", "value": "6054bd1f72f352f774fddf4f6e920a698fdec296212b4e804f9f70e0e4f61e49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769624581, "uuid": "644d6e75-05ca-4b80-a35f-1906437efc13", "comment": "Malware payload (Mirai)", "value": "54ba00b5cf2146af74827fe69d3c2e63fb48e9f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769624581, "uuid": "1ad43d32-2dc4-4936-87e0-0852af5aef09", "comment": "Malware payload (Mirai)", "value": "36a95d93e7b81385e61f62dc0975a72a459d3a94cbc57965a668807fcc78e667d5d81a706f42497dd8fd2e201f591d28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769624581, "uuid": "4a623555-8d1b-44a4-a33d-67a9c0878bc3", "value": "T15B533A52BC829A02C5D522B7FB5E428D772743ACE1EA32039D19AF2137CBD5B0E7B511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769624581, "uuid": "ea99ab2f-04f8-46f6-aa32-69e1465b44ef", "value": "1536:AayesX9+tMKckpIanBnuhWUGYt8RO1kI21PErLM:9yesXwtb8aBnuhWU/q1wg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769624581, "uuid": "ade3e024-2e8a-4243-9e1f-04443091798b", "value": 62001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769624581, "uuid": "81ea03e3-938b-4fb6-acab-47d192ed3120", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769624581, "uuid": "5259baf1-8d04-4ed1-b147-4a5dab681dd3", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "847f3de0-fbe1-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1769560645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769560645, "uuid": "4d50d6b4-22a4-44f9-afa2-0f17679c681c", "comment": "Malware payload (Formbook)", "value": "0893a048d51f7198652a597a10b60fd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769560645, "uuid": "90cfef96-0746-4335-a428-b207deaac3b8", "comment": "Malware payload (Formbook)", "value": "60cd8949dd366aa94383409dde4e7840d85db4f2cea2eef7f773b9fe2d36bc68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769560645, "uuid": "73a25603-a4e6-4489-bf2b-613f787e3e76", "comment": "Malware payload (Formbook)", "value": "0a4689d32ed666af87fb1d150e57a0ab56a92d34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769560645, "uuid": "0cb73b19-2880-4028-86a6-805002f33284", "comment": "Malware payload (Formbook)", "value": "8ca3f29e3ee3491243ce6038ca9421f9532b124a536e693efa61b37a3aadf88deb13ec762240a62d74888a3326f80310", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769560645, "uuid": "03267938-8290-4048-9c3b-78a4a3c60af8", "value": "T16E45CF027391D062FFAB95334F56F6224BBC6A260123E51F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769560645, "uuid": "ecbf05cd-0cbf-4a85-95ad-abcef72688f3", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769560645, "uuid": "74312c8b-3ad9-44f7-bfec-c56261d48dd4", "value": "24576:l5EmXFtKaL4/oFe5T9yyXYfP1ijXdaKhyuOHK6NNJ1iNKQ:lPVt/LZeJbInQRaKhyuOqKbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769560645, "uuid": "97d0c9ff-410c-4a52-b413-453d55815c28", "value": 1246208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769560645, "uuid": "513bc90a-63c0-4c43-bf7f-9c8ec7b38167", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769560645, "uuid": "5f36afa3-fb37-43bc-a794-193d2eff7ff5", "value": "POMXG012628.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e00b8c60-fc31-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769595159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769595159, "uuid": "505b4813-3b2e-4ebf-ad2d-5f3f049a4126", "comment": "Malware payload", "value": "e0f51de072ce4cdde03d4fcf128092a7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769595159, "uuid": "f7b44737-5384-4cb9-8772-0d38c9371d53", "comment": "Malware payload", "value": "61ed1c5c80c4d4cfc729e67a1820ced3516357fd5dd3693d5645d73ac621934e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769595159, "uuid": "d9d188dc-e89f-4725-a5cd-0be38ab66c35", "comment": "Malware payload", "value": "93d846a07f683272f5bf9320729b57e3e24622ff", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769595159, "uuid": "b2649abd-492e-4496-a659-87e008e9bd13", "comment": "Malware payload", "value": "e6f8dcc86fa9251ac6575661752746e41a38b10ae7d6c643393714d99412c3f9c3f8763db933e86482da470e0e29f282", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769595159, "uuid": "c0932fc5-64b7-438b-9f33-4f6ff8beba2b", "value": "T14DC277C936D2BC68132434373A7FA06BE5BECF69105C8152C55A9DE9B8E9F0CD439634", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769595159, "uuid": "17181e2a-f4cc-46f9-8621-5d2de765c626", "value": "384:dpEtZE6ExS3o4U4BXW3czj/+NU3pgVr+4Fdy6CX4ZtUu9NOiBcWKoMIS+RN06m6p:eZEjFMBmQ+mqV9yWmu9NOiW+MIS+RXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769595159, "uuid": "e0439db4-eb19-4b9e-a09f-606e2e2f5e40", "value": 27775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769595159, "uuid": "3a9125d8-404e-4836-a93a-500f7197ea6e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769595159, "uuid": "af52ff13-aa6b-43ff-a478-248ff546a83a", "value": "Purchase order 170925..js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a80a0e-fc4e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769607405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769607405, "uuid": "322d2a99-076a-451b-81a1-d0152bedcea8", "comment": "Malware payload (Mirai)", "value": "210e9038847f4e8b69da17d0c8b49a68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769607405, "uuid": "675be9ae-d8a5-427f-b145-b72056baa580", "comment": "Malware payload (Mirai)", "value": "62abeb60de3578336cf18208e9bf877d99d3c807d32923c2001ba0df42b9863b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769607405, "uuid": "491142e3-0084-4bae-9396-af895f725834", "comment": "Malware payload (Mirai)", "value": "29a136c82148b87913eed0a7fa4062d53dcd27f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769607405, "uuid": "06edca4c-41ee-4265-96e5-a758f295d363", "comment": "Malware payload (Mirai)", "value": "f0fd02e9e5649b2395dc46529d5f95bd150954a8ba9376259a16bd9dda3980eb57fa6be99d9c56d60f3e1f94e3ccbb2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769607405, "uuid": "1753c3b8-5ca6-4213-8807-4c0f3c1ccb21", "value": "T1C583824A7F614FF7E89FDC3705A92B1224CD651B25A97F35BA30D818F20A24F19E3861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769607405, "uuid": "d09e9f38-548d-498e-acb0-bd2f3ebc818b", "value": "1536:rodt3VzfKg4SfJfPuw/uu9PLp98GfjHghP1q5Uxm:roz3Vz9fJfPZ9mhD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769607405, "uuid": "58da82c6-4ac1-4695-bdfe-e8432c67574d", "value": 88736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769607405, "uuid": "59fef726-3d73-47f9-9c4f-ccf9c17c457a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769607405, "uuid": "a825e5cd-4a57-4ca6-8c0a-5659838b310b", "value": "pandora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d0b5267-fbe8-11f0-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1769563505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769563505, "uuid": "55457b9e-2785-45aa-9cd8-bc080ef1f382", "comment": "Malware payload (CobaltStrike)", "value": "94f6b55643b1ccec22d5194cc1e06195", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769563505, "uuid": "15a4c9b3-ae18-432d-8408-2a269204796d", "comment": "Malware payload (CobaltStrike)", "value": "63101038b04ac1387a6e8849f6a9c7723120c748a57d663491f81e3b88b96f37", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769563505, "uuid": "38c92967-0882-44e1-8dc0-4a9a5dc726a3", "comment": "Malware payload (CobaltStrike)", "value": "113c96ae749635c9417c0ac1c878cd3f87740d1f", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769563505, "uuid": "8592b280-ef0f-4187-87e8-e3fb282cefeb", "comment": "Malware payload (CobaltStrike)", "value": "9f50331e4b455be53f969bd699b5c78746fbfb64b099714d7a31457cc4030e6c359430d7528fa39951e443c81826aed2", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769563505, "uuid": "c501bb9a-4c03-48d8-8b41-0e75da3c914f", "value": "T1FF92D93FE31368E9C106D57845FF3733DCB139B385E6972A2734D2B42E105A46EAAA10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769563505, "uuid": "fddca338-f786-40fa-9510-4f8688a454bc", "value": "147442e63270e287ed57d33257638324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769563505, "uuid": "dedacf95-ee2a-4d85-aa91-08fd9145fb9d", "value": "192:6V7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2BS6QdWF8qa1Dojjgi:UqaCF31cix+Dc4zjMUQFF46gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769563505, "uuid": "2009e129-b170-4876-ba88-c662c444842b", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769563505, "uuid": "2de0e828-1e2e-4bc6-9182-e245470e20e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769563505, "uuid": "35b8dc83-88a8-4aba-8115-5eb381d1e414", "value": "63101038b04ac1387a6e8849f6a9c7723120c748a57d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c642a0f4-fc66-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769617879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617879, "uuid": "b265ba43-7f9c-4190-b8e1-7883e70cddcf", "comment": "Malware payload", "value": "248eed41f083c5de46a15c2b9f30303e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617879, "uuid": "dac2fde1-eafc-43c0-af19-4cd7fb4fb7d0", "comment": "Malware payload", "value": "63aa8da1aedb07d075c13f700877a7525df5b4f434c5f24026a77365517cb225", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617879, "uuid": "528963c7-2ca3-4a96-864a-add29dd06dd2", "comment": "Malware payload", "value": "107e18189871d7c9f36af04a5e65bc6a4e6d5da8", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617879, "uuid": "03c9feae-5e0e-4a1b-8b43-fa1f8a912433", "comment": "Malware payload", "value": "20221c0c59c9be24dd7e927eda4c3234b2600ee7f1c374b3e824e0ebc10763168dd062dfb09199e4fd16a4f8f921dbc6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617879, "uuid": "253bbc36-b396-4aeb-85fd-a5975399005c", "value": "T122569D26B7A400E8C87AC53CCA469513F7B2B81953B0A7DB27B4567A1F336D41E3EB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617879, "uuid": "a3322d75-deb6-4ea6-9496-5a7dc1b62c4a", "value": "3a3643ded1fedfee82a3324c3db3bf43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617879, "uuid": "d86a2578-f608-486e-8289-76034434c94c", "value": "98304:5nAa/8E9ti62iKjDzft5E1eamLuqEQitMQXfqNf45TYK02unAa4eLFaQYJSAj231:5jUMtit9NOMjTnA7saQM9Cwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769617879, "uuid": "3104856e-fcb0-41fc-9d28-1406776ec63b", "value": 6455808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769617879, "uuid": "0e11f22d-dec8-4dd1-911c-94451f498a68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617879, "uuid": "334c592b-69fb-44d5-b16d-c4a8e9f84e57", "value": "u695748.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bab6420-fc3f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769601057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601057, "uuid": "966b92f6-a17f-41de-b596-c3fd35cf8865", "comment": "Malware payload (Mirai)", "value": "14a92558926914f0f47446eb116b6c90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601057, "uuid": "eeb4ccdd-98f9-4b51-97ad-c9166beffdc9", "comment": "Malware payload (Mirai)", "value": "6409cd5aa866c9f8708b95beb77a017dd2a6174fbf8f224ddad64a69552aead9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601057, "uuid": "06e94ff3-9373-402b-a720-664b1552efa7", "comment": "Malware payload (Mirai)", "value": "ad4e6e8cc61dc1aa0772d8fb3ada476a1563c76d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601057, "uuid": "5ed1da49-bf09-4539-9a1b-b8cec686e148", "comment": "Malware payload (Mirai)", "value": "45a5125ea16a97f54f2f86e450ad06bbd58f3c88cb84a5f0d1da3190197d3d1086d31e123334e8cc0c9ca07259fdc253", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601057, "uuid": "adaa3d57-308e-461c-bce7-2cc72099bcd4", "value": "T14C93198ABCC5C602C5F0A1B2FB1F518E371643A8E3E6B147CD19AB29674F8670E37255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601057, "uuid": "70b39539-37ac-438d-bde6-39789d402359", "value": "1536:KmbrQQpm/zaR5GPz31H4AcS8nLuIL2El6F5rGKobBVejvjX:KyrV0+APi3SOSILp6F5rG/WzjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769601057, "uuid": "24c92e4d-87d1-4faa-a98d-cddd5fbe9cc9", "value": 91672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769601057, "uuid": "fe1ff0d7-0d11-4b31-a524-16b516110151", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601057, "uuid": "73a7c7a2-bac2-4981-ba98-3b61f1954e89", "value": "zerarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa009a5-fc7b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769626610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626610, "uuid": "b0f49484-c63b-4b5e-9523-6567d6befe30", "comment": "Malware payload (Mirai)", "value": "468d79b1e5ffcfd1822bd9d29230d6e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626610, "uuid": "d32088f6-350d-4953-9cd5-47b2682fd66d", "comment": "Malware payload (Mirai)", "value": "644de80b6ee185e5b37edc8d9af882f58c9f0ae459f254b24215a32741f73ba7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626610, "uuid": "c306b876-2f33-496e-9194-96ba33169cd2", "comment": "Malware payload (Mirai)", "value": "a6c46445dfd7792cc5b3401c6a1e9f87537e1f94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626610, "uuid": "870b36b3-66c7-49d8-a431-ad68d6af7f4a", "comment": "Malware payload (Mirai)", "value": "d39e047a15da0d6f9c2131ca161db3140a9accfa0e143a4700cbabbb6a66d24d65045e69fb915683ce05314c0349f14e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626610, "uuid": "546bca4d-7868-4390-9e20-ae9ff692df10", "value": "T173330249DA23FE274620DA32EB9C128777BD7F70B66F75262D044205368ABC553E8883", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626610, "uuid": "66c23e5a-64fe-4750-9c3c-d7a814163e0f", "value": "768:A+yKm9I6evJiacF5tfFWa/HuhSqSzZDJjbWb0AGfKSRrXwv5obS3f7LCm9q3UELX:UIjALfca/OYrzZD60pWvvz+LLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769626610, "uuid": "21dfc350-d3f3-49b3-9d3f-ec635a780157", "value": 53632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769626610, "uuid": "eca0fdf8-9dd4-43d0-bd3c-af805261148a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626610, "uuid": "34706394-b6d7-4a4c-9d24-770c903ddc35", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cc80f3f-fc85-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769631097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769631097, "uuid": "47c52d0e-6cf9-4346-b781-b5e6c1bb056c", "comment": "Malware payload", "value": "241f157b7bdb30fe3a7500e0778b173c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769631097, "uuid": "db2f72b6-11d2-4215-a71c-edaca53e8c0b", "comment": "Malware payload", "value": "655ec378f42596f49bf0f4ec40e589312e4ec5c5e03ae815973d55d1422ffd22", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769631097, "uuid": "48deb45d-4a47-4533-9d10-9cefe0ce4fb4", "comment": "Malware payload", "value": "469ea7d38b533f1e5c16cf5217890e8c9dcecf28", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769631097, "uuid": "d47fb254-ea70-4162-9a8e-45d3faf1619c", "comment": "Malware payload", "value": "ece8c05b9c2a39eddf2a1ba669ba4ad2c8df44685bc5385692239d929dde3fc71c5ec6576fa664ec1b32dba0a1c1ca29", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769631097, "uuid": "4ce97e04-692c-4fb8-935d-0640cddf225f", "value": "T1BF717497ED09C4A85A365A9AA6B9F20CE4C7360F9C30D411B8FD901D4F24FDB0D52D4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769631097, "uuid": "7b3e2931-d7eb-4e3c-8b30-ce056bd88fa6", "value": "48:npANhQnwN9mO08MmqwHwDwUo5QTT1qRRoRBOupXC7BA8FVYxJb53qB:nkNoO0fUQEKpXC7nFixVE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769631097, "uuid": "1fb9b7f6-c3b6-4f77-b258-cf168a6ef374", "value": 3805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769631097, "uuid": "cf4524d9-f1ad-4f0b-a6c5-bbd1f03ef0a3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769631097, "uuid": "45ca01ef-5a34-44d7-8f21-50cae41333fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92e37c0b-fc73-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769623376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769623376, "uuid": "7f5eb3d0-b928-431e-a826-b9f292aa49cc", "comment": "Malware payload (Mirai)", "value": "64f9f4b9ec621e9ce9294fbf596bc6d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769623376, "uuid": "f2296f80-0485-4407-85d8-d9cac94c7eb6", "comment": "Malware payload (Mirai)", "value": "664c96ecc2763ca7df83e60a3a118d1dc52121012d396713969f910db22c695b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769623376, "uuid": "b5ce8282-93a2-492a-add1-2fe74975f3e7", "comment": "Malware payload (Mirai)", "value": "24aba405d9ca99828fcc175b6a4c3d73844b69c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769623376, "uuid": "6c102a88-531d-444e-8939-8a966d65782d", "comment": "Malware payload (Mirai)", "value": "cfac14b44eeb0491c08237688247fb751f43c5816be65a94664775f73f20e2766c787cb2c35d5927089a1783e8379ea8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769623376, "uuid": "27f13203-9611-4040-a9d3-050f5200df19", "value": "T19B6412ABD9767DCBFE1B4FF021970E4E5EFDD2CAD2C668905215048026FD346A290BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769623376, "uuid": "94a630cb-d29b-41f9-be2d-1a5f12fcbdbe", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6co:7O/QJHZweEL/NOjCHm7FZZnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769623376, "uuid": "3ac7b10a-8509-44c3-8acf-f60b5cbd81e2", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769623376, "uuid": "fe7fa137-52c2-42bf-bd15-5425cb6a6cfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769623376, "uuid": "130d1d66-304d-4d09-a3fb-bfee0f2b5a65", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ac3df83-fc9e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769641643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641643, "uuid": "19d2e1cf-e6a6-4009-bede-f198bb94a87f", "comment": "Malware payload (Mirai)", "value": "f3add9e09053dc60f5b2a55c996e2e28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641643, "uuid": "8d8ab430-13b3-4883-85c7-17b9a0c66a79", "comment": "Malware payload (Mirai)", "value": "685c3e9b12662ff9d10a581a40a9c8d4b2d8d4e7b5d88efea6873518599dd0b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641643, "uuid": "6a0387ef-2592-4c8c-bf45-bb553c57df3a", "comment": "Malware payload (Mirai)", "value": "967a40eb54867eecbd5d0c595a9f9a0a338bc436", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641643, "uuid": "d220cfee-d225-4a05-be01-ec809dd9061e", "comment": "Malware payload (Mirai)", "value": "7951b4f30b52781e2c5d358f265002b5b785f19288eb4956f1f2557f945499bc3369cc9781d66988935ec2eee06a3d81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769641643, "uuid": "7f05fedc-b1be-447a-b21e-0cf1b409c72c", "value": "T138E32AC7F800D9FEF80AE33648170905B630B7E155925E373267796FAD3A1990537E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769641643, "uuid": "b5980076-6541-41c5-b948-1e4ce4ce77c6", "value": "3072:s1omwDLkyHhpp7M1dzoN/fGkVYjbiKLzJ0VY6fblki4kymSlg:yomQxl7MHzsfG7LzWlqkym6g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769641643, "uuid": "8939dc14-5320-49a4-ad2e-488c9eb60334", "value": 150016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769641643, "uuid": "9fbc998e-ba49-47f4-862c-1186e99fb2a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769641643, "uuid": "6d44463d-93b0-47c9-8ea1-b6b71d4f36d6", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "259d962a-fc6a-11f0-a129-42010a9c0007", "comment": "Malware payload (Phorpiex)", "timestamp": 1769619327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769619327, "uuid": "932efc67-923b-4dad-80d1-47d2b11b6001", "comment": "Malware payload (Phorpiex)", "value": "ca1bd33dec36e7408f6c3fce325497b5", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "Trojan-Banker", "colour": "#B6D39D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769619327, "uuid": "6ec907be-d540-411b-aede-588a3687a8d1", "comment": "Malware payload (Phorpiex)", "value": "691e83a56f428febba24766d5165435d79ab7f411c04efab5d8206ac63a4210f", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "Trojan-Banker", "colour": "#B6D39D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769619327, "uuid": "0b963301-ceb1-4877-98d3-a87cd806997b", "comment": "Malware payload (Phorpiex)", "value": "b266f5976cee2eeca28e396fefb2c283a04982f3", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "Trojan-Banker", "colour": "#B6D39D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769619327, "uuid": "ef5c73e6-3a2b-4874-a8ba-424241d97919", "comment": "Malware payload (Phorpiex)", "value": "d4bddd290770de49ad3adf4534abd6cd05b03dd712b24a5eff018855e9490dcf4b6ac1500d746710398b03e6cf3d9b4d", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "Trojan-Banker", "colour": "#B6D39D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769619327, "uuid": "661591a4-5ea2-4327-a91d-69630b782344", "value": "T127833900F6D0813AF4F740FBD2FB5669692CEFB4130649E7539165AFAB209C5B93242B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769619327, "uuid": "e61350dd-6628-4368-aaf2-621fb48d00ae", "value": "f7da79b7c3f003ced1454bf7330a5f87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769619327, "uuid": "26620bea-c2f2-46d7-b3d8-179ac2f6c01a", "value": "1536:md6R+1KFmav82ymR5JpxeDycFdTRWK2aBauw:Q60jOhRLjVcvFW/qauw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769619327, "uuid": "10024a84-c1d8-4462-bd67-4e9e4b0318ce", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769619327, "uuid": "3362e835-abfd-4688-b501-d997bee363f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769619327, "uuid": "9b557534-b51f-40e4-a029-ffd939d14df1", "value": "syskravbnr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f03e407-fc52-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769609089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769609089, "uuid": "b4892e19-9b1d-4b0a-ace6-09113a63e15e", "comment": "Malware payload", "value": "9163f8a0c3b1a7083154466b1fd25eee", "object_relation": "md5", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769609089, "uuid": "06954508-5c1f-4fd2-8add-03901e48bd79", "comment": "Malware payload", "value": "6a081be8abf34e423b4ee26ce82c48f0ff85ba08de63d6717dd71f3479d17680", "object_relation": "sha256", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769609089, "uuid": "07c79150-99e4-4c15-bda1-c3afb5f79655", "comment": "Malware payload", "value": "2dff276d1c8904bc3f68d01ca04c08fa1cbd5a2c", "object_relation": "sha1", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769609089, "uuid": "f301ef96-dc1d-48d5-809e-bcea6a2fa302", "comment": "Malware payload", "value": "ef998cf5b56320fe3ad3ba1ccc4a629db49370eb4926f8c56ef0e35e2a99593edf73f545cea8471bf60f5c1f7c36fac1", "object_relation": "sha3-384", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769609089, "uuid": "41fe3fed-ed06-4f42-bad8-7924bdb3597d", "value": "T1B7F4AE376A695DC4EF951FFF8232D9628CD8E9C7A165C4E4BC800840BEE8BD4F918752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769609089, "uuid": "3d5e7fbd-105b-45c4-bc91-0c93c2d83e75", "value": "6144:hEfqfa/y1HpnS0wBlCxU0MFDOvshLc8q/9xhO12/h9gGlr5cxEDiYMIAHnjZ7ClX:W+nnS9rCgOgOUGLyIBMdnjZ7CiSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769609089, "uuid": "370b3b7a-a176-416a-a5e3-8adf42f4eb95", "value": 732945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769609089, "uuid": "e3cd6cad-3f40-403b-994a-94c826e17941", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769609089, "uuid": "649daa57-c825-494d-85a8-4e9afce8531b", "value": "Parallels_MacOS.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e364f77-fc3d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769600068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600068, "uuid": "c67a2742-982c-4ef8-991a-469ebbd32351", "comment": "Malware payload (Mirai)", "value": "b7a2257cd9769b44abeece632c3c8201", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600068, "uuid": "ecc87503-8430-4ab5-ba63-be7991dfce21", "comment": "Malware payload (Mirai)", "value": "6a2046cefac5af23f6a0a05807a862a2b7c0951c8f24228a46c9be0c34b645d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600068, "uuid": "e04bde07-e970-4a34-ba8a-3b6a88bf4a3e", "comment": "Malware payload (Mirai)", "value": "ba795ebc06ec1552a52293da7fa89105440229c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600068, "uuid": "12eaa720-6771-45e3-9542-a39396a1cdf8", "comment": "Malware payload (Mirai)", "value": "817adf848c0161020a8e3d91162cd662105443ddc604d01aa66a4ca8b4af9c6b252045303c678615c08525f3e0e0d1fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600068, "uuid": "75eae809-f2b4-4d20-8c72-9f9c9201f76b", "value": "T1C7B3C64B6E52DF7CF36C82344BB79B36AA59239633E0C185E29CD9405D6034E186FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600068, "uuid": "6556ad1d-be15-4200-ac8a-0a7f499dbc18", "value": "1536:4HkIVgX7Hx7HW1Hy9SDHgq7b46IUdeGLo8T4EdJAvzxbZXg:4FVqSD9bq/8THdebZXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769600068, "uuid": "356426e4-1e2f-46f9-832f-90c93dc35a2a", "value": 110816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769600068, "uuid": "01c4df58-ca2b-4c03-a24c-dc8b48322221", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600068, "uuid": "939011c0-05e9-47a9-9115-24e7803fcfd1", "value": "nklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1de79f5-fc2d-11f0-a129-42010a9c0007", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1769593417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593417, "uuid": "e832794d-d865-415a-9606-6b51f733a06a", "comment": "Malware payload (ScarfaceStealer)", "value": "9bfccb8f3eda626ea0766b933c2dd4ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593417, "uuid": "228f0374-db4d-466a-a1ec-ca5b30afe6bb", "comment": "Malware payload (ScarfaceStealer)", "value": "6a9322c8c79190516c1944b444d9147f8846863956abac74f77b547a1dea3e30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593417, "uuid": "e8ba0e9a-f42a-4f7d-842c-b2fe84dda326", "comment": "Malware payload (ScarfaceStealer)", "value": "b1ea0782e4b31dfa29f074d12baee41961b949fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593417, "uuid": "4e6d8e65-f56f-4587-aaf9-df89c6c2c145", "comment": "Malware payload (ScarfaceStealer)", "value": "f86eacac0e88e520e0c53716d7bb17d812e04d7e97b45fe1d10fb6380eb2e328c1f036346c99b62e0f4573465cf19a48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593417, "uuid": "d07891aa-1e5a-4008-a6fb-1e692d1421c2", "value": "T176066B136CA04EA9C46FD239E9A2418677B17C441B3233C7AA903B7A1E77BC4057B76D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593417, "uuid": "e9f87add-735f-4b45-8fc9-f92c7c5ebfe6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593417, "uuid": "9c04c42d-d8d9-4a31-8d46-c495b86ee6c4", "value": "49152:QUuHHBZSePcdwePEkoPyBvBYQEZ+t1GdncpmcIup6/koB:QFHN5k0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769593417, "uuid": "754452ea-8894-4d67-acc7-a81f46d43c79", "value": 3835608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769593417, "uuid": "be0ed20a-2048-40fe-ac3d-8b779f65cda2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593417, "uuid": "099147ed-ad7e-49bf-b552-0c438a9a6833", "value": "Cs2Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d30914a-fc7b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769626722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626722, "uuid": "baaf98df-61ad-4593-9ee5-8c524a1c2c06", "comment": "Malware payload (Mirai)", "value": "0937da836fe4bf543c3f8445071f9805", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626722, "uuid": "c227eeee-d96d-4c5f-96ff-d5e4cecb8b1e", "comment": "Malware payload (Mirai)", "value": "6a9ce7819f97757913825e139c27ee5a9cf8e93991d037286a4cd0d72519c54e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626722, "uuid": "32d6e13b-c21e-4212-aa97-1f9fe87c9d51", "comment": "Malware payload (Mirai)", "value": "7748f798d4d297e2ee7554e3055672723691687a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626722, "uuid": "2229a71f-6e0c-4d98-9afd-dda12ec148da", "comment": "Malware payload (Mirai)", "value": "113263303d6b981542d0ff1a98586883135646a48059fc0766662f1a0c92c2b061031e7458ed55840aa55b2f690c26ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626722, "uuid": "7cb1c773-c72b-4568-b856-a65cbc0b6125", "value": "T19AA3ADDBB7475490C8A64BF00BC78BDD3E2762119E27C4E77C0E29B9587A1DF8902792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626722, "uuid": "184d3c6b-0c56-4ded-bd55-af0407108d6d", "value": "1536:TVaQBVf0+1fdC67krKgk/xtCeyHtong4/LWc:TVaQBVfn1fd57VBzCeyHtwg4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769626722, "uuid": "04713e1a-8e51-4aa5-b5b0-b4c72549c7b6", "value": 99704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769626722, "uuid": "46cb8015-5f59-4515-9180-9312956a5f45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626722, "uuid": "53decd2a-7dcb-4e00-bad1-ef860a68a0c3", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ab03ea-fc51-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769608647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608647, "uuid": "38692d46-6a3e-4c8c-8f68-4e24e32d876d", "comment": "Malware payload (Mirai)", "value": "c4982e1f72239e0c76499045e928dbbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608647, "uuid": "18107e82-e6b3-44c9-b501-2dbe189fab95", "comment": "Malware payload (Mirai)", "value": "6b458fbc1a63cb770788942f342fba2ac9ce82dd48dddf5f43394f53253d1bde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608647, "uuid": "1f7661f4-bc59-4a66-a0f2-ba1d0b99b782", "comment": "Malware payload (Mirai)", "value": "7c72c541c5f4059c836578e5041b40fad93bfe4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608647, "uuid": "7fb783d3-e9b7-4d0a-8a2b-a12f9b03c190", "comment": "Malware payload (Mirai)", "value": "ab8428e392c45f22f2142945fe482be1115984f064ae9f0e92b0d6c15f69c3231249255888a6ef5726893370e9b2e631", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608647, "uuid": "cc1047a5-a78a-4eb5-8282-f5c4cecb8e7f", "value": "T1CCD2D00C8A78BDFFC76D483EE58A17585999B68533860F1C82914DC8FA578CAB4C60BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608647, "uuid": "21c237fa-5da4-4e6d-a495-b67bc8051383", "value": "384:UlLqz0DKm2RCr+olUS4HJJAXdTeTjFLOgyxJ+ByN6kYOH8ZHrBnK5yp9F7Ecbufk:uLqoz64C2XdTeMEeVrH8ZHrt1htuYHWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769608647, "uuid": "87d31c48-2b4d-4803-891d-1309e160e3d4", "value": 30140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769608647, "uuid": "216c9a29-b1ec-47d0-b8c3-df46d106af50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608647, "uuid": "1ca3db90-8f9a-4e3b-89cd-aadc9ea28e7a", "value": "astro.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e701367-fc51-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769608712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608712, "uuid": "0976080a-8ed3-4154-b9fd-6115d13fac64", "comment": "Malware payload (Mirai)", "value": "35cb36059e95b38e37c7a9e37133b487", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608712, "uuid": "5f3e0652-dde7-419a-a219-1525e9ccdc53", "comment": "Malware payload (Mirai)", "value": "6cc1f2e4d9e3bfe305a01a6090cb8234b4efce087a3ec5f66ef9b3c12ba0abcb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608712, "uuid": "f2abedbf-167c-4bfc-a830-98c2b8743de7", "comment": "Malware payload (Mirai)", "value": "ee25a4d0bba702391eb488eaf87dfa5c305d288c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608712, "uuid": "3dc79ab7-07cd-442a-8cfe-f8e77dc4ba6e", "comment": "Malware payload (Mirai)", "value": "9342a6dedaf9ccec13dd809e24beb9e9f1181edc4a877c2e1149cdafd63183d93e08d8a71073529947bee052cb4831a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608712, "uuid": "20642d00-c489-48ed-8716-2c9df58cff76", "value": "T12F533B02B2180A5BF8D70AB0243F1FE197FEE9C035E4B6856A1EEB558575E332485ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608712, "uuid": "be898845-1b41-46d4-a150-9ab899d88e16", "value": "768:MbZQ9M+RJRFGLobMud1/veHqjwsdPftck7fhFCczjrhVzyMB1P28VgIES5:Mb+9MSQq13ewBrfCEZVzzPrgIT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769608712, "uuid": "13d847ea-1518-4814-9e95-4571e7b09dab", "value": 65008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769608712, "uuid": "51fe8b4c-927e-4a58-ad2f-e424d228c217", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608712, "uuid": "4d530399-eb19-4cb4-b146-91a140edd335", "value": "astro.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c57126-fc41-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769602072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602072, "uuid": "b0639a6c-b3f2-4145-b946-d58bc76ae703", "comment": "Malware payload (Mirai)", "value": "0e9ecd34c8440925438e1754e8ce1b15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602072, "uuid": "cf7be107-f630-4057-908a-9cbb436710c7", "comment": "Malware payload (Mirai)", "value": "6dc661db497040c818e1e6469f6c84d82fbef1d43d08c5863b626a60c849b2ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602072, "uuid": "c1f40c97-317c-4f68-9235-88ae4a9df9f7", "comment": "Malware payload (Mirai)", "value": "268c15dba0773a023a6bf35f880bb08e5ec8bd00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602072, "uuid": "0b9c11fb-3aa4-4cf5-9987-af218b56ea19", "comment": "Malware payload (Mirai)", "value": "2cb8455ac41cae0a6541fc27779ff225f6cd913d9618e7371f162cd3cca1b9cbcf9741793c1bf43dea9d8583edf89a2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602072, "uuid": "5ad59d0c-c8ef-46cb-ac21-c573e70c8cc8", "value": "T1384302219F42507348A0747A5EADD4C1432E1BBCC3F739131B82498869AEFD95E3C9EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602072, "uuid": "8c0d59cd-be73-4b6e-86e3-c34a6bc2aa66", "value": "1536:p3jlSDhFn3A0IG0h9DRe0wl8kaVLhh1Dgt0L6:5AdFA0I/zQl8htlDg+L6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769602072, "uuid": "e1ecf667-a39c-442c-8176-cff569fa6009", "value": 58868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769602072, "uuid": "a007fcca-9906-4243-8c4f-a47b3bf69a4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602072, "uuid": "cdbb0068-2362-4755-a666-a9a23c4498a6", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b333660c-fc55-11f0-a129-42010a9c0007", "comment": "Malware payload (Expiro)", "timestamp": 1769610545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610545, "uuid": "60f963bb-e301-4ad3-b3a7-6df7bf82e95a", "comment": "Malware payload (Expiro)", "value": "b90c60f0d57f1aa19cb5c08fe791bcec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610545, "uuid": "36a50692-a697-45d9-a685-44ec235bd27f", "comment": "Malware payload (Expiro)", "value": "6eb4bdd8ec2a01033803c139351d0fb38f919b7afda79afbc3a321609f5300b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610545, "uuid": "7e7f8d1c-f2ac-4f55-91e9-b08eacd6d699", "comment": "Malware payload (Expiro)", "value": "0c4036e663914ce7831040e9e228d8b3224ee96c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610545, "uuid": "d5c1f2d0-f1d3-4e75-9d27-fc5f2afe4568", "comment": "Malware payload (Expiro)", "value": "8ba23d576c71bdb1456b6b003ef5b4e1cc7faa4ab930ce2f720e44f717e9fdd870c7d25d953295ed5b8b2eb82ee91311", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610545, "uuid": "ad789691-d0f3-471c-9887-695a54b5e520", "value": "T13085D022E650B425F81385B07E74A25668293E391640ED0BB78DDF5A3BB1AC374F931F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610545, "uuid": "87060064-52f2-4499-9b78-3d86e2efc2a4", "value": "9f614ac8f5b17f11f2407d3f616409e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610545, "uuid": "ffa7f6ab-d02d-413f-be58-68d47c15774e", "value": "24576:X8SsAyXy9GDnitVg9N9JMlDlfjRiVuVsWt5MJMs:tsbXeGDniHgFIDRRAubt5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769610545, "uuid": "e277423b-292b-4c44-b624-cbc8156578d9", "value": 1843200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769610545, "uuid": "8ff7aa32-f8dc-423c-8e3e-72d8f8face3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610545, "uuid": "c731c358-ae89-4e45-b4f5-386d8bb2a703", "value": "SOLICITUD DE COTIZACION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f8c4c3-fc9f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769642037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642037, "uuid": "d49129e7-f7ea-40da-8d8d-e1d767ebdeda", "comment": "Malware payload", "value": "3391c8ad4a1e9cb2711e4cc72146ac56", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642037, "uuid": "8e61c9c9-2fba-4754-8b90-a439608a38c0", "comment": "Malware payload", "value": "6f28fc73cebba1d2b39fdc0d64105089cf0dc2435f72eb0b5a41abaca4b97075", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642037, "uuid": "2e7cf646-8984-4b98-9c27-3fcb6fc968dc", "comment": "Malware payload", "value": "4befe54bbbe1026bc6ad83ad783a7f1c140143f1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642037, "uuid": "e3cd7d9e-b138-467f-93e1-b7426a2e4a34", "comment": "Malware payload", "value": "1513af3b648aa227e107a90bbec95c87f149fdb0b06f8816f1edddbdfc895882ce8164a63a78299f0bd09b155413cddc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769642037, "uuid": "9caf2e0d-787d-42bd-a866-b825c80c514f", "value": "T18F336333D410FE0601A1EE55A2799B04D672D97748AD6418B60C4E4D0FCA9EA3BBFF4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769642037, "uuid": "24dfbbed-115b-451a-8d81-4fd3e9d99d75", "value": "1536:gcHg5AgywaIDFSD4zNq94AbluKlAGRhl0IG+EOP:ggtN/3EK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769642037, "uuid": "ab271c69-f701-4fb3-aa4e-da4db57a5790", "value": 55016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769642037, "uuid": "77997366-549e-4590-915d-7ffbcd576202", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769642037, "uuid": "eca1dd47-6271-4c93-9b0f-b1e9837bad4a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ccec0c-fc63-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769616667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616667, "uuid": "015435c5-4a7e-4ec0-a9d7-59734ff542bb", "comment": "Malware payload (Mirai)", "value": "52ef7b71d04551c5b28797c4de1ec872", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616667, "uuid": "f2626631-29f4-4487-b29b-09572865fe40", "comment": "Malware payload (Mirai)", "value": "71bcdfb8936240d0ebe3782fcbd2c65ddaf7000a09e5030ac8b9a34a6fb738d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616667, "uuid": "8a271b51-b360-4087-9d82-021f7385fbff", "comment": "Malware payload (Mirai)", "value": "925e8d1d38440119bd1940869ebd0a08dbbf3185", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616667, "uuid": "204125e5-89d8-4117-8d03-5b745b79a0b8", "comment": "Malware payload (Mirai)", "value": "ff5a757cf4102423df29a4c4ea8833cc9453a8a9dbccb929dde82df2b476f5e4ac499639266215313d1c335e94bd25e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616667, "uuid": "6c04ac89-3e4e-4092-9420-f61e9c62b98e", "value": "T18BD3F8C7F900D9FAFC0AE7374853080AB230BBA545925A372257357FED7A1990477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616667, "uuid": "020a4b17-3c3d-4992-a26a-0f7328f7715f", "value": "3072:EUbul4MGHJTO3ydxuttK/cQpizdDom3V8wcV1jbiiLP//YD1:s3ydYtw/cSiiWVtkLPu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769616667, "uuid": "e35acbac-ff54-42bc-8164-a246b171e6f9", "value": 140064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769616667, "uuid": "2367e333-d306-4e22-af9e-68fc2d64357b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616667, "uuid": "054ab387-47a4-4260-b125-7f750abfd882", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b9813bd-fc2e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769593541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593541, "uuid": "255a33ff-2444-4f0e-ab56-a173e7ea5e15", "comment": "Malware payload", "value": "7cceaed881765685efdb67587857a177", "object_relation": "md5", "Tag": [ { "name": "104.168.115.88:2390", "colour": "#CD9E92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593541, "uuid": "8485871d-af7f-4538-a5e9-c835fb5ea502", "comment": "Malware payload", "value": "72e0758be73079243e0ead559460a2604fec9291974a7cb1b45e25d0ee5774a7", "object_relation": "sha256", "Tag": [ { "name": "104.168.115.88:2390", "colour": "#CD9E92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593541, "uuid": "1e9c31f4-530f-46ea-95f4-bdc8ca973c09", "comment": "Malware payload", "value": "22156f69829f5b5d2e2cf16c78a0fb9ca6d2017c", "object_relation": "sha1", "Tag": [ { "name": "104.168.115.88:2390", "colour": "#CD9E92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593541, "uuid": "b050a50e-bf3d-458d-b66f-628431dd7ee8", "comment": "Malware payload", "value": "d050008f12743ff331bc4ea75dd5f797ef8371875c370498a0fadf7185c6bc9e0f0fd640496b3b92ca39595a2fc08249", "object_relation": "sha3-384", "Tag": [ { "name": "104.168.115.88:2390", "colour": "#CD9E92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593541, "uuid": "50063ba1-ea70-4067-b11a-cb90eb2cc48e", "value": "T1FAF313E83727FB8559A77DB2602493A547AF393C0C15C86A7F3F25EB43220B417E8096", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593541, "uuid": "de3d99e9-26d1-42e6-91f9-f118be22fc7c", "value": "3072:C+x1JcAoz15HGLN86cmfyjkmtSdvF892j2Ksiaz0MNwD7sHd/:/6z15mLN81mfhmIvF84yKsK4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769593541, "uuid": "9bfaed7a-3777-4772-a2b2-0df4b514adb7", "value": 168630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769593541, "uuid": "53143417-afea-4104-a24e-3d97dc10ac37", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593541, "uuid": "9c1ff535-2e7d-46dc-83fb-3b0181c6f774", "value": "PO-20114.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33b7c66-fc72-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769623108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769623108, "uuid": "999217e4-4a43-40a7-a681-cbc682958036", "comment": "Malware payload (Mirai)", "value": "8c58860c230699fc42873c19e2e2c7ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769623108, "uuid": "8b3ba06a-2136-4c3e-bfe2-074ce17c0f0c", "comment": "Malware payload (Mirai)", "value": "732695891bf76307b566146d9dcc0ba1c6ea5303b3d5bb0e035bd1d0cebe617a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769623108, "uuid": "8a8d2ae5-8c68-4cce-ad67-05f2c76c9434", "comment": "Malware payload (Mirai)", "value": "a3db5880c75b4428f1ec2e4f74b898f74ed02b39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769623108, "uuid": "de47cab6-28a8-483b-8d05-1c28226d0d1e", "comment": "Malware payload (Mirai)", "value": "ff73b3e50065fe9a39ae6579f135cce18dc4b6d5680c5da393f4d3feb36d347eee3d5ad85eab1f4e281ff89776e1a795", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769623108, "uuid": "07ba7bef-0d4a-48db-971a-62ca2e990021", "value": "T13FD33905B30C0943D1632EF43A3F27E197EFEAC121E4FA40655E9A8A9172E335589EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769623108, "uuid": "4b92c2dd-c731-40d5-b39c-532a0b641ae4", "value": "1536:5oFjgyZ/I8FRq1khL8ewk+ZxWPWA3LWTGvAfman71MWjQoqYicIqfZg+8h:KFjgyZ/I8FR9hHJqxkW7f1CSzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769623108, "uuid": "83cf7886-b3bf-4242-98f5-90231bc66f17", "value": 133908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769623108, "uuid": "c32c1ba4-4d45-4359-8684-8c737c90ea30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769623108, "uuid": "b7df0657-2545-4987-a14a-aa86c293a335", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbae1018-fc63-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769616680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616680, "uuid": "d3559bf1-2ed5-403f-89d3-0c008df551dd", "comment": "Malware payload", "value": "50648d57f9bcb8c18fe60dd000a7a0b6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616680, "uuid": "60cd3cf6-8c8d-4254-b85d-16324cf49dc0", "comment": "Malware payload", "value": "754480814846bdaa2154de4995d848591aa7fda666bef3475f3b4cec6ef541e3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616680, "uuid": "4a5c6e50-f02a-4d13-a943-cf611b2b723b", "comment": "Malware payload", "value": "f4312cb22ba8b9fff87400f950fd4615a557cb38", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616680, "uuid": "8e41cd7d-22b5-4a42-99be-b1162ebc2bd1", "comment": "Malware payload", "value": "1780b3e0c862e2d8db1b2d920e65289edc659dbbfa7ce8c65c1320d5b978ad01369f07a551de4db3806c7b8c815a23e4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616680, "uuid": "ecea9755-8d63-411f-8814-94a3a42f566c", "value": "T12A41C49E60BC0045E08ACE7175F34DCCE309D69B55B8023AFDD22D6BE099CCB352AA71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616680, "uuid": "adfc0e1a-ae73-49ee-a459-3256ea6cce93", "value": "48:ZVNPdM5L7O1U4iI8N7zFf9cxXUo7putLZJUlXl:ZVNPdM5L7O1U4iI8ZzFf9cxXUsuxZJUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769616680, "uuid": "9c9537dc-8eac-4cbd-98e8-7e9d138d3925", "value": 1957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769616680, "uuid": "5269034e-c3eb-44e1-8f16-068d90f294d3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616680, "uuid": "319241a0-fa74-42de-9695-3e69cbd2e6ca", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbebc69f-fca2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769643658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769643658, "uuid": "027fc3c7-73de-4195-ba2e-bb91e3a5bfa2", "comment": "Malware payload (Mirai)", "value": "38a4072b5efcb41c3acf6f3b596148e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769643658, "uuid": "06b2a3ef-be1a-4e9c-9e9c-27411e97320e", "comment": "Malware payload (Mirai)", "value": "767a21b847075a58cf3ac88ecc03e528b94330f909a1cf081e1792710c84f9a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769643658, "uuid": "4fcab2b2-5e13-439c-bfbc-336e1b553183", "comment": "Malware payload (Mirai)", "value": "ca11b91f52b663a4533957f3eda24efd14cb6d89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769643658, "uuid": "a359e1af-3aa0-4e6a-99e6-4e7382828c84", "comment": "Malware payload (Mirai)", "value": "73185b43555ec88e2790b5c36a59fbca6c488fdaaaebee661bac899f02e498d98e41bc3bc5e0aa4bd0e8a173cdc12009", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769643658, "uuid": "49cd0f04-0cf0-4f6d-8d52-1cd08fa4a259", "value": "T1E1F3195377324F80D726D1720B738B595AEB12922EE258C5935CCA103A24BED689FFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769643658, "uuid": "f853225f-92f9-49f4-8638-08af25423004", "value": "3072:Ydy102o4BurWBmr4AODH2dLn8ZKafgm3zw4pMsE:YG02ojrYu4CLnKfFsP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769643658, "uuid": "c545ccdb-4ac5-491d-84d9-7829def736fa", "value": 169280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769643658, "uuid": "6726912e-bb6b-4c68-a6dd-ae8d2bb20990", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769643658, "uuid": "3530dce9-27dc-495f-a4c5-2e78b5630c74", "value": "data.mips-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cb22145-fc86-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769631311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769631311, "uuid": "f93df70e-bbc4-48c7-ab4c-975744696b0b", "comment": "Malware payload", "value": "d9c00f738a50c09c29463f2ec8e29f6d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769631311, "uuid": "9ab0decc-ce66-48ba-ac81-b9743266224b", "comment": "Malware payload", "value": "76c055078a4ce834bb4f39c1a371363fe496045247e70edcdcf70ed423a5ff30", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769631311, "uuid": "d0e00690-d61b-43ff-b702-70336c74c638", "comment": "Malware payload", "value": "a4d0b127925bb118b1dfff19b55628125d8a1fbf", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769631311, "uuid": "c85fbe02-9ef9-4174-993a-54997bacf8d7", "comment": "Malware payload", "value": "f80445a5092092ce35bb741308acf49feeb0d027d374d7cf0f85bd64ae7e4833590c9a33299768d360ab278ba71998a7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769631311, "uuid": "ae842370-4b36-4e05-98ff-374e9c57b145", "value": "T115C5C014AC78D0E6FDD741717B556121B4327E378F282A9B11E487ACDA0ADDD0A3E32B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769631311, "uuid": "f68b6097-b9b9-4474-bad8-3934cf44073a", "value": "155dfc2d31fa3e5e20315bf41423c877", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769631311, "uuid": "750a08ad-ee84-46b5-bcc5-79798fa2382d", "value": "12288:F8t+QhgNvxsdSUPSzGYTkeXQvFYx7Amt0ulXejR6liSV2NvR9EPa:T4gNv+SSFeE6x73N0S6R8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769631311, "uuid": "1892120d-0e72-4fa0-9af3-bc395518b29a", "value": 2607104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769631311, "uuid": "d05fa750-85a1-464b-822d-2f1efe0de864", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769631311, "uuid": "ea07dfe2-cffd-4ac7-9d8b-67c81ad81119", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4708b0ea-fc51-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769608646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608646, "uuid": "7ee39cdd-e966-4d01-ab7e-44957b7d32bc", "comment": "Malware payload (Mirai)", "value": "05345d39e49b26afb8c230a38b651507", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608646, "uuid": "e9860653-a776-4436-b752-560396b51139", "comment": "Malware payload (Mirai)", "value": "770794251f42253b66fa1689a61419bab97805a0f785afd9e43c8acdeb211bcb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608646, "uuid": "5f109959-ebcc-459c-8a3b-de3bdaa5df30", "comment": "Malware payload (Mirai)", "value": "ee590868fb67b44c6ba1b354db0e4af714830395", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608646, "uuid": "9c064e50-0829-4321-8b7f-b6255aa0fc45", "comment": "Malware payload (Mirai)", "value": "f2f34eb18b2bd06a39906d66fcc046449ab6eb13ef85b24ff1de322be45770767f9dfaf7f7588474d2942fc6ee645112", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608646, "uuid": "344ad8da-c40e-4b0a-a507-12bb2a40a6f3", "value": "T18BB2B079D006BD25CAB024378F34C18776B6537995E872F168441A7AFFC920259BA38F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608646, "uuid": "91530509-8a20-4bcb-8013-a1294cc9f8b5", "value": "384:tRO77+AXfQi24rzBgLtdn6Pta99yCb/p5VPV5I/M2JYCNF6VhymdGUop5hpj:gVXoi24hQtdn6PtalVUlYMgs3UozDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769608646, "uuid": "c2155e42-3975-4f24-bd06-2e1fca9f170e", "value": 23876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769608646, "uuid": "b19c0dc0-99e2-42c2-a2ff-ea42f5179b3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608646, "uuid": "05b3b141-81cb-4c6a-94eb-13b3b9515d78", "value": "astro.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2eec2e2-fc6e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769621390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621390, "uuid": "9949b20f-a50f-45d3-b2f7-0e9d7784483e", "comment": "Malware payload (Mirai)", "value": "b46cfd4651556c3d261c0700c8077cae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621390, "uuid": "ee4b3d40-378f-485f-9661-26bc628aa76a", "comment": "Malware payload (Mirai)", "value": "779c35fd44e07152aa213cfd362f6b0427fdeebe4c09427c6970fcaf0dbddfae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621390, "uuid": "9f885c20-2b65-4a91-8dfd-5bee88a0ed17", "comment": "Malware payload (Mirai)", "value": "48fc9fd530f6f0d48dd81052cb778b0035cc76bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621390, "uuid": "d8cafb6d-3021-4f5f-9aa0-79b56d71c4a6", "comment": "Malware payload (Mirai)", "value": "9d1091af44e09750159f730626df79b47e07bbb71a9ff4f20759c63243d79f3ba3cc30b20d521e0aeb1ea58131d1ff36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621390, "uuid": "2346534f-8b08-467d-a681-20d12b18934c", "value": "T19C146BA8BA0F6C41F2C2D3F8DE4C87E13E1B35E3C7768971791252EDCAA39D95990502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621390, "uuid": "6722dfad-572a-4f81-8613-e2d0163a0acc", "value": "3072:rmZX+DWRIzn1l0626iGiqH0rwO977trSWioRxlMdcj7oq:6ZX+D6Izn1ll2fGVH0P7t+Axlz7oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769621390, "uuid": "82200155-bb09-43d6-a476-f0530666aa15", "value": 206832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769621390, "uuid": "7d2ea68b-8d2f-4594-bb83-d82baaa50738", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621390, "uuid": "b6a66ad0-e8a0-442d-b296-924dac90e0c2", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bfe3af6-fc88-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769632169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632169, "uuid": "7d70b133-52a3-4dde-ad6d-8a622c0f5a1f", "comment": "Malware payload", "value": "ced6bc55c7975b81829100b914fb57af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632169, "uuid": "b100cf8a-849d-46e9-a3e9-0af0ef283aff", "comment": "Malware payload", "value": "7997e6274f6c2539c0179e7504b0ec6d2c4f07925e499c21cb38fe698e8ea4ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632169, "uuid": "8beca7b0-df49-4fc8-add8-b9d80500404d", "comment": "Malware payload", "value": "9320741d7e41fefa3779e5a0564c93c06b953d61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632169, "uuid": "c257d85e-1196-45a5-9869-20b5ab6e902b", "comment": "Malware payload", "value": "59b88ea8f5b8949898042ebc5b956773f723439ee859a70de619c681f6d274b6f54f9e6a803121c8fa146a59eeb5581f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632169, "uuid": "0682800f-c480-46a9-b5a7-cbe8cf784940", "value": "T12D042A56FC419A22C6C762B7FF4E824837271768D3EE32039E156F21379B95B0E3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632169, "uuid": "43bf8537-0a0b-4614-8d34-9607cfc68bf6", "value": "3072:B5/wmr7OyYNhEtfQRN46Fq20BONhS6oBM:rIw7OJhM2N46g200HS6oBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769632169, "uuid": "4b8f00c0-6ac1-490a-a8bf-b51d273acba5", "value": 178752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769632169, "uuid": "9a46a880-7943-4f24-885e-95dcee898394", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632169, "uuid": "d63dced2-571f-46e8-9a5e-5f325cbe1b48", "value": "herios.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aa2db4c-fc3c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769599767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599767, "uuid": "bffcaa6d-d059-4f72-9570-51f44a2071f3", "comment": "Malware payload (Mirai)", "value": "fe2b18faa62535f252844210e4d9a8ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599767, "uuid": "a8dc8fbc-60a0-4e60-9fc9-6b8372932037", "comment": "Malware payload (Mirai)", "value": "79e57bb7207b4353b7a6a0767bb3d11330c16d5ea3761d8e87abacf6d06515f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599767, "uuid": "e718f612-305b-42b9-8f09-244dc40a21f6", "comment": "Malware payload (Mirai)", "value": "cdb22bbe1fad53d8fa858e5685bb5bd47d33ac9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599767, "uuid": "30f7a9f1-1d7b-4103-b859-6c274b9d7a87", "comment": "Malware payload (Mirai)", "value": "d538c8dd1e39db03a749110c2d41a9e4710521e2176d827ed9f88423878ba82304e06cd369b9c7af5fab931cb8735679", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599767, "uuid": "bad232c2-16b8-4e4c-9458-a3ed44fa2d7e", "value": "T19DB30A89BC818B10D5D626BAFE0E618D33139F78E3FA7103DE145B2A538E86B0B77545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599767, "uuid": "fcf09d11-b39f-41ca-8937-52ee5fe7f071", "value": "3072:H5mOiYtRdRPEH0fKNS4hely/r+QSMZwAq+9Nshdojoh4X:Fd89NS4/tSMZwAq+bshdoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769599767, "uuid": "425291dd-ad63-49e7-a75c-59a26509221f", "value": 109604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769599767, "uuid": "e5fece2d-e4c7-4966-8476-157af61783cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599767, "uuid": "092ba87e-23d7-457b-a864-346de5b04a3c", "value": "nklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf6f288-fc98-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769639229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769639229, "uuid": "8087c296-3ffd-40ab-8269-3fb9127083b7", "comment": "Malware payload (Mirai)", "value": "c2a47fa312144571130bb253974b2e5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769639229, "uuid": "7666e0f8-a1f1-45b4-8c72-b585f66af99c", "comment": "Malware payload (Mirai)", "value": "7cbe2f0e460b51772cc6b2dbbc4bff7b3ec7ec7b20db7fb397fe4f2508800fae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769639229, "uuid": "3e481d16-ab41-43a5-9547-39126d3d7ae6", "comment": "Malware payload (Mirai)", "value": "0edf15dfda498c850a399a47149275098be49bbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769639229, "uuid": "5fb1f0b7-8eb7-4272-9a32-785a51f44b92", "comment": "Malware payload (Mirai)", "value": "87db8231acd336f27a77bc50762e9daefebfe647277b87c557c120c3c13466fd3ab65f433ea6032c2b109bb6c5853728", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769639229, "uuid": "cedace09-5858-4c3d-bbd9-35840ef63886", "value": "T1E8B3399ABC81C312C6E161B6FB1F518E371643F8E3E6B107CC1CAB29674B9670A37651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769639229, "uuid": "5e6d4932-25b9-46b7-9bbb-aead9cc571a5", "value": "3072:eHxkyGVcwwr5JFc+LaeVvc0U5nliM4YOA3XjXx:yfGVbwrPFc+OeV0ZiM4YTHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769639229, "uuid": "85592cc6-c052-44c5-8fba-7448426466ce", "value": 113448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769639229, "uuid": "d0426ab1-ac80-40cd-845a-96f5e668d1a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769639229, "uuid": "cce92038-d2da-4c80-bb99-4e8821bfb464", "value": "splarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f173ee-fc7a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769626362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626362, "uuid": "9ecd9ea4-0f15-4c51-8e98-0d9102026f3e", "comment": "Malware payload (Mirai)", "value": "d5f2c8ce9d5597dfe3958c05f1d99720", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626362, "uuid": "2d984a25-1911-4dac-b304-1b093f2a0486", "comment": "Malware payload (Mirai)", "value": "7ce444ec23ab9186c9855b0e04524239baad5cc1dc8b8b07e68d35d98190ac64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626362, "uuid": "9159f834-9704-48d2-860b-46d68e5c959e", "comment": "Malware payload (Mirai)", "value": "72ad3c5de48721f3bf99874f41c0e5e1aa797ae1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626362, "uuid": "1ed52efa-e6d7-4fb5-9c69-f45cdf0d5690", "comment": "Malware payload (Mirai)", "value": "0efc2a77f2317c65f7d779163ee9fc5492d97cf6f243f17316906c9a2634d52f4bbfa07c41434eda3318c7e2d19c13a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626362, "uuid": "a50ac331-0886-4ebc-8e6e-9cb94588f36d", "value": "T1F9E33A02B30D0947E2632EF43B3B27D193DFDA8125B4EA44355FAE4991B2D32558ADCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626362, "uuid": "ededdd2b-c175-4ca8-bb10-bc2f1c55676b", "value": "1536:WHLZS5yXVZfXAcQcqfrnxC5nMAZ9GxT67ddfaEvWGfq/+7cuN+LH3h4zcGCWMdFV:WrZS5SvAxxFutR9TvlM4z2WSpepuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769626362, "uuid": "8d5bc865-5633-4966-bdaf-567fb02cdcc7", "value": 154348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769626362, "uuid": "9b09cb7b-8497-47c1-a4d7-8304fefe5edd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626362, "uuid": "366bb92e-9a44-435c-b916-446cbf75e1b7", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19fbdc50-fc8e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769634769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769634769, "uuid": "fc2b60d5-930f-4f3a-9d93-f5b118ff02f6", "comment": "Malware payload", "value": "01502e4b6a5a0d0b1783f82cc1246a4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769634769, "uuid": "29b41844-93fa-4b0a-bb62-8670492b0585", "comment": "Malware payload", "value": "7d1b05f19b24b7cb9d7cfc5053b98da46c922e19282981a0407f5815fd65a1e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769634769, "uuid": "4b4c95e4-794a-4a3b-b292-2864a6f519cd", "comment": "Malware payload", "value": "5c385d9426c9621a0f2494171055b62b7f66990d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769634769, "uuid": "e3490037-00a9-43a9-928f-b06fdffca2fd", "comment": "Malware payload", "value": "92f12f1c5d0ce0aaea7fd4ceb23a53ed1ba6c0d25d13e816bbe6122ff40df43c0d4438772fbce606072da029239406fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769634769, "uuid": "8daca75d-2264-42ac-800f-b64d8c06fdb4", "value": "T1F9058D9BFE5F3C47D2D2E33EDF8AD3B0522B7191D21341627A41032CE5C6AD98BA1691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769634769, "uuid": "03aaeac8-7ac0-49dd-85c3-5b568cea9b05", "value": "12288:QmToVUpoVUcoVU6M5UcM5U7M5U4I6r2I6rs1Z6ftDe8BSV7s78pqgzykzuIaann+:n1h6J8pqgOkqIfQ2uql8g5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769634769, "uuid": "c5ea6e90-770f-4c64-b960-95359a9f3f04", "value": 814040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769634769, "uuid": "d704f369-3fe6-4afd-9c7c-26e412698cd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769634769, "uuid": "322efc2a-27ec-434d-9e38-110ccc815872", "value": "arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e769c0-fc1b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769585344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769585344, "uuid": "1f01625c-8556-48cc-a019-1950b8db7b89", "comment": "Malware payload", "value": "d28d3d53241e5dda1cd59b7cb7d5aec9", "object_relation": "md5", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769585344, "uuid": "9e62e30d-41a6-44a0-a826-972b3e9111a9", "comment": "Malware payload", "value": "7d6f5d0543521cd5e664ee24c8c521d09ab766188fd749eaa79cba29d956b65a", "object_relation": "sha256", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769585344, "uuid": "fff32cc1-ad89-46aa-adfe-4791ebd37cf5", "comment": "Malware payload", "value": "b1c4273910e76803eb27f29a5daa09b1192d29f9", "object_relation": "sha1", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769585344, "uuid": "251601d9-d5ad-4a05-afc5-166e8087ec78", "comment": "Malware payload", "value": "35c838ab215b303cecd1c4e7bf41c09b8bcf2604544cebae2d183d1f43e1bf847d8f452818570ae8146ca2ea05c1ea87", "object_relation": "sha3-384", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769585344, "uuid": "963d87b6-0689-440e-afeb-57e4804edf31", "value": "T112A41937AE696D84DF950FFF8231D5A58DC9E9C390A6C0E4BC400900BEE97D5F928663", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769585344, "uuid": "527098e9-3798-4bd0-b75d-1301c01cf413", "value": "3072:EVGOCJizimJFglwgcpMQ+vzRij/nB329Ztec7Ds+nouvaevM45f:0GOociaFESMQszkrB30tJXnouvaevhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769585344, "uuid": "50adc2a9-d018-417c-9f12-d352ef18e2a4", "value": 458742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769585344, "uuid": "c462cf63-e44d-410b-bb77-d5cf999a8777", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769585344, "uuid": "34b29633-1c64-425a-bbbf-0fe41cd96f0e", "value": "InstallR.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adede37d-fc81-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769629434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769629434, "uuid": "8c48b98c-8d44-4acb-a271-1843737be25b", "comment": "Malware payload", "value": "df40bce738689b857737b2cbfdd7087d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769629434, "uuid": "0177504c-40b1-47e5-83e0-a897b26c7db1", "comment": "Malware payload", "value": "7f4036181a616499b69b9d976e7b2a6073371ee742720bbcc0557cd51ef5034c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769629434, "uuid": "4f5bab8d-fc30-4f3f-96f8-290f5d42ad7f", "comment": "Malware payload", "value": "4da8196e23262f74eaa2eb7f6e01cb35ddefd050", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769629434, "uuid": "00a32b57-5870-4507-90d6-c1f2fcc1238a", "comment": "Malware payload", "value": "4fc42d5781042202f8c54ef05865d3f5b5d0bf5f4659a0473c8233a13d3291f30384b8d65017ee3690ea6f148fdcc369", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769629434, "uuid": "d3ffddac-ad86-4554-a785-6608feac943c", "value": "T11A92E13BAAD4A259C64F2B7263F1E3176B10859D9BADE873026195C40949EFD430D3CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769629434, "uuid": "6236c65a-2984-4f3c-96dc-bfab76c614f8", "value": "384:gyR0xiDIysNBSdoUfpaKU1CQC3cc56cBDrgA9vmEJXRW:gc0xiDIbNBgxHQC3cc5rVgUeEJXRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769629434, "uuid": "66515dbd-63fd-499e-8638-ea7d3e3e66d9", "value": 20779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769629434, "uuid": "3d0ad90d-023f-45ac-9920-3315490610b6", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769629434, "uuid": "1132b281-928d-454d-a5f0-461fbc2862f6", "value": "maksbuild.jar-out.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033ac95f-fc88-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769632154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632154, "uuid": "45cf7728-0206-44dd-8569-1e2703750156", "comment": "Malware payload", "value": "62fc6955dab04b380ebb3f7e93ff8fe2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632154, "uuid": "e2a510c7-fd6e-49d5-8f38-2ad49219c715", "comment": "Malware payload", "value": "7f9543ae8d9f3527b475035a977c762a19277d94392970166e32edf2e003a34c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632154, "uuid": "e66639c5-48e9-4c7b-84f7-20ce3c4a1c0b", "comment": "Malware payload", "value": "60588541f2cc1cf2fd4c95353000006b414465c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632154, "uuid": "c7ebf2d1-f9f4-4611-ad31-611b5b9d96bd", "comment": "Malware payload", "value": "06369adbf693e97d54d8a3f95946da90c3f6cebdb60397293dd1ce717cb21c8b2a8156648bca539d03380e9671daaf94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632154, "uuid": "1f2d41b3-6be3-4927-8b9f-b06d64b0453d", "value": "T167630187C7D3EA31DA620537660849347E3AEA3064916B2E42826ADDCDC8DD4BC33379", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632154, "uuid": "79b8fe74-1ae2-447d-83d3-d992a03db3a2", "value": "768:Q0smPdVtFxvxcGLqErn9ETlmJ5b+OIVl4zB1p3nrbJ/9q9Lofda7I5Cijkv751GD:SmEtToIC1pXJQ9LOYik51meAq+xQqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769632154, "uuid": "3939ffa3-7c2e-4060-84c7-57dae3623006", "value": 66968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769632154, "uuid": "67830e96-33ad-48a3-b1af-8d83ddaca65c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632154, "uuid": "61e6811c-f885-421d-9078-e5bad32e294b", "value": "herios.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af348d0-fc6e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769621161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621161, "uuid": "4e31591a-2efa-4931-b662-fcd0e06e63e3", "comment": "Malware payload", "value": "7275a5d2f48d915ab8c055612d6a75f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621161, "uuid": "5df63aa2-b837-4762-b062-c6abe87611c2", "comment": "Malware payload", "value": "7fa484d8a7dab9c3dde9a3b18ae31fe9f60a1e6f17334c29f93efe0a8a819425", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621161, "uuid": "6ef3f110-38cf-4f36-ac59-79be6d09b340", "comment": "Malware payload", "value": "03524af0d7134a28595da950f9a90263a78223f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621161, "uuid": "d2373393-dfd1-484a-87b8-fd0b33dbb959", "comment": "Malware payload", "value": "ff8318ab8c9f33f8b9485d0150759fee222a2b00af0b4530fc10dc250ea7f394928ba7a2d2fa1575215fa42e060014e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621161, "uuid": "857dd531-d1a9-4ea6-b49f-7ba1912a17fa", "value": "T10F32A20173F88A26F6FA4F30997207250E3BBD835C35E66D19D9441E5AB5BC0CAB1772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621161, "uuid": "11ce50fa-24c4-4ba5-8968-684130e481a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621161, "uuid": "8db6f22d-0bdf-4e5f-890c-99e6762ba343", "value": "192:AOTIfAjtgDA1Sa6h3N2em8hg7qunz7CqIA0+QfeTyS:xIfrU1SPzxmO4quzUDVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769621161, "uuid": "3c19d653-39bc-4031-ba5b-6e79eb72f1c4", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769621161, "uuid": "92cf3227-f650-4efb-b335-ef6e8cfbb68f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621161, "uuid": "3bd3275f-939e-4660-890b-79e1ce2a3efc", "value": "SecuriteInfo.com.Trojan.GenericKD.78672776.17126.22378", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfd7e183-fc45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769603695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603695, "uuid": "5a3e4b01-b0ac-4150-a1cd-b32acd877baf", "comment": "Malware payload (Mirai)", "value": "436d35dfba5972f80eb9b5f580dfdd05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603695, "uuid": "013e5b86-75c8-4c0b-b74b-60f84d05c1da", "comment": "Malware payload (Mirai)", "value": "801a41534cdc9673d9b34b400b621aea80bd9ed2792d2e92ea3dfade1bde0d28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603695, "uuid": "1a4ee8c0-a7c9-4341-a54d-bd7763c0e56a", "comment": "Malware payload (Mirai)", "value": "1411d4530b19ae22b8e460b89a84c6dcdcfd3128", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603695, "uuid": "bedc8ff3-acd3-4861-ba9f-a83baf09fc87", "comment": "Malware payload (Mirai)", "value": "bbb48fbb622a718caf2a3b05de355e18664c5ad492cdaab7a6739b3a021d8d1afe38e308e1d468ba4f5ec87704480b30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603695, "uuid": "bd104991-bf3a-40d8-a29f-fa67dd09fea4", "value": "T1F8E31945F8814F23C6D612BBFB9D52CD3B2527E8E2DE72039D215F20378699B0D3AA45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603695, "uuid": "b61f64cb-436d-4e7c-ac00-cfed7e6ea3e3", "value": "1536:LMmsBz6Jb8iaVwxoVtnSiIR7qs9Zd427o554VkjM7tp5i6j7l5Qwyw3eKIhXdlyb:LMr6mDRsjd4D54mMhzi6CtAJ6n6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769603695, "uuid": "1d03cb75-d3bc-4df3-821f-ded3927e4cd2", "value": 154272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769603695, "uuid": "69898847-56d8-4cad-bc6e-e3ba905b0dc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603695, "uuid": "581eaa8c-4068-4049-824a-92b6d4dc082f", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f8285e-fc9c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769640965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640965, "uuid": "e2279f3f-f4c7-4cf5-aa60-bb7da650d31d", "comment": "Malware payload", "value": "0c989c5081c11cce7d2437ae51f4f022", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640965, "uuid": "2bf8e175-d742-441d-ab84-a57bdcee86db", "comment": "Malware payload", "value": "8021778eecf683335c50c7981c8113f336969096424b318b7206471d80fd6e88", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640965, "uuid": "4a80ad7d-ae19-413a-96a2-de79f07a141d", "comment": "Malware payload", "value": "98f2d2872c7ccc77d53302e7b47e681f76c22192", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640965, "uuid": "488a2346-3537-45a9-8294-81df468214f9", "comment": "Malware payload", "value": "bd38e869bfd5e108ffad4ca77d0e85960bea26fb4883e815f1c7aa28e7cc80b3121ee33b7216fcb500707f84caa324ee", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769640965, "uuid": "582e2dbd-8d2b-4a21-b09b-f28384977b8b", "value": "T16E336333D410FE0601A1EE55A2799B04D672D97748AD6418B60C4E4D0FCA9EA3BBFF4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769640965, "uuid": "c69c9182-5a7c-4325-ba8b-1c87265215e6", "value": "1536:gcHg5AgywlIDFSD4zNq94AbluKlAGRhl0IGLSOP:g/tN/eSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769640965, "uuid": "32dd341c-4bc0-41cb-848c-7a399b75dd7b", "value": 55015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769640965, "uuid": "0c9c11a1-66f8-4839-8c86-59968871c960", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769640965, "uuid": "6b3f21fc-f452-4bad-8bb6-139d5054b0d2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a584b5-fc88-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769632165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632165, "uuid": "71877681-6306-4ec5-93cb-944f24e91c5c", "comment": "Malware payload", "value": "591d1e23a0fefa4ed52535da2ee2ff95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632165, "uuid": "602463ac-0efe-4c53-8dfc-73250f1131ca", "comment": "Malware payload", "value": "807fc95d7aa6a24832d97242e60d0c2aeeeba06c7b99ca063721b24cdfa02eb0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632165, "uuid": "07c72f3a-c1af-4e8b-8c7b-f02a1bb4b1e3", "comment": "Malware payload", "value": "562d27dac1b1c45ad9469950fb2d4b62222672e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632165, "uuid": "aeaf9e1b-f723-4704-8233-eaa0051df733", "comment": "Malware payload", "value": "0c9b62ccec6e8754a981ef3101bb81bf9a86625d553b3a42e0df8845f22beacf487ec3296eccf06f0d9e4822ce597fed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632165, "uuid": "4376f6fc-1c9a-4ed6-bf9f-3090ca967569", "value": "T130045C02B70D0953E3633EF43A3B27D293DF99E126B4E644261EAA4D91B5D321186DCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632165, "uuid": "c011c1e4-08f7-48fc-bf77-d9e4c0fd6a5b", "value": "3072:oWBlZvP/JTwouwx8UPJyZ4q/yh9HPbNkRREr:oWBlZHxT/uwx8MAZ4q/S9zNkRRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769632165, "uuid": "b818a9f7-4a3d-43d8-b00a-fcb49ec7e092", "value": 182948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769632165, "uuid": "ee87f826-0691-46ae-bd74-f74574664608", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632165, "uuid": "ffb5180a-9594-4343-816d-d58c9d130d58", "value": "herios.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77809905-fc72-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769622900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622900, "uuid": "0e416725-78e8-45ab-91fa-2bd6413858e0", "comment": "Malware payload", "value": "b25645118878d440bb72b7f59269ef50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622900, "uuid": "42b03d47-5346-46e4-aaf3-c22b945e0906", "comment": "Malware payload", "value": "80d5a0f4d9aa11e8d59258418f99404cac285367c8315661e38185288c1c1886", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622900, "uuid": "37488b66-4b23-4393-bf62-880c0e7d9aff", "comment": "Malware payload", "value": "5977e7a092e6a4b409d8038104213cca92a3f390", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622900, "uuid": "252daa9c-c352-4c13-9960-3c893a1f552a", "comment": "Malware payload", "value": "cc34a8eaeeaafebda41160fd572124ad80df67e7b9e75c44de355088747feb186ebf8166a801f0e8605d34c5c2732652", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769622900, "uuid": "f690c36d-591f-4c34-bb70-6e4ba0221686", "value": "T18354C041139D8DEDEF6742380C6698D2326FECE893982246EF3185F86527C9B59DE3C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769622900, "uuid": "f69b371c-a791-43e8-8ede-1cee71554ece", "value": "0f187a431c47e7e3da95de55d1fc1de4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769622900, "uuid": "e4ac750b-ed43-4202-96ba-c534d222ed7d", "value": "6144:1CwFsu/4xUaopRXJxWCvm+v5twGyz7E7pZ8MTCIJ5PlgHO:Rf/gUaoTJMav3/PFTC05d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769622900, "uuid": "c68ed5e3-6a98-4ebf-a3c1-53bf6aca38f5", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769622900, "uuid": "2a18a386-112c-4e43-b445-7060b1e9079c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769622900, "uuid": "690566ee-87f5-4718-922b-0d8c18ec33d0", "value": "titan_e38ec2a0.cp314-win_amd64.pyd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf7f3818-fc71-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769622592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622592, "uuid": "c26344b5-61d7-4f32-a47c-0fb2733b3bb6", "comment": "Malware payload", "value": "bc7c061125e1080f08e7da57c8e1b414", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622592, "uuid": "1cd2a7e8-c68c-41e0-84a4-c69fa6ecb39c", "comment": "Malware payload", "value": "8148dc335fe2f3107b973dcb788c934045b92a22cb1ecda7e9af10918ae06a40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622592, "uuid": "2ce788d5-24b6-4dac-87e6-7a97662f7d6a", "comment": "Malware payload", "value": "6b7614291dd5c96a46b6671132dee86f032169c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622592, "uuid": "96d2ddf3-fce5-46b1-a78c-8f72b86cb446", "comment": "Malware payload", "value": "31646d351df188b479bfb0f7d0f2ae2d8fabda53e3c452290e7c60997ece1911f036ec2ca7eb37ab88ef3d0de7fcc87c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769622592, "uuid": "06fb06c9-fb7e-42e7-89d4-e6b49f1db465", "value": "T11EA423EAD5BB86C796B3E23D4404CD7E6A6601BEE5422507FA0CF160951C92B1F4FA33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769622592, "uuid": "19f436a4-a8c5-4a38-af31-936219170175", "value": "6144:ZnyquzduGcs7xSWmIdN2y1b+m6qB40WZL8TLw9xeBtGZRd9b2xFx7ILCt:NjuxpD7EW9dVbz340Wy3w903mEp8LCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769622592, "uuid": "1fd9781d-d69a-4da2-8746-008dfc41f69d", "value": 463072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769622592, "uuid": "cbbb620c-58e4-436d-a15a-a41920edfc6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769622592, "uuid": "7d687721-b2f9-4b3c-9f83-3cd24bb79dfd", "value": "poop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee410678-fc47-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769604631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769604631, "uuid": "57085667-be75-4807-8190-19dd05c1e1eb", "comment": "Malware payload (Mirai)", "value": "1b041369f4014005f22fc5fe394f44b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769604631, "uuid": "4ec9b3ab-442c-4d64-bd75-f953b3830c32", "comment": "Malware payload (Mirai)", "value": "81cfe7a09c71db0776f0baba68bc38e9ad9bc079e3805f15a57ee4a8faaea77a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769604631, "uuid": "9b9e8309-15e6-4208-b66c-23544b072f83", "comment": "Malware payload (Mirai)", "value": "1002ffdbf1f910d36969ae57bb9ed0080e274c5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769604631, "uuid": "f070e242-7f82-4091-acde-ef5103412c0f", "comment": "Malware payload (Mirai)", "value": "aba504c512b977166cbb1763d4dae3edba64d378a06ec99367599050540c397efb77dbc0e6899d412e73c3af6c960b6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769604631, "uuid": "2551f27b-608e-4fe5-8075-f3c5c95cd1d1", "value": "T18CA2D05547131492D174E8B6F89CD21273A185F8C2FC767002A4FB28ABCE3DAE6F4B85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769604631, "uuid": "5eeb955e-42e7-466b-bbd0-2f2c9007cbb3", "value": "384:VeY2zmbaEsSqxO5+BBOJmKdI1ORGSYPgCcTaFgJCOEXfbnhymdGUop5hoBg:UQXsVxq+AJj2PSYP7yEjs3UozeBg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769604631, "uuid": "8fbc00f2-c064-457c-aa88-0acf94b153d6", "value": 22664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769604631, "uuid": "1a0a26d0-c054-4984-849a-30724bbec77b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769604631, "uuid": "8ab99a6b-be4d-49c0-ade9-ef9ab988b7f9", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1914a50e-fc55-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769610287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610287, "uuid": "1f1ff88f-889c-4446-8f87-6c7bf6da79b2", "comment": "Malware payload", "value": "cd657db0cf55fc1e4666570488a39538", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610287, "uuid": "64a68cbe-d204-4db5-8904-8a96f7266387", "comment": "Malware payload", "value": "81d8dff9b4ef25be1cbfd9db394fde8b5d6e3159e6bfc07862a2ef91dad222c8", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610287, "uuid": "df742b01-aaae-4f7b-a8d3-e3e4f90d376e", "comment": "Malware payload", "value": "9d7df4e94c71f5bb916f40f437b0663eade2aedc", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610287, "uuid": "c58d3138-3e5a-41c4-8393-a62888b794be", "comment": "Malware payload", "value": "f848d21bd0512a5a2c83c88b322ef55a6affa46fb83b6cc0b8e7ac6fd3905ee01471ce5d66438e7fa8a800725585210c", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610287, "uuid": "6b3b8499-f503-40ac-83a4-a2f4b7ad75cb", "value": "T17A0156A12DC1665557EE424D567E2A0D435DB07A34A52784D2317F1888E897331F11ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610287, "uuid": "5c4c1051-022b-4189-9771-e7a507c7162f", "value": "24:BM/6SGS0X4gVeMoo4Xp78wnhNuNGwcCO9i80NH:8GHIggMd4loT/O9i80R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769610287, "uuid": "30c43728-f8d2-4ced-9e4d-a8a1d9a5c05c", "value": 843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769610287, "uuid": "8971cb27-1cb5-4025-8dc8-93f7a70cd9ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610287, "uuid": "ce1ac4e7-3705-4326-a1db-2f40d4f636ae", "value": "1rxTwO.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ed1f2a-fc63-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769616675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616675, "uuid": "0abe1dd6-a8d0-4945-823f-0ef48646101d", "comment": "Malware payload", "value": "bdd19606f9fb54603266827edb246352", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616675, "uuid": "2e1e9e52-be74-431e-97cd-ac5abdeaf79d", "comment": "Malware payload", "value": "828964ed5c6d166ff8981a759194c6511e68316d6e3c8d34364a59e96b4b24f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616675, "uuid": "85349883-723f-468e-aa7b-bc6196edc006", "comment": "Malware payload", "value": "f41f34d03807858f524cc97790739e84a8a08121", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616675, "uuid": "72f1ab49-eee4-410b-a7dc-897eb3f17688", "comment": "Malware payload", "value": "2fdbc4f01475c2f4b0e1e4de9410535304588340229f539dc70aca028f76644e9f478b2144f5d669b21f1d9672e3fec5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616675, "uuid": "32dacaae-cae8-46f4-a2c4-248d504f669e", "value": "T125C32A05B30C0D47E1633EF43B3B27E193DFDA8121E4E640655FAA8A91B2D32458ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616675, "uuid": "fca45c94-cbb0-4ed2-abe4-e0b75f13aae0", "value": "1536:6Id72MZ4ex10R39mk7orZb6wI0vAnjiLVRuzae8Dhq6N2te5f3dsp:6O14exAZ7cZKJnCNYaCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769616675, "uuid": "05a14523-74cb-42c2-99b4-b3cf52bf030f", "value": 121508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769616675, "uuid": "a5b06e94-de42-47c9-b4b2-5aa6687371e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616675, "uuid": "9913b7eb-e5aa-46f8-a6ba-cb6006587078", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846afc53-fc2b-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1769592428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769592428, "uuid": "4153cf51-9974-4d3b-84f9-a79ce4e1775c", "comment": "Malware payload (CoinMiner)", "value": "e2a421a1966ba02b5f0641532d2c81b1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769592428, "uuid": "40b54e97-67e1-4fab-a73b-90055f817635", "comment": "Malware payload (CoinMiner)", "value": "82f39fb649587c9d1ab9bb15ec839fe27d4c4f81524e49be1b21a43cd8747f7c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769592428, "uuid": "5bc8fd5f-c9b6-4f05-bd81-37e75d436a9a", "comment": "Malware payload (CoinMiner)", "value": "2344433e470b4525ce3b3dbb9e313a06f1e0b574", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769592428, "uuid": "e29bbf7b-5e4c-44c8-a386-5678211afd7a", "comment": "Malware payload (CoinMiner)", "value": "cb7215ad91cb59286706e328e001653c75ab5f90f5b68cea501f756d9ee8ce6facaeb5ae34f1ba8d90bad53bbfc6f7e7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769592428, "uuid": "bb48a8a3-ba93-4bb5-ace9-63ff618f8166", "value": "T196A52A57E2A350ECC16BC1348767A772BA31B86901347E7F1A94D7312F71E609B2EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769592428, "uuid": "46813583-2ac7-4e44-8f62-9fba23d9c421", "value": "4b97c69597ab53c6637b794f70ea3171", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769592428, "uuid": "b9922b66-ff16-4cea-b580-5a6f22d8d417", "value": "24576:FXeT06dzca9lVQqYeNhQrEX7qY4vBzHoSCxLCZbXkxdwIr4F7n6TAJhPdNou:5eT06lBjYevQoWY4ZzHoSCxLCZbUYLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769592428, "uuid": "f12440ec-abbd-49c5-9154-018522bd3a20", "value": 2256352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769592428, "uuid": "9717b94a-9c7d-485e-8621-7e6a37f83148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769592428, "uuid": "25be606c-4b41-477c-b250-d94e388f4ec0", "value": "Valorant Bedava Hile 2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57dbfbfd-fc39-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1769598366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769598366, "uuid": "b7bf325a-1c3a-4138-a1bf-0cefbda7644a", "comment": "Malware payload (SalatStealer)", "value": "17abe822a1c13af4e19e3e50be5541b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769598366, "uuid": "bd7ecf38-8baa-4e8f-b572-44c8cc8765d8", "comment": "Malware payload (SalatStealer)", "value": "846a83e9ff9dda31d051dccfb17ac8c0866e7ff33851cca367ec5c7f99bb4ee7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769598366, "uuid": "e4721059-58ff-4c78-9c4a-eaa62ce01656", "comment": "Malware payload (SalatStealer)", "value": "e9f07c55765a3a170d03d2c175f458a1f1017db4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769598366, "uuid": "9a7b8332-4584-4e55-b2f6-cbcf8e1b35a1", "comment": "Malware payload (SalatStealer)", "value": "cc8875f39300e50c53f28106e658ba09b0aa0f192717291238a922866e0aed95e45154a75984d235e28b7554acca96f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769598366, "uuid": "23c1bc94-5a42-4a35-ba0f-92503efeb382", "value": "T119A68ECA126AD2DE8646BEBD4B343F955EE9478E081980E0BD765E51AFB103B4CF4D30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769598366, "uuid": "4e740b0f-acdc-4a67-9c02-61b9ea22e4a7", "value": "652c45169574bb54d0e1b5b4f6fb8a9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769598366, "uuid": "d77e376e-44de-4dce-b396-e2d09737bf52", "value": "49152:5Fem82PuBZYbkBesyWJ99QUsQ9c86a5WaxrHG9sxwfS3bWoM3OvgaCbmxIlY0oY5:5JqZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769598366, "uuid": "5521a7a4-9256-49f6-866c-867aa61f73fd", "value": 10305008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769598366, "uuid": "68a531da-4e18-4baa-9dcd-c156ab3ea187", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769598366, "uuid": "74339669-3741-4c3d-995b-8fe00cbd1f82", "value": "Loaderx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5ae773-fc66-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1769617698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617698, "uuid": "5ef2a33c-0d97-4502-a104-c97b3b9e4a07", "comment": "Malware payload (Gafgyt)", "value": "7be10eb8c4fb555c471043d7d71012f1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617698, "uuid": "60eabf01-47db-402e-94c2-396b7639f3df", "comment": "Malware payload (Gafgyt)", "value": "84c3deee171c8ee76b04757d2ba862f4eb5152cebf0fb25dd2913d22c1fd0e4b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617698, "uuid": "249b6898-8427-4b56-b902-c4f108938f52", "comment": "Malware payload (Gafgyt)", "value": "4c4246b4aedd99cf280af5ab165bb81f1f013b0e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617698, "uuid": "27b4cc45-d021-48c4-baf1-7920384812ce", "comment": "Malware payload (Gafgyt)", "value": "a868fdb057b1588f3be94cb8e2b63f0d9f77a5b00257d2acabe05e63c05a1477839293c77c0dc96d397b90aea66537b4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617698, "uuid": "120b1141-41f9-496b-a69c-2a4dd6523b50", "value": "T112F0E8EF00B14C6D1244FA0AF9E20E78A80A69DD58C50F4C5F8F3C39788D9187835FA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617698, "uuid": "0a74df60-8164-454c-a595-b061ec740963", "value": "12:CLJoZDSLJhHWsLsySLshHWsLPBzvSLPBzMHWsLPnIjDSLPnIMHWsLPiDSLPDHWJ:CCZeTWsw5wRWs9z69zGWszJzhWsGeXWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769617698, "uuid": "62c6ab58-39fd-4f9f-80a5-0dd14fb380f5", "value": 640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769617698, "uuid": "7ddd8636-fc97-4a8f-b41c-17a579817dad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617698, "uuid": "40ba3f70-4cc5-4ba2-8c47-12b1ab7cd6e5", "value": "uni", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa1e364-fc9c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769641025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641025, "uuid": "89e702f6-cfec-4ca0-99c4-549b98f18903", "comment": "Malware payload", "value": "4d52f5815676df05d2eebf082d0988b8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641025, "uuid": "e1fbc021-b1ea-471d-9fa7-f32f8e097f70", "comment": "Malware payload", "value": "84de603c66f1b4d1192f0777d5fcf46b867b17c7a5dc419f876236fe425a0d43", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641025, "uuid": "df40d084-cd2a-43bb-8c0e-fe0db216297e", "comment": "Malware payload", "value": "e4bb546a2db3cac2df9701d8efdaa32b411f0cf2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641025, "uuid": "30168344-f74d-4b92-9047-47808d5e4ee8", "comment": "Malware payload", "value": "09f6dccefa06e5ed457b1b83d9ae7ec45683fb331694677f1400547c830bf9752ebe1abf88dead82d2cbe68147e1f5ff", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769641025, "uuid": "2936bab1-cf9f-45aa-84c8-42d72d2d8d52", "value": "T173336333D410FE0601A1EE55A2799B04D672D97748AD6418B60C4E4D0FCA9EA3BBFF4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769641025, "uuid": "ddb8a229-7c50-43ae-ad82-a917541a932a", "value": "1536:gcHg5AgywtIDFSD4zNq94AbluKlAGRhl0IGGEOP:gbtN/LEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769641025, "uuid": "081f2466-583c-47b4-bd78-b7e19162ccce", "value": 55016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769641025, "uuid": "c05b4f64-9ae4-408e-9e79-ebf470a2672d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769641025, "uuid": "bd0f71bd-b6d6-454f-b95c-80185674eaf6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f3f6e6-fc63-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769616669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616669, "uuid": "a6a56cdc-ed3c-4154-9a4f-b12bf0169eab", "comment": "Malware payload", "value": "4522fb834a96094d6de1556c9fe7df1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616669, "uuid": "b00e6ddd-24e1-48d4-8901-808baca22abe", "comment": "Malware payload", "value": "84e4680daac509b4ec84c2f0c7c3fef7f063c51f8d13f9a782f647a61425492f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616669, "uuid": "6d05d747-1f61-4ee9-893e-f12cf7ccc7c4", "comment": "Malware payload", "value": "7d5395f5c0a8d5b02d48361e41889558b4e19947", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616669, "uuid": "9b9711f1-050c-4677-89ea-841d1b922014", "comment": "Malware payload", "value": "651da0442cd78f10e68eb61bf1be37deaddcbca185fbeb14e87a833006f3facad48bee3f28b36a1f16954a69f39f8762", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616669, "uuid": "20f32247-3fbe-4576-aa15-904d457398a5", "value": "T140E3B71A9F910EFBDC6FDD3302A9060635CC954722A43B763674D528F64AA4F4AE3C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616669, "uuid": "dbaff710-df14-41fa-ade5-6cb34d72fd5d", "value": "3072:KJ7Vw1Cc/0s6YAPwenUr48pzfR+Joncy:KJxw1xAop0YfRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769616669, "uuid": "5e64a3c0-6b56-4517-8f0d-0577769e47b0", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769616669, "uuid": "1f3d1572-549d-48df-aaa0-6602ace5f080", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616669, "uuid": "286558ad-847c-4759-8225-7c6f179f343f", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b23b0da-fc51-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769608653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608653, "uuid": "923cebee-e24b-49c5-b4dc-ce8deb135ded", "comment": "Malware payload (Mirai)", "value": "92cfb8c00ab733918b6735ebb0b1d375", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608653, "uuid": "ea1784ab-1e91-41ec-b09f-092b4f4c762f", "comment": "Malware payload (Mirai)", "value": "85456466776f0d5feeb8080a24178d29fbec9e36bcea06f2f92b5353802fbd8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608653, "uuid": "b16e7ac2-c8d1-439f-a2c1-4c441e2b117d", "comment": "Malware payload (Mirai)", "value": "18ebdc34cac41fe2fd2faf485ce1ad40c4d46e20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608653, "uuid": "80dd948e-3a4b-421a-9b2f-15df68cfa19c", "comment": "Malware payload (Mirai)", "value": "9db844c32a18abd8fc1d75931a03fe66a63df751759822a35e0e56d712608cdeae7a2963442bcd4675b0c16fe65567c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608653, "uuid": "39c1e723-adce-4700-98bb-223746664f9d", "value": "T110532AC4B183F9F1EC02057C317AEB365E33F0B66139D99BD7D599336802E42A906A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608653, "uuid": "ce90abe1-e1ac-4e38-b6e4-192a75777e9d", "value": "1536:AlOjsJuCdrqVZIhOwc/NsgKqHXUWoPpdwVkRW4XZ4k7dhn:AM44CdrqVZIh2/N9Kq33oP/wV4W4Jx7T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769608653, "uuid": "482eb236-a1ec-498a-b5fc-d9aef33ccd6d", "value": 62224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769608653, "uuid": "afde6e9c-19c5-45c5-80fa-77110f2f8092", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608653, "uuid": "0ca9614e-8ee0-4b62-b880-a3ac51b477f0", "value": "astro.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c52ac35-fc91-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769636169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636169, "uuid": "17fa0d58-b97b-4e35-b90f-c4507f655065", "comment": "Malware payload", "value": "45060fb2904ba20c60945467b3c8021d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636169, "uuid": "3db29701-e3ef-4793-9355-b7b56e371d2b", "comment": "Malware payload", "value": "8575df4fd80e6d2b46152dc8ca5fbdeaa16e2b93a8b61ea97df65b9536edec01", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636169, "uuid": "86d28b54-8676-4e06-ae08-6201ac909b2e", "comment": "Malware payload", "value": "9e7802e8beff92582b03186e120115dafdea8ca6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636169, "uuid": "ba52a10e-1a04-4e98-b6bb-5df1dbafa20f", "comment": "Malware payload", "value": "36e3d7ebab0ceb24c494d6e64ac42067cb6bc06355ae09bd49a941b33d71ed6fa9163732b112688e1c0fc06353590491", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636169, "uuid": "1452c6b7-67e7-46fb-bd30-3dbff71f54ee", "value": "T1A5336333D410FE0641A1EE55A2799B04D672D97748AC6418B60C4E4D0FCA9EA3BBFF4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636169, "uuid": "9028cbb1-7282-4b36-bee2-87469a0377f8", "value": "1536:CcHg5AjywrqIDFSD4zNq94AbluKlAGRhl0IGWv1kA:C+qtN/vvB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769636169, "uuid": "edfb214b-de4c-43bc-8a67-1b68ebd49228", "value": 55045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769636169, "uuid": "2be6e118-868e-4754-a8c1-bee559956f0c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636169, "uuid": "3b23c15c-de3d-47bc-ae47-98026189a178", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d06c009e-fc81-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769629492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769629492, "uuid": "a5ad590c-b6a5-470b-a102-831778e62953", "comment": "Malware payload (Mirai)", "value": "9dbac21af28eeed3b725924e3952a1b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769629492, "uuid": "04d04066-ef7c-48f7-b60c-256322a806e7", "comment": "Malware payload (Mirai)", "value": "8590fca6bd80f48e8a59389a4a6c2cac78525f4108282f52f8736e596978b9be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769629492, "uuid": "7a0072b1-e771-4d2c-9b83-a91c4cc820b6", "comment": "Malware payload (Mirai)", "value": "2a9237d46deb0798ffa7b658115ca31829ba5b55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769629492, "uuid": "f1e0ce98-03f3-4d68-9665-7720cf649d3e", "comment": "Malware payload (Mirai)", "value": "047ab88e29a28d9598b75be14f17c4e5adc5279ce5ad4f5edc6660c0f0d53b97dc8df3c49f46836e9819e30c1373a0b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769629492, "uuid": "8789ea17-fad5-4571-a214-8ce5b9fc16c3", "value": "T13CB34CA6B400DC7EF85BE7B780571A46B220A3F44E436B377617FD13EA2E1B41826D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769629492, "uuid": "40b3abdb-63cc-4b80-b53e-1e2c909b0fbd", "value": "3072:MCWtjip+nJoFSiEatMXfvK95zKsPcuGzeR8:Gtjip+nASLagfvKPzwuYq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769629492, "uuid": "498ac3db-be7f-440f-ba73-54d99dcad363", "value": 113312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769629492, "uuid": "d531b4c4-0194-4e40-a9a9-ca0334929657", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769629492, "uuid": "d1cf344b-fc8e-4acb-b91b-7705315a0ba1", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61cfc39b-fc8d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769634461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769634461, "uuid": "cd73cd18-7a61-40b9-a147-5949ba0426fb", "comment": "Malware payload", "value": "66cb7084d9bbc5e869bd0a7756e320cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769634461, "uuid": "d9708664-3ed0-4d46-abd4-ece12719f2e1", "comment": "Malware payload", "value": "86a89d23fc74b81cb10aee961f4f21d5e91bb72156223155bbfd8ba4c2b727d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769634461, "uuid": "9f48d6c8-ff3c-42bc-a8da-388c1e2b9f44", "comment": "Malware payload", "value": "fd0108f2b839feb219a9e838d59d30bb9a6a4bff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769634461, "uuid": "46721ff3-ca03-4de8-b04f-f4fb89a20957", "comment": "Malware payload", "value": "6daa012deb2f9f7e30705b1af83139a6b673a45910c5f9f24bed52be842e6a441b3ace0f48666b227b08a141d2f8cf1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769634461, "uuid": "c3ea9553-77d1-4371-ae60-4cf24e8afac8", "value": "T100C4BE63F2252E43C4E3923F1567C264937BDA5513918702A70BF6BC3DDA66A8F1A3C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769634461, "uuid": "d375d123-5799-4ebe-bce5-06ff966c7bdd", "value": "12288:XxgPh3K7L5134bXcJKYWr//AsmW8pYJizsncKbcmd+LK:Eh3i4LGfWr/nncKImd+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769634461, "uuid": "a4ac5aac-eac8-404e-b5b4-7dfbc1e1375a", "value": 585384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769634461, "uuid": "f274f6c8-0d78-4720-ba9e-9eca8c783a8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769634461, "uuid": "9a9bac22-389e-4f74-bd00-c6140da21173", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873ab1a0-fc64-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1769616914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616914, "uuid": "824a4714-e45d-49ec-923d-f5039880ce96", "comment": "Malware payload (ValleyRAT)", "value": "4924da7878d5e94f8e9b6692ede0c96e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616914, "uuid": "91691473-5a93-48e5-b83e-a3fed50baf8f", "comment": "Malware payload (ValleyRAT)", "value": "87301b1942b5261c3fe8bf8a05d66335b6437239ed9c8afaeada108d7ee4890a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616914, "uuid": "8885b85f-4d75-4e02-9a68-886f20946ea8", "comment": "Malware payload (ValleyRAT)", "value": "9275001a9d06f342348a4b4c8f6299b41e6da5e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616914, "uuid": "61eb385f-7a77-4e48-ae25-32e8360185b1", "comment": "Malware payload (ValleyRAT)", "value": "07474e85d6fa5552c797c2cdf05d5028df3b02c1c0fff6ee1cf89a7c0f026a232215f3560ba8af15762014eeb7c15ed5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616914, "uuid": "6dba8ef9-af5b-435e-88af-adfa99d716fa", "value": "T19D867B01FE8B59F6EA43263055A7B26F63349C054F36CBD7EB507B3AE9732911832219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616914, "uuid": "466eab61-01ed-4ecd-8fbe-a5304a9d5170", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616914, "uuid": "e3ddbaa1-4bb8-48f4-b313-27a409ca56c7", "value": "98304:vfwAmgrE0EOzsbRiOCJQ13lt/Etyx7RCfRa/7pN9QIoizoag/YFy:vd5jWd1VtcoZRCRa/7pk3iO/YFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769616914, "uuid": "bc9869ad-a807-4379-835b-789d6aedff1f", "value": 8323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769616914, "uuid": "777c2d55-6ca2-454d-b077-2abaa79f0cae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616914, "uuid": "a6d0c689-94a0-4baf-b28a-c37d3423ab05", "value": "87301b1942b5261c3fe8bf8a05d66335b6437239ed9c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b2fb0c1-fca0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769642476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642476, "uuid": "7b33d5b2-e9e3-43f7-a758-0ca2f4689713", "comment": "Malware payload (Mirai)", "value": "6bdecfac2905742d6bc47a556b954693", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642476, "uuid": "dcef25b6-7669-48a2-836a-111c1ecfe608", "comment": "Malware payload (Mirai)", "value": "87367446c474988204534e92a221b9a6c507cc966b005ca2073c630d783acc74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642476, "uuid": "9cdb68c1-4af4-481f-b933-75d18d5450bd", "comment": "Malware payload (Mirai)", "value": "2634b0c6c0c945e7d3b9e11e369f6ea3d763479a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769642476, "uuid": "c7ee5670-358a-448c-b2c1-96ec056f7595", "comment": "Malware payload (Mirai)", "value": "70085e204e4723287076490d7e6551ca8f7e61f08fa41c5cfae0c88557b772d9358366614f86886a99cc1436e4bd1ada", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769642476, "uuid": "b455130d-6528-48cf-8fef-f1e484942cb3", "value": "T1B6631995FD818612CAC16576FF5E429C771A03E8E3EE73039D296F20278B56B0F3A905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769642476, "uuid": "b006620e-f8bd-4d38-9a33-84e6fd0b6827", "value": "1536:lxQyqadxn6w2VcaX5+JvBaqDGD4xGuatnNX3iaXx:LQyq6xn6whaX5olDGDQGdtNiaXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769642476, "uuid": "129cc723-45d4-4b1e-9097-6ac75b7ab1e0", "value": 69616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769642476, "uuid": "260a1bd8-d03e-4296-a05f-24e1d9faa2e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769642476, "uuid": "a1db49e0-f94f-479b-896e-b79661885954", "value": "nabarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ebf7a79-fc3d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769599961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599961, "uuid": "41d857ef-2636-4231-90f8-c582b63aff21", "comment": "Malware payload (Mirai)", "value": "113241841016db40db5cea8aac4e2123", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599961, "uuid": "ada2c9ea-210b-4160-996f-c45259089c9c", "comment": "Malware payload (Mirai)", "value": "873da354093954fa3b896dd5bc5f93c9236a2c523471f61d1362cda6f787ba20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599961, "uuid": "dc499184-57fc-4c93-b984-d703bb577c46", "comment": "Malware payload (Mirai)", "value": "762f14557adea346e47a906f4efa2008fa3f2bc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599961, "uuid": "a6968a8f-fdae-4def-bf90-8bd01fa39cbc", "comment": "Malware payload (Mirai)", "value": "f05ceec95009468bcf953a2950ddc83be1227656a1edacdc90499ab6c60548e71c891c8897000652d99ffebd974751bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599961, "uuid": "2c8be7ea-b55f-43cb-b587-6855bea4088d", "value": "T1FCB30889BC858B11D5D535BAFE0E618A33138F78E3FA7113DE145B2A538E86B0B3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599961, "uuid": "5b6b78d3-e8b1-42ef-82f2-0c3cb29d6bea", "value": "3072:AUDQWHCTPWCsExPfdWiXexoe27LbNiGIdSdDeR2+X:roWYdWi827LbNibdSdiR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769599961, "uuid": "98f3b8a5-f3c5-46b1-a7c5-9a7dce466756", "value": 108188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769599961, "uuid": "ed6bf82f-fd7b-4c39-84be-94d402892f67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599961, "uuid": "6b2fadec-334b-41d5-9dbf-340523bb7dfe", "value": "zerarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed5435f4-fc2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769594322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769594322, "uuid": "070f4c2f-515d-4242-8ba9-9c16bee37d01", "comment": "Malware payload (Mirai)", "value": "a9891e35d6d86f8d54a37d9905cb1a2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769594322, "uuid": "06a16842-0003-4414-b465-3a46682f53af", "comment": "Malware payload (Mirai)", "value": "88441ba224c8e8e86bf8a57e8a67095c061a917665cfc6dd52b7611acfeaa1df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769594322, "uuid": "f409ba46-db2f-4ebd-833d-4b4961fdcd0d", "comment": "Malware payload (Mirai)", "value": "31f6b7c7448cf6396fbc1a19d626df8b71b4d32b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769594322, "uuid": "ee494efc-b8c8-41e5-a616-3557fb17306c", "comment": "Malware payload (Mirai)", "value": "07fdc5c6a67dec4ec7b0629c40b48762f775ac7714d8e02a1f8b577e7671e920162982275973a2724a7857fa8882c7dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769594322, "uuid": "53f6c9dd-f38a-49da-a17a-1f54a6f528c8", "value": "T17493298ABCC4C702C6E0A0B6FB1F959E371643A8E3E6B107CD19AB29675F8570A37151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769594322, "uuid": "665ae543-3f15-420e-8f47-64ba05b21d13", "value": "1536:w1rTP0K47DeABf2lRxo4GO/EJ0rjy2o8y50eq2Qh5yXnX:wRTPH4zZ2llb/PrjyIy50QQhcXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769594322, "uuid": "2bf102b3-6b99-46db-8457-a0368f509797", "value": 89980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769594322, "uuid": "437c6205-4168-4ca7-b840-5a41148531c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769594322, "uuid": "14d8783d-ffe3-468b-ae7a-9cb6b4f590c5", "value": "nklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64536ce4-fc42-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769602252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602252, "uuid": "978bfdd5-48f1-43ff-aa91-a4986c2b0bb7", "comment": "Malware payload (Mirai)", "value": "3f962b6d612a8ef1f1825462cb6af602", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602252, "uuid": "e21e832a-109c-4451-82e3-c5f0540426c7", "comment": "Malware payload (Mirai)", "value": "8895afdf7c48e61ce84e791f2242add856dca46dcaeaef1c59297465d173ae5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602252, "uuid": "62411999-653f-4e60-8b1c-646a37fa050c", "comment": "Malware payload (Mirai)", "value": "467b81e986ded2f01ba0a28093876cb215d31610", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602252, "uuid": "90ca3070-fc81-4496-b62e-feaaa2f07e6c", "comment": "Malware payload (Mirai)", "value": "19e836c3738e97cd29c132907a7973c7a70fc86a987e1afd78586a6308b0b7708e845ab8d06cc5e1009a87bea779a5f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602252, "uuid": "3fc62b58-bb01-4281-8334-ef361136361b", "value": "T1378318A6B410DC7EF45BE6B780530615B130A3F54E42AF27762BFD23DE6E1781822D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602252, "uuid": "9a066717-03e1-4c13-a8b1-10432b1496c7", "value": "1536:enZuuJdio2O1Yxt3N4VxH7ItJLl/WuVOrYOgVkO8Ro81Q/:enZuQ12WYxluAzenrNgVkxo0Q/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769602252, "uuid": "04b2bb0d-eea4-4ea6-8194-a11500709798", "value": 87564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769602252, "uuid": "66ef7381-ab33-47c1-9903-07e02e64a9a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602252, "uuid": "c6749236-8b81-443a-9e3d-a14f43343db4", "value": "zerm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0721d2d6-fc18-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1769584057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584057, "uuid": "068bbfdf-104c-495d-b6cd-0499e97ac809", "comment": "Malware payload (AsyncRAT)", "value": "672f378114ee103286d8e2bfd2a7e9db", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bknoww-com", "colour": "#F8EF07", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "wmk77-com", "colour": "#33F251", "exportable": true, "hide_tag": false }, { "name": "wmk99-com", "colour": "#F3305E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584057, "uuid": "3bc65e13-edaf-4161-b76e-59eabe116e5a", "comment": "Malware payload (AsyncRAT)", "value": "88e751761b569a5cd865ed526110428d710b6ce0533a68b5345d88e706197951", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bknoww-com", "colour": "#F8EF07", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "wmk77-com", "colour": "#33F251", "exportable": true, "hide_tag": false }, { "name": "wmk99-com", "colour": "#F3305E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584057, "uuid": "34c20409-27c6-4202-8a2e-7d434b7156f2", "comment": "Malware payload (AsyncRAT)", "value": "2bb61cacc4450248a98881f4c42ca2db499bf611", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bknoww-com", "colour": "#F8EF07", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "wmk77-com", "colour": "#33F251", "exportable": true, "hide_tag": false }, { "name": "wmk99-com", "colour": "#F3305E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584057, "uuid": "c6e7bf66-141f-4597-bfd7-0707b3981f3c", "comment": "Malware payload (AsyncRAT)", "value": "7a26cbc1baf72c0ba29a1e279c39273bcff4809ad0930ceffc51e91341f19ab57566c95b6d08a1dccbdb0a7e0433c92d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bknoww-com", "colour": "#F8EF07", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "wmk77-com", "colour": "#33F251", "exportable": true, "hide_tag": false }, { "name": "wmk99-com", "colour": "#F3305E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769584057, "uuid": "54b1437c-38aa-4ace-aba2-a7e618ca63b5", "value": "T13E614E4B21A1A2308742133A456F6588312E8967250E6D14FCFDC2847F39A2A9FE77D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769584057, "uuid": "3015cb80-373f-44c0-8f7a-b5901aa5ce1a", "value": "48:krdevQuw3lCCO5s5DMhCOGNfyXlxCbsOAvQn0NNVWcOai8HHzd5JFND1yUZJWeye:k00gCtWGNmxvXO0NNrOx8RWvogyhi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769584057, "uuid": "aea0f105-607b-4ce8-9bc9-baa3a697a576", "value": 3173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769584057, "uuid": "e5a1077f-3c90-4d9a-8214-478f0eea2908", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769584057, "uuid": "7464ff39-d1db-42c4-9584-ba4bf2a3565c", "value": "sm.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122617a5-fc88-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769632179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632179, "uuid": "6378dff5-8f75-4c5e-b4a6-29a5d3e3106f", "comment": "Malware payload", "value": "badad040f522f9702b34d8bfe12dcaef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632179, "uuid": "1d68776e-f420-4e8b-8d5d-f4e0a896258a", "comment": "Malware payload", "value": "89241fa9722f1c8dd2e197c843818d538095ed34119e40dc64636c4a0c47e8aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632179, "uuid": "a6a7c81c-79e3-47e9-b5af-7ea5c91ab5ef", "comment": "Malware payload", "value": "181365d42b728a9d8853b65cae94d25bb548e3cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632179, "uuid": "0238106e-03da-4815-a3b1-a356b3f2bc62", "comment": "Malware payload", "value": "2badb5c85c26dc3668d1a77727ea33635704812f06c4b2f5170ee116987231981c6722aefc2cdf6cd5bdafc7c8070753", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632179, "uuid": "edb2c3ee-607f-403a-902c-d0ede6e49a1d", "value": "T1DB047C1BB5C1A8FDC4C5D1759B8FE636D9B2F4092130716F13D8AE262E8CE216B6D390", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632179, "uuid": "9f7e4471-cb8b-4339-b672-9de69e5b311c", "value": "3072:8clH5Wms117VVs1EIgq9ttYfAcUU1T1aJ5/ZcX7jea+H2btTVxAk2EObG0:vt5h6Hs9S5t5xr9+4TAk2EObG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769632179, "uuid": "5cdf58e1-9838-47ab-997c-5a66899f9f7b", "value": 188328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769632179, "uuid": "789ab76f-11c8-4766-b9e8-50fd284e4c06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632179, "uuid": "8004ed80-08f6-4eb5-b219-1c0c70251f3b", "value": "herios.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "051aab89-fc28-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769590926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590926, "uuid": "7c92fe43-8f47-4e66-9aca-fefc286666f8", "comment": "Malware payload", "value": "65ac7b38c2d9c269684298da7b5fc7af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590926, "uuid": "100d8ad1-30c8-4e8d-9a63-1a1d41e31772", "comment": "Malware payload", "value": "89c98d6eaac5bda6722d99936350c576e89df6cfe83236d18c84cdc10a6a1d06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590926, "uuid": "865b87ad-08a3-4935-8036-a9e51ae57469", "comment": "Malware payload", "value": "289a95e4a8b9b9d5a8dcd57399709de79854100b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590926, "uuid": "d9d75ccf-481a-4d23-b2c7-17ef3cd0ee44", "comment": "Malware payload", "value": "49c7e02fd186c2c2291ec065e7c80ae3bd512d0f25063a720aa87d9eae94a608bc86ea392bdf61cf96f2a9551a9ffc71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590926, "uuid": "6de6e7aa-24e8-45b4-9b62-609f267b28c4", "value": "T10E839E40FA20D496ECB1C73610765E375EB3BD2AA8B0160F0B2C3A647EB76D2551F927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590926, "uuid": "ad8b6878-e4ef-4f29-bed4-9b15e4c36fbb", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590926, "uuid": "0e89e762-cb63-45db-b225-ba5876d90103", "value": "1536:hT4HrN+noJHCq0Zs0s0DAVeu6TpH1wPX61zHRpBVVqE:hTIN8ogtjDAVeu6TpHmf6FHRpBVVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769590926, "uuid": "ff1c70ee-0efd-4ffc-8bbf-c074fbf62431", "value": 83856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769590926, "uuid": "04a9c923-7668-42d2-b13f-69e43b2ad4f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590926, "uuid": "07faae55-8b4a-4917-ab56-c0abc384635b", "value": "89c98d6eaac5bda6722d99936350c576e89df6cfe83236d18c84cdc10a6a1d06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e802a622-fc3e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769600755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600755, "uuid": "db436849-64b3-4f94-be6d-ffe120dc926b", "comment": "Malware payload (Mirai)", "value": "00aa5159d1c9fd3665aed3d2d73bc19a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600755, "uuid": "5e830a33-2cd1-4c8c-8dc3-827beb5ee721", "comment": "Malware payload (Mirai)", "value": "8a2a01453a985c4eb967ebb5453d54d6548531851f86a7ce709653fbf52b7c95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600755, "uuid": "76ed6fc4-5b22-49b9-908b-8280251217d9", "comment": "Malware payload (Mirai)", "value": "bc496b62cf012ec7618520893aa448c051f94289", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600755, "uuid": "290dfe31-ab32-456e-b538-f08515cb355b", "comment": "Malware payload (Mirai)", "value": "657ad1b09c422e359353624d0643ab0d810c0ff0da4a5f6212c2a531ecab5e84e898b665fcff508da1f5e611103da275", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600755, "uuid": "4537e01d-9816-403a-b649-a7cc2f27901e", "value": "T183A32DDA7C818B11D5C156BAFF1E508D33135BB8E3FA7213CE185B2A574B86B0A3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600755, "uuid": "6f2f35d1-ef24-44d1-89d9-de0b2e829c59", "value": "3072:tBL5OCsqqItESYfsSFleb24efVdpc19IZKdmiuRX:Dq67SFleb8w19YKgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769600755, "uuid": "94ff7877-70b0-4b70-87e8-27ed0967d92e", "value": 104264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769600755, "uuid": "565df21c-6cc8-453a-b229-23c54abdc816", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600755, "uuid": "662b073d-8cb3-4980-ad3e-2d9be9f4432c", "value": "jklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81500614-fc71-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769622487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622487, "uuid": "eabc0aa4-5d97-4720-84f2-48bcebd44663", "comment": "Malware payload (Mirai)", "value": "c6bd2fa017568b6967576dd84ba6b546", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622487, "uuid": "8056bb00-fffd-4943-bec4-8b78ed5108f5", "comment": "Malware payload (Mirai)", "value": "8a3f7e074169f25e4c635ae59e66605d3f68fa771b5f4bd40515e0870059bf5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622487, "uuid": "e1ed5806-f590-4c6f-930a-145f2b222e05", "comment": "Malware payload (Mirai)", "value": "b7911ff70755e0e979ad9461ac3edb2c14f8704f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622487, "uuid": "75f3caef-9742-4b4b-9360-e6f16be2d4f7", "comment": "Malware payload (Mirai)", "value": "2d11870ddaa0e3182dd43847e0a7bae718465568751898864ec8f7c345a685b619e7efebb6b4ea8820adf76153328e04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769622487, "uuid": "016609e4-83d9-41f3-ac24-2ede71258031", "value": "T1EC14861E6E328F7DF368873447B74A34975D23D627E1DA84D1ACC1152F6028E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769622487, "uuid": "fdbe003d-dcdd-4baa-83aa-0c49ce77617a", "value": "3072:DLhm8vqdCRnx+yiOZ23phlHHRBmn9KNLZAdiwHdzqJnSb:DLhm8vzriOM9RoEux9zq1Sb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769622487, "uuid": "ffc46b39-2b3a-4618-80d6-86de07430926", "value": 203416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769622487, "uuid": "1ce12a4d-5321-4ef5-98d7-0fa81d95cdae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769622487, "uuid": "763098c9-1258-4e47-b80f-69a1666f8f0c", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a58bae5-fc88-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769632166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632166, "uuid": "828bf6c6-fac5-41e0-9d98-0edc5ae3bd96", "comment": "Malware payload", "value": "51e208491e2331a2c998991cc48b6760", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632166, "uuid": "74ed570f-c859-486e-b366-9cbfe0d575c8", "comment": "Malware payload", "value": "8bf5b0d856837364297a6af3a64b6b70f7eef3291428d642aa36569b611965cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632166, "uuid": "93d5069b-cb10-49e3-a500-b57507d0af4c", "comment": "Malware payload", "value": "bf56b126f09e7e4bb92a10a3b8a2c5e8c0435374", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632166, "uuid": "fe41b0d2-4413-4679-9402-9010062e60e2", "comment": "Malware payload", "value": "271a686c3278ce2960bbbced43c1e34f45b002f0b2cd17b364f967db5b9599d4244b7ba8b81386e341204ecbc34f36be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632166, "uuid": "12c7314e-158a-4c12-8230-dea316917aa2", "value": "T17834B65E6E228F7DF2A8C73447B74F30975D62D622E1D6C4E2ACD1041E2424E685FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632166, "uuid": "41c48a27-f8c5-4cb0-a234-6e6007ba1793", "value": "3072:jRaiTqtLXskq9yObO194vpw7tBmwdPPTSa5KKPmp6:jJqp899yYOYyxBmmP35Kcmp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769632166, "uuid": "bf4e5b93-1804-4765-aae3-79d6dfa192dd", "value": 241380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769632166, "uuid": "ffe6000d-ec4d-4376-8da4-c66bac6dc5f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632166, "uuid": "68af073b-1e81-4eeb-abab-77a72e0a07e0", "value": "herios.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a40d2b2-fc45-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1769603390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603390, "uuid": "3b6ca731-b595-4f08-bbd5-117c91aed04e", "comment": "Malware payload (Stealc)", "value": "d26bf8ace0dbd944e14016f6a1e03c50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603390, "uuid": "0993eb40-e3f8-4384-8e21-4d0f40232df0", "comment": "Malware payload (Stealc)", "value": "8d1a0d68b7544de045948605b1afca727e2fb0281564c0ed8c10c0989b71f632", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603390, "uuid": "66c8b22d-5726-405f-a33c-8542c5846113", "comment": "Malware payload (Stealc)", "value": "b6484623cc91ff7c075bd9e86e9ac81a31489c6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603390, "uuid": "01df1dea-21fd-4392-b017-8f9406a14605", "comment": "Malware payload (Stealc)", "value": "cca1f5d22f801c16faa0d86f2683b50cddd055b1f3b5bfbc8fc04839aedc0853bda7237c455a5d442e4fa24d7749675c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603390, "uuid": "dc3b0186-b688-4035-bde8-40359f4b8289", "value": "T11ED49D22759194B6E47705748D78EB558BBDBC700F606ACB23C00A9A5E706C0EF37B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603390, "uuid": "85af5c71-9e2e-44b2-9556-342fded84f68", "value": "23b623d5aadcf64cb25b8fc4c13b1df7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603390, "uuid": "a7e46581-f196-4d4c-87ba-3c50d8c7d5c9", "value": "12288:yM8EQf+pKUX2wfW7ks18/EN6ALSQTbAK4lNl5E:nAe2H7NwENzCli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769603390, "uuid": "2440c4c9-dcc1-4dfa-b390-3e8e946ce130", "value": 607744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769603390, "uuid": "17644464-9446-4d46-b727-93cc1609ae66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603390, "uuid": "4bdf9871-b7d5-4935-a140-07ce8cabcff6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "011f28e5-fc64-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769616689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616689, "uuid": "c7229956-72a7-4db5-821e-e980fb6a59a6", "comment": "Malware payload (Mirai)", "value": "fec9557db24d43e49289d2b99eb84e88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616689, "uuid": "ffecf357-533a-4aa1-b858-b517a8aba61c", "comment": "Malware payload (Mirai)", "value": "8dd2b821030ea90df06e80af282409f5bfa981a2e5c15eb9828bfc3bfe9d0f18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616689, "uuid": "477162c2-f6fc-4922-bbd9-d7c688681d13", "comment": "Malware payload (Mirai)", "value": "7954e50af5332eb4a6e53c3fa5b85cfd42e379bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616689, "uuid": "a7fd150f-f54b-4b95-86c1-8a7d29a2e0cb", "comment": "Malware payload (Mirai)", "value": "f9cc3d67e96d751138b9c7190abb2a60d4e06a149d4c2f0f60e8db2adb084913e534017c77acf2a235049c3831089f5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616689, "uuid": "e0d217fd-b1ff-4a53-8540-251011599ffb", "value": "T115C39DA7B24F1050C82647F41BCB579C2E3325019E2B9AE77C6E373E1A769DE58063D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616689, "uuid": "edb970f5-d936-4d1f-9d72-a14d20e28225", "value": "3072:of0GAArzU5n1RkclSyVDKd+AqLmgbgiCrheiiU4hqG:of0dV1RkkSAzDLrnCrheiCqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769616689, "uuid": "337394da-c331-43e8-9bd2-3609635b3320", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769616689, "uuid": "2718b577-290c-43d1-ac13-b331919d678d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616689, "uuid": "c0f6b0ba-e765-4060-81f2-a507ec50d8f4", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a8f6d1-fbfb-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1769571861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769571861, "uuid": "910e07ef-3ce2-43a1-adb5-e57087578aab", "comment": "Malware payload (QuasarRAT)", "value": "4e7a97a26a4330b502784ae61d630194", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769571861, "uuid": "ef5bf98b-8fff-41d6-b206-4fb24a4df1d5", "comment": "Malware payload (QuasarRAT)", "value": "8ee2ec2284e50ce2c40a5595892ce9d908ed3531db8501cc7bf0b3c051d4cd3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769571861, "uuid": "9272cccc-9357-4022-9796-7870e3c6bb91", "comment": "Malware payload (QuasarRAT)", "value": "6006598ac518eb6622b6c82a73469a63fd515ac0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769571861, "uuid": "494c341f-e759-4c1c-a0b0-d924a7265bca", "comment": "Malware payload (QuasarRAT)", "value": "fea2fd7f5537a932d36fa6e9bfdac4cdf15c38e641ca1f9b5282f6de5e486f8919080dedc13df7ecc62f02c50e812ed4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769571861, "uuid": "18a84bc8-44b4-4c40-8367-2cc6320d4d92", "value": "T1BBF5239A9D55CD90C9613F78C13299304233FC64A2F1D78AA85A7CBB2FF7376101A85B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769571861, "uuid": "21be69dc-7e2f-40fe-8c4a-cee73d66d7e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769571861, "uuid": "91903d57-7551-4e8a-b050-87220cbfd1cf", "value": "98304:alabnbvio7j/r5Iw+bPC5Lb48jctj4aUwCpUy:4ITlj/r5IjbPCE8AtjNCWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769571861, "uuid": "6ecd9a21-47b6-4a3c-9dfe-86612bc460d2", "value": 3472896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769571861, "uuid": "556a0d5d-3ac4-4e40-9172-a51bcaeb5266", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769571861, "uuid": "139411c2-5380-42cd-8ea8-28db4fa0c4c2", "value": "Dokumentinformationen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66101bd9-fc42-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769602255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602255, "uuid": "a43d7faa-4576-4d14-9742-32415b28ba63", "comment": "Malware payload (Mirai)", "value": "85a424b507e6a4b4972e16880fb3934a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602255, "uuid": "a5f51e02-7aee-44cd-a0c6-8b4f7fda4ee0", "comment": "Malware payload (Mirai)", "value": "8f05dac7c6e390eacfc705d61c0d6d4987fb848ca14e493c9c13b59ee040790c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602255, "uuid": "6f57aa23-d767-428e-9438-215ecd0a6554", "comment": "Malware payload (Mirai)", "value": "20c389911237dca8377075d7f6fdde74d1d4d332", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602255, "uuid": "c4a29924-3de8-4c3b-a3f2-d05a37ff32cb", "comment": "Malware payload (Mirai)", "value": "d5ce671459cca9c1b48214d38225fd1be84dafa61e2bb2db1aac52e866eb019253eaff07786c93c8bffa1ebd58c3457d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602255, "uuid": "5d081aa4-f605-4402-8bd7-b78f9b30e000", "value": "T147665C17A5E324FCC1DAC074476FD623BE71B8A942247E7B2298AA312F56F50271DF21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602255, "uuid": "6d9d87bb-a83d-4115-ae92-e3ec676c4d61", "value": "98304:g8DPu7AJOgt5Gnuk4zX06WOESLAsNFeuLSgPETesUVLFqK4sB9sPBVrZDEtq+Udx:OVaGFesaVBjHmxN9NZozI1olQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769602255, "uuid": "b4c5725b-4a1d-4051-af59-8f66d672c353", "value": 7104472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769602255, "uuid": "48a7d83f-8fae-4fb3-b951-16d6baaf46bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602255, "uuid": "1092928a-2ec9-48eb-8cb0-6b86f7aba8b1", "value": "f33.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67fce17d-fc65-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769617291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617291, "uuid": "dfafd168-5b4a-4b64-9790-ba846d18a32e", "comment": "Malware payload (Mirai)", "value": "e81e0198d0f19b1effba0d257b39703c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617291, "uuid": "eda3d294-8189-403a-8ce7-35337866c174", "comment": "Malware payload (Mirai)", "value": "8f0615911c684d815ba64398f6d2c6cb5ff937eadc8ea4c7e18dfaf914181bd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617291, "uuid": "7537ea7e-8f5b-49aa-8891-66ca31c9763a", "comment": "Malware payload (Mirai)", "value": "133de10eabc7f9b77abb5546bf5e760799f819ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617291, "uuid": "f34e7026-552c-4b53-aa4d-03d8e9e115ab", "comment": "Malware payload (Mirai)", "value": "65acf99d149fb92012ff54cd7d5c1a9fe5244d974ad3e137fc311498ec8e9635c0774f77880f141bd3f49442cabc2467", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617291, "uuid": "3c15d0f7-13ee-45e3-957d-94a0e6069838", "value": "T10B334B42322C0F17C0A35974252F5BE487FFFAD122E4F685251F8B668A78E371489E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617291, "uuid": "024f83aa-2223-409c-9976-cc56782deace", "value": "768:3SjbGSLlRrYj0a8C/dQOhPC/+I20Ja6ZZ+GwPS4yns96BktDgIPi8TwU:ivW3jdQGqt7Y+Z+zN9cGgI6bU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769617291, "uuid": "d7eef8b2-ca45-4fde-b4f9-51d94ea10ec1", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769617291, "uuid": "6977db9c-ab18-4545-bfec-590581db43e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617291, "uuid": "76badbea-a612-4c94-b572-84c1b8e0f889", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92aff91b-fc18-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1769584291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584291, "uuid": "b316cee2-c3cd-4632-87f2-c3ac0b6445a2", "comment": "Malware payload (AsyncRAT)", "value": "7bc752da276a68db5d171c813f88ad82", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bknoww-com", "colour": "#F8EF07", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "wmk77-com", "colour": "#33F251", "exportable": true, "hide_tag": false }, { "name": "wmk88-com", "colour": "#FFD915", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584291, "uuid": "3da4b0a7-68a7-4844-85fd-74732bce7ffc", "comment": "Malware payload (AsyncRAT)", "value": "92876cc991e53984a5b91abaa819101f8c9ef0084d621bf3263d09153b0dea67", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bknoww-com", "colour": "#F8EF07", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "wmk77-com", "colour": "#33F251", "exportable": true, "hide_tag": false }, { "name": "wmk88-com", "colour": "#FFD915", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584291, "uuid": "aeb4ef89-649a-4ae6-879e-d95670877d99", "comment": "Malware payload (AsyncRAT)", "value": "6a83439419b3818f8bfd927245a90f1bd11c027f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bknoww-com", "colour": "#F8EF07", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "wmk77-com", "colour": "#33F251", "exportable": true, "hide_tag": false }, { "name": "wmk88-com", "colour": "#FFD915", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584291, "uuid": "8fc52015-fada-451e-8f78-d52b2d70aa23", "comment": "Malware payload (AsyncRAT)", "value": "6a62379df9908ed785d89b2f63e4759aa353839b9507de9560c46a5dd8d468c31bc210e3767a83df36a1739458bc37eb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bknoww-com", "colour": "#F8EF07", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "wmk77-com", "colour": "#33F251", "exportable": true, "hide_tag": false }, { "name": "wmk88-com", "colour": "#FFD915", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769584291, "uuid": "2c7df2eb-f9a6-4e1e-a86f-1cf4c1e5b04f", "value": "T1EF3633DBC4C44FF213BE8C6B951ACC486094F67C78012BA858A4C76A8E654CA9DFF717", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769584291, "uuid": "3281fe95-063e-4042-a9d3-d7b48b92ed2c", "value": "98304:axcTRb07C2MiDzBIt2QzoRjjxiK1ZsvNgKl4kNnVD8pq:r2MiDzB22vR1tsvNtl93gpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769584291, "uuid": "ec01001f-397d-407f-b195-2ff9ae7acfde", "value": 4868107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769584291, "uuid": "571fb409-83fd-451e-8159-52b7bc32ec71", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769584291, "uuid": "f7d02691-13df-4c32-b730-f730127d9fc9", "value": "92876cc991e53984a5b91abaa819101f8c9ef0084d621bf3263d09153b0dea67.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a6702d0-fc8d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769634502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769634502, "uuid": "edb6d172-8af2-499c-a2a8-901facad8963", "comment": "Malware payload", "value": "b1663629867c14349d6066336cf6bfe2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769634502, "uuid": "2dff68eb-c6e0-4b21-9fa5-df38e8fc01e4", "comment": "Malware payload", "value": "92f97f264c39270d65533e88a576776ffba7b81451344288b5b2b33a9d55f86c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769634502, "uuid": "53fbabea-1872-4ed4-b64d-bb49bcb32e20", "comment": "Malware payload", "value": "c2884af4e946e2d497817da68119fc691d0fa68c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769634502, "uuid": "7b2f8038-9130-4d5b-a77e-2a70b408d3fd", "comment": "Malware payload", "value": "2ca5096865bd9142a7769b35c45f8c2c4e8730426c471ec415d99ed95ad612be42ed1b4703009c3fc2a60e51ba345989", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769634502, "uuid": "a6c40c05-0696-4be7-83fa-b40b3fe68bf6", "value": "T1EA9533941F7621A320DB9A940EFC8AAB598921FD0D63FCCEF5D221245F08F326651E77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769634502, "uuid": "71d99a5a-0193-4fe7-9b67-beb7f3d949bb", "value": "49152:wJJv/e1b+iPb5zzse3DEMdPB0ooZN4eAsy1L8U2CzwYEYW:SObXb5Pse3DEMlWBnrAvl8UNdVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769634502, "uuid": "eb82aafd-9c43-457e-86d2-7d316101bd2c", "value": 2031988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769634502, "uuid": "b7bd90b2-9906-4539-a080-2460325a1065", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769634502, "uuid": "cddcd25c-a5c6-4d91-a2f5-a0bbe8d2a5c8", "value": "afbe6751d339fbc5b7bddd29429a11740e82fef935a61acaf2fe5487444dbed4.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5657c588-fc45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769603518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603518, "uuid": "82b3fc3a-3d53-4aaa-a2c7-3399005aee71", "comment": "Malware payload (Mirai)", "value": "dafa9d8c2e14a873413892d31c7ea5fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603518, "uuid": "566462c7-4a50-4f9f-ab30-754c3a0798fb", "comment": "Malware payload (Mirai)", "value": "931917f50a7edf09174f1f55566b709d8a4a53afd78906960d9269f0f1b0f4c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603518, "uuid": "15530956-c25c-4373-9f40-16834359e7a2", "comment": "Malware payload (Mirai)", "value": "42ef18067b2cb29707cc79c70670549383ace4b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603518, "uuid": "988261e1-09b3-477c-9cd2-592d88787458", "comment": "Malware payload (Mirai)", "value": "20d3d602d90c5ebeb270c7323fa34c570951a911e17b2c5aa3911df1f8c0bef9a151bf8d3a2a11ecc3d924ae5598969f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603518, "uuid": "ee05c9e5-64ff-4dbc-96ff-5146e054090c", "value": "T16EB32A8ABC819B11D5D526BAFF0E518D33135FB8E3FA7113CE145B2A538A85B0B3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603518, "uuid": "35d36ebb-7a34-4b72-8b84-e61efa82b973", "value": "3072:wrbXBf3wwebEAdfEwB2GY0/+keiH+Pgt8lgDzV8S+of4QX:7wo/B2GY0/+Lgt8lgDh8S+M4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769603518, "uuid": "de92cc23-8e59-4591-9e86-617b3ba921f0", "value": 117728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769603518, "uuid": "d555db01-3d85-47d1-8bde-ba2239e1ecc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603518, "uuid": "ffe9d9a5-45ea-4dd1-9a89-af17ef678733", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d3ca59-fc7b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769626980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626980, "uuid": "1a972935-ce0a-4eb7-ad93-a66efd04a679", "comment": "Malware payload (Mirai)", "value": "f3028d72ee99697ef12c4de1646d256b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626980, "uuid": "e9bf17f5-ea6d-40f8-b846-bada73a7e201", "comment": "Malware payload (Mirai)", "value": "9359833f0090006a711029b2d519d34b9c2a99150995566f605651f89f8e409a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626980, "uuid": "db7363bb-cac1-43d4-8b18-f767a6f653ea", "comment": "Malware payload (Mirai)", "value": "1e25a662fe5ed0b09b2e5eb3d11e945e89295c9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626980, "uuid": "c6458846-4e37-4eda-b220-a0b68017ba13", "comment": "Malware payload (Mirai)", "value": "b5a701a8b8986b19063aead9634978f7082255b6e1b17c9774a8550c1c477f9cfb777eec0de191d3add238934d764403", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626980, "uuid": "f9ef562b-17dd-43a6-a382-79d8f9e7c880", "value": "T1A423F171679E9837C7E95635D86043895C9B2FB8F0D77E93522C2000B9F71C3AB9AD82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626980, "uuid": "6bb99a6e-8b1d-4d8d-a80f-2521b774a607", "value": "768:i70jhGBRlytgUAS1Qy2nPsunrs5kJ09q3UELb4c37zR9sNYniIn2FNU:iolnt2S1Qy4PsMukJdLscLzR9co/kU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769626980, "uuid": "72bd7bef-919a-41df-a194-26e427e488bc", "value": 45632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769626980, "uuid": "f57f7ed5-69a6-4521-b43e-fa3008bc97ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626980, "uuid": "2dc38f66-ac12-4b95-bf6f-6c38c92d87a2", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44d6e7af-fc51-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769608642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608642, "uuid": "5d62fe81-9985-46d9-b924-68f7b20fa224", "comment": "Malware payload (Mirai)", "value": "6a8d7d3656647e1a105ed43a02fdb4a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608642, "uuid": "dec140e4-e3c4-4601-858d-722286c86863", "comment": "Malware payload (Mirai)", "value": "936d6c1a6cff713caaceeb9154f5d8c8d4a0608c60f3d2272f429c3e751e8f18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608642, "uuid": "c102816a-bf56-4be1-968d-6435622d34f9", "comment": "Malware payload (Mirai)", "value": "ba63a572e9d160f0863a75177127cf25e7e09dff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608642, "uuid": "5a3bd3dd-4833-43a8-a1b3-0f9b142cde9d", "comment": "Malware payload (Mirai)", "value": "ba41ae867f698f174b4861f3187721c5df03938b6c0f8434e27afa0f1da54988cb8103883b05f798b9787b6d850031c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608642, "uuid": "8b2f78ce-5302-4478-b875-3dc043560b82", "value": "T1E9D2D0F97A0300FAE158C4F48BD007926E504BA6514AFC6B6697F65F4D9D5F03887AE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608642, "uuid": "1bcdda91-e0a3-45ca-a0d7-30c0cdd80625", "value": "768:fjcua9vOxCgj6M18i0OBhPuN2+14EnyQGkomJgGlzDpbuR1Je:f1a9vOBj6YPusg417kLVJuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769608642, "uuid": "5fdf3ad0-8555-4417-9f68-1b4050348826", "value": 29076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769608642, "uuid": "9a4ac3c7-4e69-43d5-97b0-715c231e3bc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608642, "uuid": "2a09e58a-addb-4c44-8530-9acc3f9282d9", "value": "astro.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "278b5b16-fc65-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769617183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617183, "uuid": "f1ea5fe8-27dd-4304-a450-17608012ce82", "comment": "Malware payload (Mirai)", "value": "86752f074c9167745421bda0601ac851", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617183, "uuid": "71896b7e-872d-4e79-ae19-3bb1edbba63e", "comment": "Malware payload (Mirai)", "value": "94005e99979690cb42962e22f1fa5dbabc84048f1e9745abda6501d74e23a7b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617183, "uuid": "a62952ba-f570-4334-bd90-82e261d1983b", "comment": "Malware payload (Mirai)", "value": "f770fbeef28c2681e529ac3ea25c8be9fdb80c01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617183, "uuid": "48742d7f-e1f0-4912-9944-c62604a2f895", "comment": "Malware payload (Mirai)", "value": "9613b6c023930c8fb78148e10964b8787bf87e64cf513716bac4cfb91497a2a8d03cbd9a258076d23fd7a4840db76eaf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617183, "uuid": "79cceedb-abfa-4d7d-a4aa-dc4d8bae874f", "value": "T10CA2D025E345AEF4DFAF9CE053C1C2C27AE947C7678AC8E240EEAF016516056B788D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617183, "uuid": "3fb8b812-5d53-4a3b-9e17-ce450c06d00a", "value": "384:m/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5tGM4uVcqgw05VxJd:mRxsSVsMD6xiJJE5zRWN3V4uVcqgw093", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769617183, "uuid": "edd1335d-3cfb-4522-876f-409f6c795c4c", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769617183, "uuid": "f79f309c-b94e-4e13-8f86-0ff82c88b764", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617183, "uuid": "9492f2d2-e7ea-4d64-aec3-98287887c22f", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d74cf2df-fc52-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769609317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769609317, "uuid": "fe46da2d-fb83-471e-a70c-820114eb55fb", "comment": "Malware payload", "value": "b6e48d1cf52906af51b27e7132d53743", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769609317, "uuid": "6adc996a-531b-4dc5-a218-c31af3462799", "comment": "Malware payload", "value": "942129efbabdc7b66276823d9b195b2d05c08defbb6a0db7c145ebb339574927", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769609317, "uuid": "d191603a-2617-47b5-aeb4-baa99d43f3c8", "comment": "Malware payload", "value": "dc8e088b24fc6ddab8c1ae5cdf86a9ad8ebba940", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769609317, "uuid": "f6dd036a-6d53-46f4-9305-bff53f95a9b1", "comment": "Malware payload", "value": "b5d55b02cccab433b534afcaa201b6b318fe27b135ba62540032733ec053bdff05555a87e1cca95d7de305e0eb5d3632", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769609317, "uuid": "4bb300c5-1aed-461a-8ede-bae6c55cecec", "value": "T142A1900B63AB1BBAE6A6CDE9535C720764F6C46F391135B9F7E10393682BD51BC20234", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769609317, "uuid": "fffa844e-1a80-40c4-97d8-7e6657134979", "value": "48:Cz3Rsqx8Zn67C0K0maJEtGSahV7hsqxTwd9WxKMDQWaaZK0Q4GSasEGSaaq5KfsM:Cz20r7lUw/V7G0MdeDQsKY35v0meT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769609317, "uuid": "1ba408bc-d239-43ee-b557-be7f6662851d", "value": 4912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769609317, "uuid": "6e602777-b9e6-43f3-8939-9c5d0c9353cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769609317, "uuid": "bd38a2bd-ae5d-4992-af8a-4e5d9eabe997", "value": "captcha@193.149.176.249", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b3dc26-fc94-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769637626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769637626, "uuid": "b20590a7-6c03-459a-a204-2df4fff67274", "comment": "Malware payload", "value": "70e5cc3e4cc245238a314a9dd9b49d8b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769637626, "uuid": "d2888ec5-f2c0-4e00-906f-71ee60825015", "comment": "Malware payload", "value": "94460a87d89a0424521bb4c83e7d88b82dd9355fc01ef047e32355e7e92b4962", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769637626, "uuid": "aeb379f5-2135-4c59-9c45-efdac0afe0cf", "comment": "Malware payload", "value": "8c0b1d84c21e35577917081e35887bfd42653e44", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769637626, "uuid": "6b82459f-0034-4628-9073-1a0a7e5d8210", "comment": "Malware payload", "value": "6942eabfd2e266c66ab449d956fabe468f81f7d8289db06e1cd07f7b44197f97a076030d3d29fa9f001fb157ef3f71a9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769637626, "uuid": "b3cff733-355c-46d0-9b83-83ad292329a1", "value": "T1CE336333D410FE0641A1EE55A2799B04D672D87748AC6418B60C4E4D0FCA9EA3BBFF4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769637626, "uuid": "5a212430-299d-4e78-ad4d-ba09f2cd76b9", "value": "1536:CcHg5Ajyw6IDFSD4zNq94AbluKlAGRhl0IGnKG1kA:CltN/7GB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769637626, "uuid": "0762c261-2d50-40c3-9426-8306ce4f7c51", "value": 55045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769637626, "uuid": "b82a6847-a692-4174-8b44-ccef5e1f53e8", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769637626, "uuid": "ac93fc6b-d387-4102-ad0b-d2760407c859", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d3b8dd-fc7b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769626654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626654, "uuid": "07d6865f-4d58-4624-8161-6e35334ab2e0", "comment": "Malware payload (Mirai)", "value": "0339cb477a6ba6c687e0b6fc33f82332", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626654, "uuid": "56b9d82e-da6b-4d3e-ad22-d5e490a4a769", "comment": "Malware payload (Mirai)", "value": "94c3c35affa1e7bb1112830d84c09213bae20ee96ea5ecdba1a3ec3b6578cca8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626654, "uuid": "6bea7738-a1f0-4528-b685-39d9c6e7d5c7", "comment": "Malware payload (Mirai)", "value": "c70146471f79a5fe987a80b625d8fb1d38d50afa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626654, "uuid": "c841a21c-6636-4b86-a11b-4eb80c43d5b1", "comment": "Malware payload (Mirai)", "value": "28a9a798473a8b6c3419bb59b7d4a908deaa40f7dce7a22830dc88ce5ed621a5e2735fcec3d914aa35e0c5960a4acf41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626654, "uuid": "0ea6d404-21ce-4f3d-ac6e-02e821d433e6", "value": "T143E31946F8818F15C1D111BEFE1E124E37131BB8E2DE7212AD24AF74778A97B0E3A915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626654, "uuid": "8ec013c6-9112-4a08-9bc3-73c1dd179edb", "value": "1536:Vvn82sKCNu6MQVReh9W5Ny2ywROXynttLEyCls2XirNMeGUoSI0VOZ0m0FjMt/0l:yHC23UXAuANMeGUk0Vyna/CPEqTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769626654, "uuid": "5e009090-cde4-4e3a-a105-04bf1332d8bc", "value": 143516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769626654, "uuid": "04ba9485-0a53-4ed3-9284-67b8a2c062e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626654, "uuid": "b3757f39-0c8e-414e-84da-b605582e2037", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e328116-fc74-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769623583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769623583, "uuid": "44ef64fa-9404-4771-a353-9873542cefdb", "comment": "Malware payload (Mirai)", "value": "b8f53eb684b9f4072a88444634bb4501", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769623583, "uuid": "32eebf81-ff74-479a-b790-b992fd4c717f", "comment": "Malware payload (Mirai)", "value": "959b05de2a625de27188597ac85b8fff26b162d5174acd01ad3d4651fabbb899", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769623583, "uuid": "406fbc5b-a7ea-47aa-b194-45df0cdfc9b6", "comment": "Malware payload (Mirai)", "value": "eadac9cbecdb03800fdda0df7744c3fff3b9d543", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769623583, "uuid": "f86f55b7-f4e9-4669-a1ee-b21221221057", "comment": "Malware payload (Mirai)", "value": "c024cfc218f51b6280735b5d45b14acd408ab992caa6ab63b76d46d532c07bcd31813f847816bada5c475a36b333f193", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769623583, "uuid": "3cb752e0-a362-4426-ad0d-dbd42bdae025", "value": "T134E3F649ED41AB00D5D536FAFE4E428973534B6CE3FA7102EA245B2123CAA6F0F76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769623583, "uuid": "892805ba-d5c9-4a2a-95d3-009dfa6d10cc", "value": "3072:F7Yinkzc6QgeTRyiJyjaFIOxps2WZZUDaLudiWV8w2ElGfhQzlI11tUyhD:VYinkzc6mTRyiJ7FxpsHyDaLYiWV8w2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769623583, "uuid": "e720d031-7076-4ea6-854b-de5eaab26a2a", "value": 145128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769623583, "uuid": "58a30488-4c1a-4ebf-92c9-6ba456ebfb80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769623583, "uuid": "f27ff861-50da-4ed5-a637-7844b468817d", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f25174b-fc2e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769593600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593600, "uuid": "8f2f23c9-6803-48dd-bc22-ba038f46d914", "comment": "Malware payload", "value": "f943ac25ea04a3c8cd1abee2571095f2", "object_relation": "md5", "Tag": [ { "name": "104.168.115.88:2390", "colour": "#CD9E92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593600, "uuid": "dcad4e3a-b613-45e0-92b9-725fa97e86ae", "comment": "Malware payload", "value": "97b17f9acd074b5f6e8330512daa827dbf7db4e3e053a75250a24ffb153e77af", "object_relation": "sha256", "Tag": [ { "name": "104.168.115.88:2390", "colour": "#CD9E92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593600, "uuid": "c60f9d21-072f-490c-bfd4-3c94ae938638", "comment": "Malware payload", "value": "202188cd37f37f78f31bfad645431f3546762b02", "object_relation": "sha1", "Tag": [ { "name": "104.168.115.88:2390", "colour": "#CD9E92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593600, "uuid": "efa4296d-c776-42b2-bfa7-7c638487628c", "comment": "Malware payload", "value": "c349fbeec92d7479b2e748e369b6764f502f42688668808610a59ed63dc9829a20b15c5ccef28228e6d1255b6a8d1c3f", "object_relation": "sha3-384", "Tag": [ { "name": "104.168.115.88:2390", "colour": "#CD9E92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593600, "uuid": "3bfa88de-0f72-4623-b22f-688215e8147a", "value": "T11805DBE82DD2F54CCF436437F20EB00DA6F159F21B242C1978DD1D10AF9A2D99EA4A79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593600, "uuid": "cafe51bb-9620-451d-a808-b92ff1e3f0f0", "value": "3072:QuLP6+1MJvg5sD96mfE6hhRUYRS7RJ1x7ixLRAx9xrYRL0RL0RaBR6AxrlR34xr9:QuWZWsD96GEA1/PiaCAzLbkS1BF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769593600, "uuid": "abd45b65-abf3-460e-b937-729bc7dcb6ed", "value": 862209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769593600, "uuid": "5c839403-ef8c-460f-b1d0-b1c12d730aa0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593600, "uuid": "dae67793-50e7-4188-a570-1e1193dac004", "value": "PO-20114.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e4a7ba-fc7a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769626253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626253, "uuid": "fbfa6549-9a7d-4026-a871-7c805a75b9d2", "comment": "Malware payload (Mirai)", "value": "079a6b18158a0f95c350ce7a052839ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626253, "uuid": "4e5c7e10-ba18-4009-9808-a5a13b316cd0", "comment": "Malware payload (Mirai)", "value": "98ed64e307b12f20fb49a22a06c7b08a672fdf1a47aba67817368cfc56dc60e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626253, "uuid": "704cf6ff-2d05-41c7-99ff-54cf35056c1b", "comment": "Malware payload (Mirai)", "value": "7031c205650a289f747916948523b20c42cfde91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626253, "uuid": "aac2ff6b-250f-4bdf-8abd-60e7462305ac", "comment": "Malware payload (Mirai)", "value": "2b9ce374b0eb391a2bb933999f53c155c7389feb6599c54d5de5712ec3fdfdde23908ac06ce7b024a2bbcc148d754b07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626253, "uuid": "fc1b061b-e300-4ddd-8592-6af8c65b8012", "value": "T1FFF2021A73CB570ED98CE4FF018C88D75C6AE919472EC4462E092B3B5BEE2A650345B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626253, "uuid": "da99761c-6663-4cbd-8846-3ef1be8208fa", "value": "768:V6pbw8ibUESyiwBm9oyGC6HfKO0KVlEOMH8qg/96lF2:V8RibUESyiym9X4fKO0KVsHJk62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769626253, "uuid": "54642961-9913-43bf-9501-29cdcabaef25", "value": 34652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769626253, "uuid": "acdd8fe0-e890-42c1-97de-a2c5bdf5d688", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626253, "uuid": "6cec1912-7bbd-4ed0-a599-b770d6fb63d1", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65143be9-fc9c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769640908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640908, "uuid": "cda7d6f1-90a4-4dea-896c-4d33ece0b63e", "comment": "Malware payload", "value": "762aa7d7001fca65254c2cfb135b8ca4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640908, "uuid": "7cc5e9f4-7255-4a50-bfda-f006563c0e49", "comment": "Malware payload", "value": "99e7bcc4bc96aca3f12364dfdb06700c58f7944eeec6f06ffac890a794a484bb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640908, "uuid": "1b467741-2ce1-44f1-9247-97d662a68b8e", "comment": "Malware payload", "value": "0e874260088e449c19ec5f79b5f1a67cc15b576e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640908, "uuid": "2aaed729-223b-4a49-9ed1-4d1628213660", "comment": "Malware payload", "value": "2f9a6ec554e7fa5085f3ff5874279ff232fb8ce194749beadc8a5848d551c831b59ece19e38dd07d8c49868ced032fdd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769640908, "uuid": "a8024f5f-109c-4c33-a9fc-4b1b0befcf73", "value": "T13F336333D410FE0601A1EE55A2799B04D672D97748AD6418B60C4E4D0FCA9EA3BBFF4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769640908, "uuid": "5d2f4714-065a-4abb-b0ae-f02f8036cc12", "value": "1536:gcHg5AgywgIDFSD4zNq94AbluKlAGRhl0IGSSOP:gKtN/fSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769640908, "uuid": "31592f72-5bf0-442b-bacc-d8db18d3f53e", "value": 55015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769640908, "uuid": "2973fa73-c6cb-4668-a197-5f1e939fc087", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769640908, "uuid": "9515c064-c201-47ee-bdf4-bd1b89d08b08", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65987ed5-fc6e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769621152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621152, "uuid": "f5e6792e-25f9-4d04-b1a9-7f1ecd274258", "comment": "Malware payload", "value": "18f7f57f9c6ba1582a63f42d51d6355e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621152, "uuid": "05b760f5-5e46-4830-83e5-2b064b865e29", "comment": "Malware payload", "value": "9b15d1a2119c998c4d4015f6fcc6726646b730e9573045fd980ff8fe4c530422", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621152, "uuid": "69a00ded-86c0-408d-9047-38ffa51d83c0", "comment": "Malware payload", "value": "0cacc310ab08d07920e181331216243dc16ff553", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621152, "uuid": "b037f1b8-5589-448e-8e26-9382487574c1", "comment": "Malware payload", "value": "919d45e8961c5ded60d3b3735b701404d26290cf084a7e6666a94f2ac14ff885f25ec0e6debbfbe996fa732c6e9ac235", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621152, "uuid": "bc4653e1-9e54-4fca-8cd7-ef5d8f37ed06", "value": "T156F59DD2A7A600E8E977F23C85468117E7F2B817537097CF16A48A761F236D12B7E702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621152, "uuid": "3cd2dffd-d40d-44d0-bc58-da1f01ae985a", "value": "a41de816070f4232d93c4e8ee8f581bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621152, "uuid": "9e43db18-0dce-4021-b01d-8c0763cadeee", "value": "49152:l9dZEy2B6vflQf6X8uZQoy3vR6QVQy5Z+bm4M/HMFvfGW0/7Z7Ib3jx75le1:NHvfGfZvZj1/N/z/o7be1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769621152, "uuid": "0e9e7e61-13e1-436d-9e06-b2645faba9c4", "value": 3606155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769621152, "uuid": "83001ab4-35b5-418e-bc8e-bdbe6bd194e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621152, "uuid": "28edfcfc-77de-4e29-8fb6-a9c314706a09", "value": "SecuriteInfo.com.Program.MeshAgent.3.9757.15218", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "441b5968-fc51-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769608641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608641, "uuid": "01cbb236-09ed-4bfb-9460-04ee895bb457", "comment": "Malware payload (Mirai)", "value": "8c4bca8971d7225de80c67bfa3f1f135", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608641, "uuid": "5998c71d-6044-4c70-bfa9-d6422dc34daf", "comment": "Malware payload (Mirai)", "value": "9bc64e57530bee4ea3b2ef51f6ed149286ac968f49c62887a137d1504d3e9694", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608641, "uuid": "364e125e-f4ed-41bb-8459-0afa8edefb57", "comment": "Malware payload (Mirai)", "value": "d3651f85f64150bde6135f1cf96c79f03300e252", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608641, "uuid": "2d18ba1d-877a-46b8-90ab-148fc33e035a", "comment": "Malware payload (Mirai)", "value": "2855bd07760515bcb992e337f33c0b6aecd10f56b3c612ebfc13085ff587a7cabcb26fa26c6bf6658420f1786277bb62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608641, "uuid": "4a2f3fc3-56e4-47ca-aee9-258783e5d35d", "value": "T1B833F19ACA2C84F0CF706437C9DE49067E2A8F30C9BF5927A221DA194CC6D5B66F4943", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608641, "uuid": "ac28ac33-fa72-4621-835c-5b4df2831d83", "value": "768:GwpGm3irydjviLkTXThGTgppk6MTglZnpZ92X5nNdB79q3UEL5HxkbLUGwm6QCix:Xi+ykTdLMmZnpZ9an3BaL9xkUpiJp/eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769608641, "uuid": "d5bac765-718f-441c-8da3-19a30b36dec2", "value": 51640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769608641, "uuid": "cab2af13-46a5-4fb8-ae33-ad68195347b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608641, "uuid": "6aefc7ce-b158-4c65-ada2-dac09f1fdf0f", "value": "astro.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6402c19-fc3d-11f0-a129-42010a9c0007", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1769600296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600296, "uuid": "1e2817df-4329-413c-a14f-e41cc7a5fbe3", "comment": "Malware payload (ScarfaceStealer)", "value": "817ecf129e3585bd2bb9d7d6a6a8bf58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600296, "uuid": "40f7b300-c22c-4c3e-b4e7-8aabf1cd0c88", "comment": "Malware payload (ScarfaceStealer)", "value": "9c7702b4d702bbca82d20a7af16daba4809474fbf2cdca02cec5f3220a37111c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600296, "uuid": "fcfa874b-4d21-4ba1-a200-777b43076e2f", "comment": "Malware payload (ScarfaceStealer)", "value": "5bf7c463cb80cee9eb355c5795d4375b7a16d30a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600296, "uuid": "2df25a88-1a97-4652-b179-b9cc7a1cc989", "comment": "Malware payload (ScarfaceStealer)", "value": "6d4881f8fad8265abc0f3e45d65c18774d58665e6a41868d6db89d22336c933d4263c855e6baa89bd1f0d3d7049aec35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600296, "uuid": "5465a15f-7eb1-4ef0-b90d-048abb561d1e", "value": "T113B53343D96C24FACD7609FB039A5E0A17EFA47092E113851E16517B9AAFDBC0F205F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600296, "uuid": "2430a0a8-4410-4d6a-b3b5-ceecbbd78f76", "value": "16115189c3817c69eaca44014ebe16e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600296, "uuid": "258c6fb0-496b-49a6-9f12-83fe40c97ab1", "value": "49152:jAukdrba8TPZU7vohXBFJh87vWX8//ePKToNTvCIQpz:jAukJa+owhXBFJh87vdePU/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769600296, "uuid": "e3c1609f-dc45-4fc8-af21-7c09599c711e", "value": 2299904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769600296, "uuid": "4088c708-0bfc-4c72-aedc-a02e5ca49f73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600296, "uuid": "466cde88-1401-4381-815f-6c915af3f08e", "value": "Phantom.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d024c76-fc65-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769617192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617192, "uuid": "12ce4eae-16c3-4fc9-b9a6-2dd0a30d2261", "comment": "Malware payload (Mirai)", "value": "df0e2e6c2c996b66ad7e19c3a55760e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617192, "uuid": "f1496f2d-adfb-45af-bb52-ea05cf5b55f4", "comment": "Malware payload (Mirai)", "value": "9c9ed77f2177f8846d784b8161ef9dad573954df1e515750f74583aaf5d9dfc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617192, "uuid": "15490882-2ee2-4fb5-9b7d-046c13c1e527", "comment": "Malware payload (Mirai)", "value": "b49e7da90294daf9e6efc830529d89e5f577443c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617192, "uuid": "369842f4-5e35-45fa-8494-227fdd77ac86", "comment": "Malware payload (Mirai)", "value": "2a007f8176b2d8eaca03acaa7bd232c34515865663be9bd2ef2b76acd6e6173dc2a0c23e100e54a32c5671dadcdf3d6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617192, "uuid": "cda7f325-0b4b-4b6f-9278-7f43a80d68bd", "value": "T12133FA8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617192, "uuid": "12ad690f-8bc5-46b2-8285-602acc850297", "value": "768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oGj:r/hqaJMcjeqK806MHdMfQXoHuCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769617192, "uuid": "0b900569-5d35-4ad2-b451-a10bbc8ad79f", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769617192, "uuid": "0781bd81-35a1-4f50-9da9-7ec86d1d53c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617192, "uuid": "2897171e-120e-4c40-a310-725c2d4293b7", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0175307d-fc2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1769593926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593926, "uuid": "45f615d2-bcdd-486f-8328-f2fd0dde05c4", "comment": "Malware payload (Vidar)", "value": "8ba4a99fa2174c1c8eb1325cb8a806c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593926, "uuid": "89dcc253-42d1-4a08-aacf-f5f30a8f477e", "comment": "Malware payload (Vidar)", "value": "9de91176c21607a231f19a68d3c413ce17518650be2c1ef2a5b4e42c7728d0fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593926, "uuid": "87bb3754-18c5-4f50-a28b-2d60c72695d1", "comment": "Malware payload (Vidar)", "value": "27f12568ade6aee898366d7a04fe2af3db457995", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593926, "uuid": "32b3ee5e-dc27-48f3-b6a9-09269acdb7f8", "comment": "Malware payload (Vidar)", "value": "ba568661711798050153e6f989949fbbe659534721e5a7616e6eb5088b7b2d7abfb6bed43c6ff63381d25a93c3f82fa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593926, "uuid": "7290f7be-fc78-4a56-a92f-9b0bb3c9bbb5", "value": "T1E7166A536C908AF8C4ABA33DE8A252857774BC090B3133D72A503A751E777C46A7B739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593926, "uuid": "8ff3d9e3-de0e-4117-8959-ef05418b88ac", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593926, "uuid": "bacf3e11-abee-4cf6-a151-63fb5d2a5679", "value": "49152:qJMHEvhQkRVrHi+GxDYvqfwTUeOfNFbIiWQF4IaN/UjtnpilviYr7ydP:qXe/FSxUeyIFIqUjtpoSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769593926, "uuid": "d17098b5-8fb8-4c1b-982f-b1363ec7b357", "value": 4382424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769593926, "uuid": "1d218dc2-0b30-45e2-a604-76829122ac23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593926, "uuid": "3b806e73-b912-4ebc-a063-ffa31cae2e08", "value": "FixMBoostrapppe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2be7fb07-fc65-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769617190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617190, "uuid": "d3e4c7ce-4cd0-42ac-ba78-18ce63fea419", "comment": "Malware payload", "value": "057fc4307aea581670b7b4536a51790c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617190, "uuid": "dbeeedf3-7a1a-45a8-9a9c-6f6cfdcd1b89", "comment": "Malware payload", "value": "9e739f00c8fea3cfa8abee152d347182a9da277399f8b936c4ce4b739b416e1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617190, "uuid": "7b27987f-a5f9-4fbf-b5bb-fe5c85af8d2e", "comment": "Malware payload", "value": "7a765ef2050c8a375ca6ef9e12228e5f67a281b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617190, "uuid": "610a3636-4eb8-4964-a0d6-406c14157456", "comment": "Malware payload", "value": "be94fdd6a08916f566ab7f9d161836065f67abc6c87af283586dc1ffb3a00693bd1d4ee0cb02462327cc5b7dd272579b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617190, "uuid": "b1654b38-5bd0-463b-8d19-2fbecd5c0d78", "value": "T1BDA42346B8C65C99A0089C60112EFF7FB17DF299C81CCEF2AAD6747A1852FBC580E15C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617190, "uuid": "69ca6912-d063-4bd5-8ba8-c02def894bb7", "value": "12288:4PKUJVNfWJn/0QvQTozgYewfzbWUX35Zs5p4AAF8X2jSmoSu:XoVNfqQToDhLbJ3Hs/mbjSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769617190, "uuid": "83709e5e-8ebb-4e9b-903e-008c54a8f040", "value": 490256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769617190, "uuid": "913766ce-e96d-4df0-8dab-59336083dc81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617190, "uuid": "58d60f0c-ddc4-4168-b1f1-e4c5ce7a35d3", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04bd9322-fc4c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769606387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769606387, "uuid": "862aa7a1-f18c-4529-9db3-5b4a7a6bb414", "comment": "Malware payload", "value": "19d66877060e10986813c32e5cb9c985", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769606387, "uuid": "26b50aea-7296-4fbf-860e-32aee75fe255", "comment": "Malware payload", "value": "9fadffb3edd52ea398335a14c4e213c96fe57a5ced7c1cb43ed215b4b1a80bdc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769606387, "uuid": "45dbbabe-d108-4d7f-9e9b-817385f28c46", "comment": "Malware payload", "value": "e24e9253e8fc45136e6bcbff300d6130b5832c63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769606387, "uuid": "3d6dfa60-f233-4f0f-bbab-af0c8295e0c5", "comment": "Malware payload", "value": "6c6644505b1f9e681801f025e2bd8a2aa607002d4ab8391c551aa61b10f366682f74185ea44c7977f2b9fd7351394222", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769606387, "uuid": "46a4bdad-56be-42a3-8021-ecf7fb6b02c0", "value": "T1E574290BE6E250FCC5DAC034476FE572BEB178E946207A7F1588AB311F6AE60631E711", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769606387, "uuid": "63783a2f-7e35-4c88-b315-cb9f4753e32e", "value": "6144:gkVW4G4lNR0++DrTAw2YgQrhVyqGmMDPu7gmuhiZ8BsE2a37fZ:gkwbDr52YgQd4zDPu7gmyiZ7El37fZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769606387, "uuid": "35996dfc-3c71-4073-9e80-147ce5b7c8a0", "value": 338552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769606387, "uuid": "81421aa6-a362-4eca-9520-69fc31a73008", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769606387, "uuid": "c0422369-3c48-4ef0-9b43-fece1b63a737", "value": "f33.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75fc8264-fc9c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769640937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640937, "uuid": "9c45a105-6bc8-41d6-a083-ff28e723d977", "comment": "Malware payload", "value": "fbfcd330c7cc6a8fe1c043e7ae1ad193", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640937, "uuid": "f9af2732-708a-4e3c-84a2-73ea53d9ea55", "comment": "Malware payload", "value": "a075dc97c1f19eb05877f10cc8e65501117219c853663ba652ceb2ecc7fdf034", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640937, "uuid": "afd24065-a53e-4aed-8af7-f37f3dc30f1d", "comment": "Malware payload", "value": "9aeb832040d9fe8976e250c93ff8371f746e7dde", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640937, "uuid": "49674599-b720-4c26-a7f5-62b55964973e", "comment": "Malware payload", "value": "10afd9361b481b43d71063bdf4060fdec4e7c1ca8680372002176479d8640b2a8b55984c6210c1c927ccafc241e255dd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769640937, "uuid": "49cc790f-1669-4cbf-a677-93097c56d67d", "value": "T19A336333D410FE0601A1EE55A2799B04D672D97748AD6418B60C4E4D0FCA9EA3BBFF4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769640937, "uuid": "ba4c9578-7b7e-4be6-95b9-9c9712931926", "value": "1536:gcHg5AgywIIDFSD4zNq94AbluKlAGRhl0IGTSOP:gqtN/mSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769640937, "uuid": "cc294901-b7dd-464c-8dcd-811d11a7eeda", "value": 55015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769640937, "uuid": "1ddd53af-d7c3-45c5-a0ed-a80974d135e7", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769640937, "uuid": "948268a7-f802-485b-ab69-8a58343acd8a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4ebfaa-fc27-11f0-a129-42010a9c0007", "comment": "Malware payload (Amadey)", "timestamp": 1769590831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590831, "uuid": "ca359a92-13fb-440c-90cb-cc6ea4e32396", "comment": "Malware payload (Amadey)", "value": "cb565ae2a6f5c9f726e2c9458e2112d3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f397a7", "colour": "#FAFA18", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590831, "uuid": "30868424-6ba8-44fe-beb8-58f448def61d", "comment": "Malware payload (Amadey)", "value": "a0b453b054513023dc3a5460eb813c70717776e7a26ee89c8ad97ef281084bf1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f397a7", "colour": "#FAFA18", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590831, "uuid": "2c664a26-c47b-4a80-b38d-56424ea6f1b4", "comment": "Malware payload (Amadey)", "value": "4ee81932f2a3401f80bb545fa6e421c2b450dce9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f397a7", "colour": "#FAFA18", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590831, "uuid": "4f228451-fac0-4e55-81f8-107224a13e0d", "comment": "Malware payload (Amadey)", "value": "689f40fbb1a54dd2c3a199f9c19e1698ab6d4606c3d9cc5e7ef0feec0f7a2882b333a5eb18a66fba864596d5cf9ad276", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f397a7", "colour": "#FAFA18", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590831, "uuid": "8c8bfffd-b813-4092-883f-fbb42438a37d", "value": "T122557C0BA26141BCD4BBE1789A175A47F775704603709AEB07E446A63F13FE1AEBE310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590831, "uuid": "82600709-5441-4f45-b726-e82c98e627af", "value": "3f175edea93fa7a76a78004d12de2235", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590831, "uuid": "f662eaf7-fda6-45f8-9dd0-82c3e7ce7e6b", "value": "24576:1rR0NaOy0mK9yCksn6JCc2YkxfUyamitsDw+mLRpTOnW:1kHmiyCkhh2Bamituw+UrR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769590831, "uuid": "cbbc2092-1486-4f41-87fe-c8a18448dd86", "value": 1282048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769590831, "uuid": "33eef76c-b3e2-4230-b5ac-efaa9f3d9e00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590831, "uuid": "0297c0fa-17a8-4da8-92e4-89f254080bf9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "352661c1-fbe1-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1769560512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769560512, "uuid": "0218dc03-f704-4742-bcd6-38f2cd0e31da", "comment": "Malware payload (AsyncRAT)", "value": "510d8c1ed805b3ab6c99a1db64cfd508", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769560512, "uuid": "e7763375-5a29-482b-aa06-dbbeb42885a3", "comment": "Malware payload (AsyncRAT)", "value": "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769560512, "uuid": "0c468777-11bb-4e1b-8625-e8328bd45d58", "comment": "Malware payload (AsyncRAT)", "value": "040faaee02ae239c50855853d75e9a2373c4e20e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769560512, "uuid": "7933b4c7-64f1-4ca9-addd-d45e035ab7f4", "comment": "Malware payload (AsyncRAT)", "value": "566acd5123f01b841cf093dabf1827e45db874e9ffd7be77a270475662ec8c35a09a457f6317a0fadc8aeeecc3d0c561", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769560512, "uuid": "4a16c04b-4e3d-42fa-ac86-8a06388e2fce", "value": "T1A426E117B3C790BDE06A873A8962D135D6F7BD115221AE5B47E04C9BBF361A01E3E702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769560512, "uuid": "a710c63c-387c-408a-a9ef-4112d0ebad70", "value": "5175da4b99d292f751a152b8e78310d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769560512, "uuid": "1521332b-adcf-4e75-bdea-038151cd986c", "value": "98304:kryrziVtLSFZRSmaQdNJRTamMQRfoVSe:iyn2RSnRSmaQdJTamMQRfo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769560512, "uuid": "029d18d5-704c-43f8-b550-5c144844c5a3", "value": 4659200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769560512, "uuid": "1e2440bb-21f0-46a3-9de9-1f85cc53e8f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769560512, "uuid": "9ea7ca83-3337-4f7c-8962-98297c2291ed", "value": "MicrosoftFitcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1074065e-fc92-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769636471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636471, "uuid": "e96c15b5-61ca-48d5-8f71-d58adde48bd1", "comment": "Malware payload", "value": "25d5476d244f7b7af8b58898c9494542", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636471, "uuid": "54f5a3a0-4690-4c12-b865-8bbc40b6ab2f", "comment": "Malware payload", "value": "a17ce97bc4dc743a3834ec5a0848091cb8f75e8ca3da6aba4c4384ebdf732c01", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636471, "uuid": "95c99355-b4ac-4b75-af44-dcbc30c577a2", "comment": "Malware payload", "value": "e04e0562f8398d5980b519c8fb9a8f2e4cb1eff3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636471, "uuid": "85a9545f-b7f0-4800-b2d4-fb22b3d244c8", "comment": "Malware payload", "value": "ef296bfe39d28a74c78e6cd419852a035f38e25896fe82e5ecaecf08c7996f8e803c2fe49dfdb11ebe519f3521b66f6a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636471, "uuid": "97eba286-c2b7-4bbe-8f3f-81164e8e46d0", "value": "T13106E0336FBEF0E2E5A992B1C47075032FBCFD740AE504646984A4994C328D92F5FD6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636471, "uuid": "fb236f11-6f44-4e1b-a6b7-d6ac59e5ca70", "value": "ad9c385dc47952d65cc178757c7e0a4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636471, "uuid": "5c9eec0e-1d3c-47b7-8893-0d4523ff5d27", "value": "98304:nZwCpFRhv/PrRkWPfNBzeg/2TNPD/2leRHZy00Hg:ZwUFRR/PrRk0fNYg/2TqeR5yDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769636471, "uuid": "3c5e6f42-e1e9-471f-8226-b409d56208dc", "value": 3988016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769636471, "uuid": "f6be964c-805a-46f2-8366-a6ced3ae2c6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636471, "uuid": "5612563e-393d-4656-b517-773f47dc9ae9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51dd22cc-fc72-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769622837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622837, "uuid": "58770945-a3d2-426d-a42e-039b1ca6784f", "comment": "Malware payload", "value": "1830e59ff6c3c2d59b2504762a09f68a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622837, "uuid": "bd18e0ac-9246-450e-b1c6-9801df4485ec", "comment": "Malware payload", "value": "a1a600812424e7c976b8ec60f77fe808520d3fc7f716d12663bdc22b93c81038", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622837, "uuid": "7615f57e-387a-49b7-9ca7-ce30807a9dda", "comment": "Malware payload", "value": "7c953c84b3b5f8feb7d2a89567825059dd0dc507", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622837, "uuid": "c257626b-3b79-4e7c-89a4-6ff8ace288b7", "comment": "Malware payload", "value": "49c5147a1ab2700cacb6697ced4e2579a6a9a537d8b7ad2a35fc84b539adc9539e776b8abdcca3b3b127cf82b65518d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769622837, "uuid": "3f569308-0c47-4d81-b227-da469daea9cb", "value": "T14DF53367C7A68C12E81917B98035C97815333EA976F6C79CB0E8B8736FB73D4112681E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769622837, "uuid": "0e38b2ba-c23a-42a8-9120-5d812039de3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769622837, "uuid": "a050a652-0d80-4efd-8792-6b55aeb9d0ea", "value": "98304:AK+xXWGccyP/mfXrCA32zo1L2og2xkIzDqizRJw:AXxXLcZA32zEg2xkIJzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769622837, "uuid": "ad4cd923-c1fd-4978-a164-b75ff88be90a", "value": 3426304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769622837, "uuid": "61c945d3-0fe9-48fc-ba99-f166a15f3d35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769622837, "uuid": "8dd35047-5aca-4620-abb2-8ba7fc813190", "value": "Paiement.28.02.2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4fe5202-fc9c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769641043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641043, "uuid": "6a7d05d6-6c58-4758-934a-ac9441d9f5a1", "comment": "Malware payload", "value": "856776e6ecf17615cd10eeaf315e03ef", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641043, "uuid": "80a39300-472f-4a09-ab44-91ecba50d327", "comment": "Malware payload", "value": "a2ce73b93d4e5bdb6886396831035cf93995a0029bb288a97c43153539a568d4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641043, "uuid": "63dd246e-c87a-4e8b-9efe-87caf3a50e2d", "comment": "Malware payload", "value": "3437772760100d28d49a8894292935e1c4ec7c38", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641043, "uuid": "d9cd8559-85eb-42e1-a692-c25445f69d34", "comment": "Malware payload", "value": "5a0b5a57b96e821b18274b6047ed819e81a3be8bd8ef971cdd17f5a93b5c5337993b435b720c19ac030718fe092054c5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769641043, "uuid": "f0bd56d0-c145-4db1-8af0-65a409f0c0a5", "value": "T1BB336333D410FE0641A1EE55A2799B04D672D97748AC6418B60C4E4D0FCA9EA3BBFF4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769641043, "uuid": "2e4e33b4-135b-4929-b2d1-7f6257c548c6", "value": "1536:gcHg5AgywYIDFSD4zNq94AbluKlAGRhl0IGOEOP:gytN/3EK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769641043, "uuid": "2c04eff2-afe2-4ecc-8f58-96eeeeda0dc1", "value": 55016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769641043, "uuid": "8817a557-12a6-4dec-9769-9cd7764a1b7c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769641043, "uuid": "1cd7dd82-a7a9-4d99-b200-2be06d3ecd65", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08920684-fc40-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769601240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601240, "uuid": "9b6f75ee-2143-4468-8084-b2e2c85f915e", "comment": "Malware payload (Mirai)", "value": "b49ec13770327ce6575b113dcd6e639b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601240, "uuid": "f638d38e-b362-4db4-9711-52d9523a8b56", "comment": "Malware payload (Mirai)", "value": "a3142b278719fc6b9cdf0548aa3152df9c65fbec928eced1cbce607dbf8600fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601240, "uuid": "580fa364-1bbc-4768-aa92-8eedf2031d41", "comment": "Malware payload (Mirai)", "value": "cdd79047017fc2fda9dd8309aac0acf9f35cac0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601240, "uuid": "9029dc24-6172-42c0-adc2-076c5b2846b9", "comment": "Malware payload (Mirai)", "value": "413e08a62e31e4deccf2cd090bfff332b749cc3136db9612958ac2d759d49fff85a3b5d5af53df4a8218ec317496b3e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601240, "uuid": "e520043f-0667-4480-b6a9-e7d2ded34afa", "value": "T199C3B64E6E529F7CF32C83744BB38B3AA65527D233A0C186E25CEA411D6035E586FF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601240, "uuid": "9ff4b8e2-d783-4228-a594-1064f2b64ef5", "value": "1536:lCJ5PTTvvZvvMTvcFTx6DvF4ZeIAFnLd2vayvA0fZyi48FpoLkMWxzOPXsXzo:l+PfTxEv+HAt4a+y+oL9BXsX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769601240, "uuid": "ee4861a1-3794-4444-b4e0-5cabbb11974a", "value": 121728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769601240, "uuid": "3f6858cd-02db-4ca6-980f-4bf68f45b0ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601240, "uuid": "fd8cf105-8eec-499d-95dc-4aeeff72a80f", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75bca790-fc91-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769636212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636212, "uuid": "5c61ab6e-bc90-4931-8731-244b0777ab52", "comment": "Malware payload", "value": "3bd0f6e5f5838a76268950a682c25315", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636212, "uuid": "eead8850-af0d-43c3-bf52-953ffa630645", "comment": "Malware payload", "value": "a3243744425635a6a12497a0a2ec4064ec7919949ec3144270d1fb605d6a3643", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636212, "uuid": "e7fe62ea-2091-4e64-81e2-426e907ce9f5", "comment": "Malware payload", "value": "811e5958d203447d09a29c4a8aab49aba63d2ae3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636212, "uuid": "3f06aa7d-b709-4386-a716-5f49dbaa3c98", "comment": "Malware payload", "value": "592ad4105694976368af80996c7af211476c09e02b5856caed7e47cfc4e6e2be937f944c767c8bebe903f25568d67c30", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636212, "uuid": "33394a8c-bcbe-47d8-9522-9bc8fd6d338e", "value": "T1DF336333D410FE0641A1EE55A2799B04D672D97748AC6418B60C4E4D0FCA9EA3BBFF4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636212, "uuid": "888ec956-bcff-40a7-90d8-168fb2c9eec0", "value": "1536:CcHg5AjywCIDFSD4zNq94AbluKlAGRhl0IGCO1kA:CVtN/7OB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769636212, "uuid": "ee0cc4f7-b139-4b21-a739-fd1977eeadde", "value": 55045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769636212, "uuid": "10592a86-2187-4dab-bdf8-2569bd7da286", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636212, "uuid": "4cde2edd-426b-48a0-aa25-322b748b6677", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4508a948-fc40-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769601341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601341, "uuid": "2e69c837-c504-4a80-a647-3d53e8c45fa4", "comment": "Malware payload (Mirai)", "value": "99f285dc39d4eda4546eb856853cda9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601341, "uuid": "9713ad8f-4b5d-4f65-ab9e-7aa85e91b319", "comment": "Malware payload (Mirai)", "value": "a3872f2e31da8335f98bab3659485878a43e2ee5b3ea0cea038cbfc77ac1cdf0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601341, "uuid": "2ca54a06-813d-43e4-b80c-e73ed9494964", "comment": "Malware payload (Mirai)", "value": "f5e88e8c6b0c84615448593e152be6b6dcba1ab6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601341, "uuid": "e6ed6e72-851c-48d3-aae2-6911e248d9f2", "comment": "Malware payload (Mirai)", "value": "2ccfbbe00dd3ed85aca700b9d3fe1bc51efd67d653207132327e019c132109fb01f612b8f9c79212f7b81090fe03ecfd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601341, "uuid": "c314c7da-36bd-45b5-a9d3-f2b82c3e965f", "value": "T16D838C12CC65AD9CF07A6D7020B9CABB5313A549990F6CBA3C438725501BF98F5E3BB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601341, "uuid": "f8df4978-d0c5-46d8-9dba-9db77490f396", "value": "1536:JY4zvGqSEH+45eTeigVF+xNmxlDtWYQRpJjjuXCJSyUYgX:JYQvtH+45eaigncNu9tRQ5juXGS1bX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769601341, "uuid": "7b2fe505-d3f6-46a4-b3a2-c5035e06cbda", "value": 85660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769601341, "uuid": "31a05075-e485-4187-bd06-cb8e8f0b3811", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601341, "uuid": "41eee347-9b9b-40ba-8dff-19177ed7dbab", "value": "nklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c865683b-fc5f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769614876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769614876, "uuid": "02a00793-e7f5-4bf2-bdd7-b993e3972424", "comment": "Malware payload (Mirai)", "value": "6f8ff2cd8d511e02f24afe8b2770b59f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769614876, "uuid": "31c404b7-1ce3-413e-84c9-5f9bb2dba06b", "comment": "Malware payload (Mirai)", "value": "a4186f78e926adc385476b4b19b2f989dbbddea6d64a706a05d8d23b89f21438", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769614876, "uuid": "1a2cfe66-8e30-4a88-bc34-f9fe6c838c2d", "comment": "Malware payload (Mirai)", "value": "b5140b1d4719d9c95b90205f661df23752332d20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769614876, "uuid": "5cd730e8-9c43-4553-acc9-5a592d41c5cc", "comment": "Malware payload (Mirai)", "value": "4b399201757e4abf18c6bc62c4760d9d15c49e496bb3ceebe5db4de3785102d82bff2e33e53039c4cc5285d2bd845dae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769614876, "uuid": "5634dd3b-140e-40f8-84e6-edf19ecb6d3c", "value": "T14F535C02B7684E0BF9E619F5243F1BD483AEED9021E4B585A90FC7464235F33499DE8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769614876, "uuid": "3fd09a8c-28c1-4d68-8716-29d16d0506e4", "value": "768:zzzpxA779ZnaLskvgeFAcs1pl1gb8vpH5aEgGsllk5MDKw0COClBHW2tdFsDMUQg:zJ8ZnaOl19Hszk5J1UNbK1DVPyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769614876, "uuid": "b83d7854-5e39-4f56-b61e-890d4d4466ef", "value": 64188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769614876, "uuid": "e663f993-eca0-402d-9b8a-92ad44144a58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769614876, "uuid": "6883f6ac-0a23-40dd-99fb-206d0eb7ff83", "value": "pandora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6597f9-fc63-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769616684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616684, "uuid": "8b7bfd98-ba10-4625-93db-36496771dcc8", "comment": "Malware payload (Mirai)", "value": "316303d1d00cb16b8346a206015dd5d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616684, "uuid": "d6ddda25-4059-42e9-8e28-d1c4d215bb46", "comment": "Malware payload (Mirai)", "value": "a45ac1ef1db031124ce9db5a8442ac51136a8f0a0a75313d1e388acec3080cee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616684, "uuid": "47635b06-4a35-498f-8d63-e796123c4a28", "comment": "Malware payload (Mirai)", "value": "08b44af1d0296988121d074f91def8cffe477ecd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616684, "uuid": "5aaa52e8-e4da-42df-8b60-bdbf8664b24b", "comment": "Malware payload (Mirai)", "value": "eb1b961ecf8be02d2ce042df79b5dd291884d43689e1d7594f8ec9fdfe8a11ccdd897cb4488c45fc4f0da85530c158c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616684, "uuid": "09e2da5f-5ebb-4fb6-a156-5f8ab6e5eccd", "value": "T1F6F33969BA0F6C41F2C2D3F9DA8C87E13E1735E3C6778DA1790252EDDBA39D94980502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616684, "uuid": "13454a05-02f0-4f23-b8a0-b8bf8b46f534", "value": "1536:bdMiHrrc/qDHavM5Dtrg89RPA4b1X75rgmnX7Dy+IfMpZEn5p5M/LW:77vDtrnPTR71gmX7Dy7fMpZxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769616684, "uuid": "fe654e9c-2caf-4de9-9a4a-313ce84b9eb1", "value": 157544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769616684, "uuid": "216a7ddf-d44a-46f0-b868-8965af3793e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616684, "uuid": "d64deae8-97f0-4de4-b852-930a45df19e7", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca4ccf1-fc51-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769608709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608709, "uuid": "7a965352-18ab-46b1-8e1f-f90baa910b07", "comment": "Malware payload (Mirai)", "value": "33996f42129d55e5433667f7d0f3b5e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608709, "uuid": "d51175c0-b185-4621-9aee-faf03c2cb99d", "comment": "Malware payload (Mirai)", "value": "a5805d2e3c804ea413c9a4b5db22b0777cc35543b718a155e1ebdbb3da49b590", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608709, "uuid": "a5a852e1-b8a5-4596-8629-539341627feb", "comment": "Malware payload (Mirai)", "value": "f1e4b35b15c3800932a1b6fcf5b9a1b6135ed996", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608709, "uuid": "0638d9a3-8509-44eb-9979-a2c9c20477e3", "comment": "Malware payload (Mirai)", "value": "1b5f5589ed1085da99d96863f73be637354f1714a166ddbcf3a64b6bdb6473e55c73afe3dc57708924a1b5dcb594349c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608709, "uuid": "e913858d-d1fc-4188-8442-0e7029882a57", "value": "T1F493D716BF610FF7D8ABDC3706E92B05288C955A25A97B35B930C818F64B24F19E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608709, "uuid": "e2261103-e7b6-4f1e-a49e-2c6ce8f73dff", "value": "1536:vbMkIh2wF5rwMS75P0/EwwVzukcYZe3zHa:vbMThPSLcYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769608709, "uuid": "443d88b4-fc96-406a-b879-f44d6da17d28", "value": 89408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769608709, "uuid": "34ff3162-2fab-4f51-beec-1858fee704a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608709, "uuid": "a936c8ff-c757-4956-96b5-40a4fc3d2eb6", "value": "astro.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c781de-fc34-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1769596183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769596183, "uuid": "815245ff-623e-4887-8b46-cc20c90299e9", "comment": "Malware payload (Vidar)", "value": "8965c5da62f1855ab1d9632baebd3552", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769596183, "uuid": "9b525016-d73f-42a9-aa4f-663f1b0f2def", "comment": "Malware payload (Vidar)", "value": "a63eaad3fa1512b6e6e001ad074ff0e015e2ab24eec17b9a4ddf89ac0b11d089", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769596183, "uuid": "2f127df3-0c44-4b5b-96f4-d3c19fb539a9", "comment": "Malware payload (Vidar)", "value": "db2acb1323c155aa33cfc85de7998d134cdf2716", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769596183, "uuid": "ca11d55b-b601-4830-9251-0b003f818448", "comment": "Malware payload (Vidar)", "value": "4a0207297111b4ee198c5c87451840a24254db1f1c3dfeaaed6670d3a45c19a9b9a4ca1eecbf1090917a0478094d9aac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769596183, "uuid": "1109a169-bd48-4a4f-8630-3268d70d433b", "value": "T1E2066A03ACA149A5C4ABD1399CB6614177307C590B3023E32A46BB793FB7BD0953BB6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769596183, "uuid": "89c91ea9-7319-439d-b45e-17bd183853d6", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769596183, "uuid": "d0f8e9f2-6de6-4d64-93a2-9097f0a69789", "value": "49152:Wlo6+AM6mS9V6tmoNU81FRxLyJYhyxJBcdu9Bo7wmteiE3SzHnWFMTiBYPjcRy3H:WbLaNU84JBcdu9YwmthSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769596183, "uuid": "d59b8f13-4f60-472a-82ff-0b5b92bf69a8", "value": 3735728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769596183, "uuid": "39b6b812-00ec-437b-9f23-ee76261b1448", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769596183, "uuid": "7937b690-38f0-4c15-8324-78e3c35c8cf6", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7802194-fc27-11f0-a129-42010a9c0007", "comment": "Malware payload (Amadey)", "timestamp": 1769590822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590822, "uuid": "deea23fc-c98a-4cbf-b58e-7a20f97acd8d", "comment": "Malware payload (Amadey)", "value": "9dc7bdf4d82a1b00c32417b26695bb51", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "f397a7", "colour": "#FAFA18", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590822, "uuid": "fd4732ed-ceb2-4d09-8026-1ce8fa64a40d", "comment": "Malware payload (Amadey)", "value": "a67c656898f7250b47693bf9e36ad2062a75b97e1c3e29e8e0b8fe56318d4f68", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "f397a7", "colour": "#FAFA18", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590822, "uuid": "698b9cb2-78da-4f5a-86cf-11bd5da6a3e7", "comment": "Malware payload (Amadey)", "value": "5e6e9a995f0ec1700719196364ee32d4b6742629", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "f397a7", "colour": "#FAFA18", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590822, "uuid": "db9b9cfd-0e1c-4c0e-9962-c49d27c43f37", "comment": "Malware payload (Amadey)", "value": "d167b684e3530a949833c8f581b7b9153e0fda0e2464430bacd7146ecaaf829c00d96305ba9a8564e5a0bdbedc89e886", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "f397a7", "colour": "#FAFA18", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590822, "uuid": "b760c83a-470e-4b68-8c7f-c159d18bdaf6", "value": "T1F5358E06FA52D0B1D8D420B112B6BBF2597C6539A72445DBABC01FB69D201F33E36B2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590822, "uuid": "ec0680fa-d989-4208-9697-0c6e9f165335", "value": "aca6f08ee5befa37be16bac4bc315573", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590822, "uuid": "a63a9b3b-1413-4ef5-9c58-8f22ffae801b", "value": "24576:Sf5xDRatdGrWrz4x8/cvmGwDM1H2BPdEnunN1ljhzgPnvzJnRVIBk:Sf5xVaU24WGmhkXzFUBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769590822, "uuid": "c81837b4-c182-41a9-9bb5-71c08c2784bb", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769590822, "uuid": "931c5fb7-0298-48d4-8274-bd9323cdfec2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590822, "uuid": "c61bc70c-756b-4aab-9c03-913da405cba9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "855a7760-fc1e-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1769586846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769586846, "uuid": "98a11f8d-674c-4db3-9554-67fc5a5e7760", "comment": "Malware payload (AsyncRAT)", "value": "1caa6a248eb80b63a18d0ce0f6814216", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769586846, "uuid": "c0d32397-8638-4f26-bd50-58a8f4ef1325", "comment": "Malware payload (AsyncRAT)", "value": "a6aeb58f493464ebe65db5bd6271f06ce27599ead3ca7b30e245989a57dfb2c8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769586846, "uuid": "7dc41272-1d1b-4b61-9b8f-c258c0600935", "comment": "Malware payload (AsyncRAT)", "value": "40aee9a169d2e5cda7175268de1c68191e559467", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769586846, "uuid": "c70c8c62-c954-420a-aff4-efc3dd94ef5d", "comment": "Malware payload (AsyncRAT)", "value": "3de45d8561796a2534103015c35ffe5fe01da1c2c80799447c319731761f0cff5703d791a33ed48d3710511c359ed611", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769586846, "uuid": "be4674c6-4f74-40df-bc36-9d2b57b55048", "value": "T163D22A04B7E48AA5E1BC1BB98D7292009376E9474D67DB9E2FC440DE6623789CE14FF0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769586846, "uuid": "297c05ae-f915-4081-b8f3-3cc50760f93c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769586846, "uuid": "db6dbd61-b7d1-48e4-bbfa-506ca93a4787", "value": "384:4QXpodWMBtwfSSp+QKIcjdh93buUsTQxnCJf+jJGIjJWIoH/+:4Gp3MB6SSsQK/jDRbVB/jqH/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769586846, "uuid": "1b638383-a378-4c87-ba60-9aaddb9bbeee", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769586846, "uuid": "91bfa2c7-c7ca-4d24-bb1f-c342736a634d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769586846, "uuid": "994736e4-eece-41d9-9844-bcee2123b4fe", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7169897-fc41-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769602069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602069, "uuid": "8b8159d0-1aa2-497a-ba03-fe144d7a499b", "comment": "Malware payload (Mirai)", "value": "e5b623bad2e23c445d015d18800ce333", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602069, "uuid": "f367eb5e-c254-4290-bff2-93e1deec2063", "comment": "Malware payload (Mirai)", "value": "a6cd99999efd842a4e6d53a098b615c8709138a87b9f20b63c704e021f542aeb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602069, "uuid": "e36ad367-693c-41a7-8b2a-49e144fe8e02", "comment": "Malware payload (Mirai)", "value": "cbc1631e08e187135aff9b35e4448fc1c3eed849", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602069, "uuid": "1d37300a-3b64-4669-bbeb-d191ed43df28", "comment": "Malware payload (Mirai)", "value": "995de0c7e29bc0ade35f206501ca9d00a6abd6033da6b1f3d35dc3623da32c2352049f18334b6bfcad4b62587c9bfad0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602069, "uuid": "afcab429-3d69-4bbf-a402-54bcc6ba616b", "value": "T171938C11CCB5AEDCF03B2E3150F9C9BA9713A589D81B6CB63D478325001B988F5A6BF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602069, "uuid": "91c39d54-f4dc-4862-b817-c862cb489b81", "value": "1536:Av4mwbS+ES+Il79lDy+agwIKQiKbJRiv/FbupmVPjcCyoCOGX:AvZw+W+Il7ry+5wzNKLoFb7Pjc7BnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769602069, "uuid": "446b7542-3b72-46a9-8607-6f86a8d3fe5d", "value": 91584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769602069, "uuid": "5543a8b7-1317-48c2-810c-239e71947ed4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602069, "uuid": "e0026fda-d401-49bc-a06a-e91bc605bab4", "value": "splsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04002e43-fc45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769603379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603379, "uuid": "56eea1e9-834f-4101-b593-63165f2955b1", "comment": "Malware payload (Mirai)", "value": "7ccbe289963b68025d53980a41766d20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603379, "uuid": "a098bc80-1174-4c2d-abb3-939b8e139714", "comment": "Malware payload (Mirai)", "value": "a6dd3ee67ea2ed50379efd27bfa4e1b23fa69efa062b12eb824650157e89e07d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603379, "uuid": "710267cd-ca44-472a-a74c-87182dda95dc", "comment": "Malware payload (Mirai)", "value": "dcca3c62b50d2ba7abd00ec0b7c3cefd3ba23eb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603379, "uuid": "3b98c68e-414d-42e8-bf29-13917e951732", "comment": "Malware payload (Mirai)", "value": "1f886b3367e3cc57fffbd1a5e7941125c2546b4381f67aef8fc872ac2641d863a36eb848873e782768657254f9a3c9b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603379, "uuid": "7751d8c5-5ea4-4d75-bf3b-afc8124a04bb", "value": "T187A3C84A7FA14FF7E89BDD3709D61711248DA41B25AA7F36B534E828F20B24F15E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603379, "uuid": "e1a56312-5414-40cb-9551-ea0a6ed0279c", "value": "1536:oodt3VzfKg4SfJfPuw/uu9PLp98GfjHghP1q5UxmyUNF7:ooz3Vz9fJfPZ9mhDrUNF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769603379, "uuid": "e9de497a-e059-4e9c-b441-e91dfbf9de84", "value": 102832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769603379, "uuid": "85baee6e-c9d7-419c-b332-aec9ae0a526f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603379, "uuid": "a3c9f2e6-d3dd-4fd6-ae43-0c347d672a1b", "value": "pandora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a6e41b5-fc28-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769590935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590935, "uuid": "2d10933a-74ac-4578-9abc-41194fe69c26", "comment": "Malware payload", "value": "422875e5076daf24a1f58fe9b21a67bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590935, "uuid": "5479ef3d-1a59-4f9b-9a76-a60044ba5bc7", "comment": "Malware payload", "value": "a7003b7af78dab031889daa333fab455659a6fb09d8e815f5cee1848ae881b49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590935, "uuid": "cdd4974f-0758-4d0b-94f4-ed4f58780747", "comment": "Malware payload", "value": "274702802082a01ec1ba8dcd54dcb870fe68d98e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590935, "uuid": "0b7a855f-3ec2-46eb-a4f8-fdbb94ada98f", "comment": "Malware payload", "value": "f39d5e9de4da3efa392b43dacecdeda87a57b26ec2730e87ebf02d8a557edc90e7a9f83cb1291513cb9effbe0e8007c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590935, "uuid": "b7c9f3de-7dc8-4610-86b5-3ead3b4e2e4b", "value": "T1EE83AF40E660D462ECB2C73620765E775DB3BD2AA8B0160F1B2C35247FB36D2951F927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590935, "uuid": "8fdb145b-676c-48bf-8fa8-e925dac4a27f", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590935, "uuid": "71220768-6b0c-4411-9b16-f1e2f938c8fd", "value": "1536:oT4HrN+noJHCq0Zs0s0DAVeu6TpisYX61zHRp6PVTx:oTIN8ogtjDAVeu6TpisG6FHRp6PVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769590935, "uuid": "5faf2f36-0e1a-40fe-b218-31933fdcdb1b", "value": 83840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769590935, "uuid": "d489b094-b36b-4fde-92ff-0948e20678bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590935, "uuid": "980ae2da-3af2-4709-b678-a8dbe2a74145", "value": "a7003b7af78dab031889daa333fab455659a6fb09d8e815f5cee1848ae881b49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad29535-fc42-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769602398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602398, "uuid": "92cb4a7e-80a9-4902-8183-768a62fe578a", "comment": "Malware payload (Mirai)", "value": "e2f09ae840b10820accebd7591d6f5a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602398, "uuid": "52b8c18e-80b1-4309-9057-b4b2391b9b6d", "comment": "Malware payload (Mirai)", "value": "a7664a410794615c68167bb4956aac61a82fffd153248757b92f49de4c0c4cea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602398, "uuid": "b27ded3e-f238-4780-b26c-405967effeed", "comment": "Malware payload (Mirai)", "value": "d109a8a252f8fec1e67a05bb4f97caca4e97d9ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602398, "uuid": "b9d867d5-316e-41d1-b3c7-1f4276b6eaf8", "comment": "Malware payload (Mirai)", "value": "23f0f1b534e60dbf7312bade9a6714aa23fe2c66613d864861238e9c33d83c659aed6681a74db84d23308134177e0bd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602398, "uuid": "6573b298-e2aa-484b-a331-5bdded31376a", "value": "T160A3399ABC85C202CAE061B6FB1F558D371643B8E3E6B107CD19AF29634F85B0B37651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602398, "uuid": "10aa3366-3dcc-4da2-8aad-ed79ad639caa", "value": "3072:jTxCcMunH1vNy09t+G3RKq5GYnluwIzX:/EcMqH1o09t+k/u7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769602398, "uuid": "a746b4ee-9804-476c-a421-4cdfb7262967", "value": 99720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769602398, "uuid": "41011861-cbf7-436d-838e-85ae97156935", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602398, "uuid": "d31671fa-5e96-4511-8f0b-52e968598e2c", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee76bf8-fc3d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769600069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600069, "uuid": "2d1adc5c-9c38-4232-bf52-a9cbf2f85c2e", "comment": "Malware payload (Mirai)", "value": "7463a85bad8a96b1a3fc8991f5ad5349", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600069, "uuid": "5f9858e6-e341-4028-940c-c9589294e1a9", "comment": "Malware payload (Mirai)", "value": "a821f27fa55930b99d88cac3c4db9484d71b1767b63804ea2af5b32234da395a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600069, "uuid": "63ac8dea-2083-4705-822e-0c4d4e5a7906", "comment": "Malware payload (Mirai)", "value": "8a163336fe501cece3e28488272c13fcb64ed098", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600069, "uuid": "b7497b2f-ab66-44d3-a943-73d5c29f3780", "comment": "Malware payload (Mirai)", "value": "52a84d484495e0709bdb72e84ea2c7a28b00448101c145f77301a8976ce162a3634270f54a485dbd038ad9ee88da6264", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600069, "uuid": "51eb57b0-85a1-4323-a392-90ffe1557677", "value": "T17B934A11ED792D27C5C0763A51E30A31F5B7439D26BC9A4F7DA31D8CDF14620322BAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600069, "uuid": "fdeda3bb-ced5-4c5c-bb59-e8ddc8542ce1", "value": "1536:Rzfl2qzkyqMayP2+ICiZGU0w3Rv9/bI547ZbcwtGQnx:9QYbR21Zr59zJx7nx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769600069, "uuid": "06b6fd32-b153-4f1d-819c-008e21f9b368", "value": 91840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769600069, "uuid": "ed5da1a5-242a-4936-9c36-81567b0542b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600069, "uuid": "130963dd-0170-45ff-a219-bca3fc1fe728", "value": "nklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b11d30-fc78-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769625414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769625414, "uuid": "42413457-5e96-46d3-9831-4bf22051ac7a", "comment": "Malware payload (Mirai)", "value": "b2230a8541ec648f0241f643ef376d39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769625414, "uuid": "54629b3b-ae61-4b18-b518-115e73926c46", "comment": "Malware payload (Mirai)", "value": "a93d028cd0383852dca208935fa57bd4aaf88c0db6359839108282924bce0956", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769625414, "uuid": "f46ac344-ac3a-40b1-ab3f-4aea074b6d4b", "comment": "Malware payload (Mirai)", "value": "0e91d4b7d064ac8e78e1e09cbe02fca82b25ac30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769625414, "uuid": "e20ed608-038e-46e2-937d-62c89761c645", "comment": "Malware payload (Mirai)", "value": "5372930dcca54eceb8593cf1aec8093bba4ecbc745a42a92402b821a8f12d2f7a1a0b722f147bf8cccafe6ddec05933e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769625414, "uuid": "ae186e42-b985-409f-8d7f-8dd6714d0231", "value": "T12DF31956ED819B11D5C152BAFE0E528E33131B7CE2EE32129D246F747B8A87F0E3A415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769625414, "uuid": "96e351fe-354b-4ed1-a564-83c4d2564c6b", "value": "3072:PDw5Qcqgs41ZXkP2F55QajQJXjLvbaohEXFdZTfpPjgE9MT3egQ:Lw5Qcq41ZXkPk9KXjLTa2EVPjpPjgpT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769625414, "uuid": "c9ecc69e-bf80-44c4-a8d8-26759ef805f9", "value": 166548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769625414, "uuid": "6c25834d-4622-45d5-bcbe-f991d3aa48a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769625414, "uuid": "9ee7371a-bb78-4e53-b1bc-14d6ad0c86c1", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08111cf1-fc88-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769632162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632162, "uuid": "75c3073c-db1a-4a12-b599-7bd183110168", "comment": "Malware payload", "value": "c2fe29dc871e48cb96a323a4900dfc26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632162, "uuid": "18bd4870-7604-4ae5-a551-1f8b6108e406", "comment": "Malware payload", "value": "a98e2fbb5be77a5316776bb8c37f692b7a844ef0e02d73b7b86de3e8242e738a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632162, "uuid": "b19526f8-0dad-4174-84e0-37e8903b83dc", "comment": "Malware payload", "value": "f57c2dcf549a84cdca34ea9464865b9e679387a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632162, "uuid": "6c697d2b-e09e-4e5b-ba92-3bf995153845", "comment": "Malware payload", "value": "ae2b0b89a4badfcba59ae492515716877969ded8cb72da6692cd447ea2a08c0ffa7df8ecb993b465e16b80372617843d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632162, "uuid": "481dfdfa-fe61-4c5f-8349-0cf2b36084f9", "value": "T18C34B409AB610EF7E8AFDE3706E90B0225CCA40722A93F793574D524F54A54F4AE3D78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632162, "uuid": "1d151433-2577-43b0-8dd0-4b2c28751884", "value": "3072:1CcmoQYGiAmUgsjoUSoZSa9ni/EyIUuYUAcmVftJJOkyOLUM3j:1CcmoQYGiAmUgsjfSWnYMmV/JWOwM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769632162, "uuid": "3d688184-58ef-4d77-8352-a644bd4f13c2", "value": 245476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769632162, "uuid": "65b755c7-7d03-49cb-b654-810a62ec4416", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632162, "uuid": "fbcf78c2-6711-42c2-a060-1fd92c18a056", "value": "herios.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba61bf0a-fc2e-11f0-a129-42010a9c0007", "comment": "Malware payload (N-W0rm)", "timestamp": 1769593807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593807, "uuid": "8921cd25-94bd-4821-8197-2f636b5128d1", "comment": "Malware payload (N-W0rm)", "value": "4dfaa1dce4fe6ee6870dfa58ba14cffd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593807, "uuid": "d0cf4382-0382-4d8a-b113-65b8c86c3110", "comment": "Malware payload (N-W0rm)", "value": "aa0795c0c982cdd90182ffbbc1002e98ed95fb2100e800e046185af73ba93499", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593807, "uuid": "e8c13627-8163-42e0-8dff-4af5630c6678", "comment": "Malware payload (N-W0rm)", "value": "dc1088e11b571e8ee020634ca44112030971f90d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593807, "uuid": "13023088-a89f-40a4-be26-07bd507091e1", "comment": "Malware payload (N-W0rm)", "value": "fecaf7f70c5deb4c193c54e9ecbc73d579d6c1ea67743f6b104ec64f7f5ee98fd283aac8a5a6edd85f5c1e99e3bb7f14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593807, "uuid": "13a83236-b33b-4d3d-b675-7cb1f391b56b", "value": "T19A06D43B229B9619D01A873ECF62CA50A433BC75F3B3C1E7159072591A798F45F3A6E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593807, "uuid": "d8747d4a-c0c9-4852-adf9-1bf96d190881", "value": "4d3e559cac07b4295f34e8c489591f45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593807, "uuid": "6d57a974-6e20-4fa5-9928-c0b52b083746", "value": "49152:qDSMUxY2cPbc7RbloTBJ8doekSixjRr8loekSixjRr8mN:qDO97doekSix1r8loekSix1r8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769593807, "uuid": "0bffb573-dd02-41ca-b22d-7b5acf25856d", "value": 3664200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769593807, "uuid": "2d9d3c5d-a76b-4cd8-99d9-8c784dab2ac1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593807, "uuid": "cbe7d104-e616-47c9-826e-d00aec9259c1", "value": "aa0795c0c982cdd90182ffbbc1002e98ed95fb2100e80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23623932-fc2d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769593124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593124, "uuid": "7d9cf638-dde8-44bc-9f29-2a729f9d1e11", "comment": "Malware payload (Mirai)", "value": "cd7481a1f1004c409822c2534a05bb53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593124, "uuid": "ca5a5745-58db-47bd-961c-f18fa04f0f9c", "comment": "Malware payload (Mirai)", "value": "aa817eef98e20072b1a6289250782140009501a5da3799bac4bb4644d71a7620", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593124, "uuid": "b53ce708-958e-45db-986a-da181abc9d06", "comment": "Malware payload (Mirai)", "value": "7da278ca01d57bca927bfd94fcc087de1a87b78f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593124, "uuid": "a2eb9769-6267-4797-a3ec-2f1c6fc11d04", "comment": "Malware payload (Mirai)", "value": "d67abec08bed1a21e1e02c8e87ed9291da3931de21aa9d1c9f589bba1cd7c4fa58246dc5478006d251f039f0dde83b91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593124, "uuid": "a170575b-56bb-4351-b52b-887d1f4cfae8", "value": "T1A773B60E6E218FBDF26C833157B74B35975963E222F1C684E25CE5051E7034E586FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593124, "uuid": "929ed867-2c39-4a79-98da-a56f1d5c8de5", "value": "1536:9y2dy2gr2x6Su6njJANGI4KQ42oh5hobran7xyqQs10DTE0S/USJJ/XaaL:uHwj+P4Klan0CDSUiXZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769593124, "uuid": "605babf1-0bc7-40f4-8c0d-3c4f33f2c763", "value": 77768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769593124, "uuid": "adacf418-dfb8-4582-ab46-9786eff60c37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593124, "uuid": "71c21b1a-0848-4ed8-bcf0-05a2c1e45c42", "value": "nabmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57085d05-fc45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769603519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603519, "uuid": "209f0997-68de-4673-87cb-7dfdb8e4b34b", "comment": "Malware payload (Mirai)", "value": "d4d735b4f72e26bf5e76e32a6d3345d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603519, "uuid": "45239cef-850b-4bfc-b35a-c7e0cb502655", "comment": "Malware payload (Mirai)", "value": "aa94144b626b4c28c0e144a5fc5786b345226667cbfc274670f0c3dd775f5ae6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603519, "uuid": "1e7b6c30-1e22-4ea1-9104-205f9f295661", "comment": "Malware payload (Mirai)", "value": "195f7e64d50d241e2cbbbfb48a2c318a6af4bd08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603519, "uuid": "35a6543d-17ff-4e03-8b68-51c2b39405ee", "comment": "Malware payload (Mirai)", "value": "a66cb505e45f5db604f2b1dd7c00885985c428c68a894c931f03606aa9654afb8b2463abb0b29883a2aa7251460a2671", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603519, "uuid": "446c6e43-8585-4bec-9139-85dcf4f072da", "value": "T14E433C55BD918A16CAC56277FF0F419C371743A8E2EE73079D296F21239B86B0E37805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603519, "uuid": "ceb88602-0358-48e7-8059-1b75796a5ec1", "value": "1536:cHXyLuI8qZ25tdB5xHehqvBaq08bAFhvFXj:QXyLSqZQ3B5xHjl08wBFXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769603519, "uuid": "e4d12273-2507-4684-b0bf-46dd301dfc73", "value": 59364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769603519, "uuid": "90d20d32-9558-4041-b058-eed4bf3cb3a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603519, "uuid": "062b0aea-f63d-4184-8ec9-e91233ff4a36", "value": "nabarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74adadf6-fc09-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769577799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769577799, "uuid": "408f9fba-838c-4f61-9c31-aaedeff3cc5b", "comment": "Malware payload", "value": "4f8a3d266a3ae38fa577e3363270f022", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769577799, "uuid": "dc9bd299-4f34-4629-90bd-e9519f4c90a4", "comment": "Malware payload", "value": "aac8808e102458153102f4f81c856980283a45d549137de173f3a30119209eac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769577799, "uuid": "ad79bac8-650b-4264-b8dc-f542a3775a61", "comment": "Malware payload", "value": "f8bfe50e57a74c73feabab8e816cc00286b6cd55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769577799, "uuid": "8af1d4e8-7aba-4b7f-a6c2-c921e3e30b57", "comment": "Malware payload", "value": "6cf1e484060dbfd39ae357a8a54fb045732ae190157f56e9015f01151c54c9db5fe54a3db6cc59ee068d314df0096cc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769577799, "uuid": "2646eb47-d283-45f5-b8fa-3bbb13628d84", "value": "T1EC05237393BFE580D3D962E1BE1B01BECF553290CF87A9B530590B1153352ACA9CA329", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769577799, "uuid": "aa144e88-be95-491f-8670-ecae6569f45d", "value": "12288:gjZK30AEGvhJdNCBM7gMdnXxzZiUcvPYAO2B1g/5m6os2qRrmY1kkldbPm5:2ZK3pvVNC+7XxNOa5mquYtBm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769577799, "uuid": "0a815c19-a996-4c6a-a68f-5e754134bf1b", "value": 844929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769577799, "uuid": "13d8977a-b13a-41e6-ba89-1144522f6a72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769577799, "uuid": "7f8f5240-31b9-422b-8c77-0907e647ef02", "value": "avx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20073c79-fc38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769597843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769597843, "uuid": "664df1c9-059b-4110-91cd-c1964b5bd822", "comment": "Malware payload (Mirai)", "value": "ce9db0c7c536fba130e269c7eab07a87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769597843, "uuid": "9ba30063-843b-4c9a-a73d-459461f436ea", "comment": "Malware payload (Mirai)", "value": "aaef2f59df910dfa4d28f6b6f69bdea59f70ccc6df57a0fdc59911afb04a0603", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769597843, "uuid": "5f11055f-8ca6-45b0-890c-e74bd1a4d382", "comment": "Malware payload (Mirai)", "value": "285eec1a2dd38836b020b7a3985057b065b484b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769597843, "uuid": "255ab428-eac6-4868-9710-f8bee9b975ea", "comment": "Malware payload (Mirai)", "value": "7adb26832eb930f1e7ce4336af94419037804a05ca92895707bfe269ea3a3d9669f1b68c5f2b4f77805219f4a0aaaf56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769597843, "uuid": "cc94f40e-45d2-4d75-a2d0-b2ac8a1994d9", "value": "T1E6935A42B3690487F2A74EB02C2F6BF1539ED5A131E0F285694FDB0F8175A321586FDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769597843, "uuid": "3b09aa2c-1c68-4882-be74-0b719e84615a", "value": "1536:lsE9XdH6OORiFanDekrLYIHiv2c6y3aFmbwsZatzd85E/vLSqyLTJXPR:lsNOORa83y3/wsZaM5eQX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769597843, "uuid": "e2956619-7bfb-4485-b088-fdba962db071", "value": 96276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769597843, "uuid": "e6b32513-466a-4d7d-874d-f7caf9e460ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769597843, "uuid": "26bacd70-40d2-4120-9c15-ac8e6fe8a11f", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b182666-fc88-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769632168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632168, "uuid": "245eff44-4ede-4703-b6a7-99a248f1de15", "comment": "Malware payload (Mirai)", "value": "80669350a333a3b2c2ac97317ddc9357", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632168, "uuid": "f2fbb283-2f1d-40bf-8c8c-eef7ad5c7f5f", "comment": "Malware payload (Mirai)", "value": "ab4d6c1ddb8f9dc0dd1ecf20c6f6652bf5d85c6ce2b61022154945455ea97266", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632168, "uuid": "500bb785-00e9-4621-b7a8-940ed231e03d", "comment": "Malware payload (Mirai)", "value": "d3eff6c7a75b1f6778392a18ed4528e27b3b53b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632168, "uuid": "c157f1ad-b368-4d28-bb90-877d5418bb70", "comment": "Malware payload (Mirai)", "value": "220c74a8b094047c138aa32b6f8ff42513a0adfaa3c8b0ac0dd6dee5ce5a260d61997602ce4357f0d9961592eea0a711", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632168, "uuid": "a47562e5-5912-414b-a391-32fb7360437c", "value": "T10E246BA4FA0F6C52F2C6D3FD9A8C47F0391734E3C67699B16D1203ECDAA79D95A80901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632168, "uuid": "f1334264-c7b5-4d55-8ebf-b5ccebd52b85", "value": "3072:9tT61EYrqXsWiEEZSt4rOEoaMtnSPQIXADNj7uHNIFBysftM3a+xq:9tT6kOWaMtnSPfwR7ut/sftZ+xq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769632168, "uuid": "6965c65c-137f-42ce-8b6e-f14926da9553", "value": 223096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769632168, "uuid": "064b3a96-e283-44c6-9f72-87df58a73061", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632168, "uuid": "24013cd8-0af4-46e4-9a42-76fbb9847c93", "value": "herios.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5d4aac0-fc86-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1769631676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769631676, "uuid": "222e1985-cac7-449d-89e5-a026391c826c", "comment": "Malware payload (AsyncRAT)", "value": "a874832c6dd743f5c394e64f7f8d13a8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769631676, "uuid": "64bdb270-50c0-4dfe-b485-3ea5ca4e1a1e", "comment": "Malware payload (AsyncRAT)", "value": "abd2c370f101ab72d5ecbcef4a469daba12890dd356c146cd1b7d17ca955caae", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769631676, "uuid": "a0764654-97a4-489c-b862-ab5a46c94330", "comment": "Malware payload (AsyncRAT)", "value": "db2de82086c71d4598b4948b73a20d2382af64f9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769631676, "uuid": "e46df95e-491c-444c-bf43-7f79c464e3fa", "comment": "Malware payload (AsyncRAT)", "value": "5ad739ae65d5c7d739a97816539c971d79785c4b0d3636a721a70b65140296941a51d5540aa88914c0d3c14c696fcf1e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769631676, "uuid": "5e749b8e-d648-4c7d-90ce-07261df8c694", "value": "T1B9C207BD07E501FCED5A41B9D934A817C731F0563EB1528E42B2E8D6DF02AD2AD2CB85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769631676, "uuid": "f64ebd11-d7bb-4e9d-af17-36deaee953d6", "value": "67b2e05b342c56b6c89451a62cc934be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769631676, "uuid": "9a8b5f48-3bd9-41ba-a0ae-d57d5103275b", "value": "768:4cNnCiTGGVwg46uBkK5ZkhOUzJlKkmer0Dd:73GGiYvgc32eW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769631676, "uuid": "65f0a900-7e07-4cae-a0b0-f83617b99a47", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769631676, "uuid": "00cec263-a756-427d-9cae-d243377eea35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769631676, "uuid": "006d8048-55b1-47e8-8f2a-23e301d6f932", "value": "SecuriteInfo.com.Win32.MDE-B.73495465", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07331acb-fc88-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769632161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632161, "uuid": "ebf1c04f-eeed-49f5-8f78-83e8cd904866", "comment": "Malware payload (Mirai)", "value": "188bfde572d19aced23608ded02c90ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632161, "uuid": "155842b1-2b11-403e-9a36-8a6e7f920005", "comment": "Malware payload (Mirai)", "value": "abe3982b112308f44b9ad7ea5da1a74192767b070a360b00d841d5f3469c0412", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632161, "uuid": "1f3fcc3a-ea7e-4093-aab7-7ea3b5d6761e", "comment": "Malware payload (Mirai)", "value": "33e68686edf5b48741e6075408e5f3725fc0b243", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632161, "uuid": "67224df9-a05d-4838-a0e0-cf59f1f19af6", "comment": "Malware payload (Mirai)", "value": "e2fa296484e84d949fe4859e53a25bd76d12b9e90f870d49e1c4326d3cc75b2a166aa9830f60fc5c5948b0d97393f75c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632161, "uuid": "e6f20464-cc2e-420a-91c4-4b2ae1447951", "value": "T1AFF30656FD41AB20E5DB36FAFB0E424933530B78E3FA7102DE185F2122CAA5B0B76515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632161, "uuid": "14d3b67c-4b44-43bb-80ef-b58e9446f039", "value": "3072:qr/s9sRymXzhTXwK0e65sjrJqIwbDLEGwM+ZZa6CsMebd3fTc6othVp+Vn:blCztXwK0yjrJqIwDEGhUZa6CsMe53rD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769632161, "uuid": "d377f25c-11ad-4198-9e25-1217a74a2f1e", "value": 162472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769632161, "uuid": "8da6b9a7-7b3b-4e9e-a484-7c36b138329c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632161, "uuid": "3c5e7ce6-ae84-48f9-87f0-41c6184c71d0", "value": "herios.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "021860e8-fc28-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769590921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590921, "uuid": "313ef454-b37c-4e89-b8d1-74633ae652b4", "comment": "Malware payload", "value": "854b791ea5f085a897f17a00f31a1886", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590921, "uuid": "f30b894b-e8bd-4c3d-9cc7-996702cde936", "comment": "Malware payload", "value": "abfd538dd8d46d4c4f7e2c2ff40b0a7c490daea1c27142b1250721f39d5babb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590921, "uuid": "e659ab58-a2a6-407d-88fb-c7104c482567", "comment": "Malware payload", "value": "ac47352ac46c27189c2236516bf4e02e40fe166e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590921, "uuid": "7884d09f-c08c-42f0-b672-43ca2ba999b9", "comment": "Malware payload", "value": "689f60b9c66c4857c6b78175c846f07acccfa04b5208873914773519f48b15800492ebb100fdf7ff9a3d3a3b8cdbb6d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590921, "uuid": "036255d6-2675-4974-aab3-af27cf998f60", "value": "T1B083AF40E660D462ECB2C73620765E775EB3BD2AA8B0160F1B2C35247FB36D2951F927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590921, "uuid": "349d8448-40e1-435b-b3e1-5806da4298f9", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590921, "uuid": "3c79e7ca-7f36-4531-8c0b-a5583ddb71fa", "value": "1536:CT4HrN+noJHCq0Zs0s0DAVeu6TpisYX61zHRpngVP:CTIN8ogtjDAVeu6TpisG6FHRpngVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769590921, "uuid": "69c2db8b-6d6e-49ae-a43e-80663aa321a5", "value": 83840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769590921, "uuid": "885a6261-8293-4b36-80f2-c23c24274431", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590921, "uuid": "9b7c248f-61a7-4565-ab60-cf8d1836c034", "value": "abfd538dd8d46d4c4f7e2c2ff40b0a7c490daea1c27142b1250721f39d5babb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c515c6e-fc66-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769617701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617701, "uuid": "2a3d12ca-a003-4a7d-87ac-8a877c3d1e47", "comment": "Malware payload (Mirai)", "value": "7fe1f56885ec8d33e59df28f74d87a81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617701, "uuid": "ca059435-47e3-441b-8c07-90bd8ec9c530", "comment": "Malware payload (Mirai)", "value": "ac0de66ad392299c321c00db0b0f010ff5d63a18392364b8f07ea8da4f94c52f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617701, "uuid": "519369c5-98b2-47ca-987b-83cd93b29ae3", "comment": "Malware payload (Mirai)", "value": "3de9b0942fdc77a3690fdf34a66932c91c8c607a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617701, "uuid": "926ae1ac-ea39-43be-a637-d7cd525c2ebb", "comment": "Malware payload (Mirai)", "value": "af156c3e2373b1ba5ed7cab457b9c9f7ef708cf348d5f60a90b05be2e754260112c1022eda95c584b9ac5c3a1518eead", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617701, "uuid": "f203c5f6-1cfb-4e27-98ec-b37963181a0b", "value": "T13F734B41BC819B12C6D1127BFB5E428D772617A8E2EE7307DD256F21378781B0E7B246", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617701, "uuid": "579082f2-5e5c-45b4-a158-d552b181523f", "value": "1536:W6Rp+V2ZMFNK2rKzBBvNim6Gs6NBM/O6rDcw5+Snvws:W6RlKFA2r84m6GsqhMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769617701, "uuid": "c470d399-f4f0-4f7b-a3cd-73da1de05083", "value": 75604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769617701, "uuid": "fb4fc453-249e-4bf4-ac70-f27ff2e87fe1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617701, "uuid": "c88ad87a-b486-4607-bb03-0bf0abc3e35d", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db2e558a-fc6b-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1769620061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769620061, "uuid": "452164ce-2e71-4af2-8581-de61bee48d29", "comment": "Malware payload (Adware.Neoreklami)", "value": "b767c6fcfa5a87b274dc0fdeb3c0322b", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769620061, "uuid": "c4d1b5df-1fd5-4eb4-9e21-0b4aec46f08b", "comment": "Malware payload (Adware.Neoreklami)", "value": "aecc358fe3b7c7226aa6b90bb0eedeed2f7c01af3d9458881731e508d47fa0cd", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769620061, "uuid": "ba3e434b-b9ea-45cd-bd85-05788f874871", "comment": "Malware payload (Adware.Neoreklami)", "value": "f03598f3fd637459fc0a1be9284873227b72adc3", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769620061, "uuid": "74f673e3-9de7-42eb-892c-b2c0e7a16ae1", "comment": "Malware payload (Adware.Neoreklami)", "value": "aab5abe4a15ecd3672cd04b0f9c56ec7b78961fec0351071e984187349222e98d7243a67fc9261de8c12f32e859c91f4", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769620061, "uuid": "9337299c-353f-4282-af2d-818cb9dbc06c", "value": "T1D276331132E2D1F7C9723A3355D63AF3F5A4A1680A1A853B77B6384F2B7CEC5C849852", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769620061, "uuid": "9fae7d3d-0b9b-4ca9-8ac0-af28698f2cc1", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769620061, "uuid": "4e861aea-0d51-40ce-b7a5-9a5cc21b6dad", "value": "196608:P1OMQhGe7vVGLUs1++l3be/QpruT7SwhV:tOMQhGUQ+M3be/Qpru7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769620061, "uuid": "1f62f524-07dd-4f32-afed-ee86a4ddd2d0", "value": 7492333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769620061, "uuid": "4fea56e2-4f1b-446d-b4e1-f591fda787cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769620061, "uuid": "8dfc9264-c611-4cc9-9c59-28007fb40604", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64791101-fc5e-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1769614279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769614279, "uuid": "8933d6d4-0780-473f-9885-2b1e9fbbb1cd", "comment": "Malware payload (Vidar)", "value": "57f35bde28932b586879df649ebb8f8c", "object_relation": "md5", "Tag": [ { "name": "BB1.file", "colour": "#D5282F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769614279, "uuid": "867cc24d-e6cd-4408-8ff5-69f3eaa3f39f", "comment": "Malware payload (Vidar)", "value": "b15a74df9010e1fae7ffdcff7c96a26f5cb9aa9dcf720b716a2903488fd322a5", "object_relation": "sha256", "Tag": [ { "name": "BB1.file", "colour": "#D5282F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769614279, "uuid": "1170c133-962d-4962-a13e-eb252841457e", "comment": "Malware payload (Vidar)", "value": "cf2231a278d461c0efd91a49220bbb22e9e091bd", "object_relation": "sha1", "Tag": [ { "name": "BB1.file", "colour": "#D5282F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769614279, "uuid": "d2fd7267-b2eb-48ef-8f19-add58ab4e35f", "comment": "Malware payload (Vidar)", "value": "74717737f550de115d6714bc74e0b5d0bb4c76808114b32a6e3f887f4d31477d8915c223666300af519272f782d4d08e", "object_relation": "sha3-384", "Tag": [ { "name": "BB1.file", "colour": "#D5282F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769614279, "uuid": "b05610a6-2c04-46c5-8211-5aed0e9300d9", "value": "T10175232867F4A037E57B57B58AF24201C63570E1DFB216AF718887A86B722F15B34B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769614279, "uuid": "e242385a-8ff5-4cab-8e4b-dca2b6bcccae", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769614279, "uuid": "a794c9ea-07a5-4768-8b2b-b1df4ecb95db", "value": "24576:XfK2Db2ZC5JBHtmfbWHzKyBQsrIbQLF0TQjT3I82q7NvRxUDp4tjuld+R1QtIaTe:nqC5JZUy9yTGmq7NoFMc4KaI6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769614279, "uuid": "9654ea11-561a-4bc1-9b3c-e502464ab47f", "value": 1691648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769614279, "uuid": "68b404cf-f9d5-44b4-b70d-76ef8560642e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769614279, "uuid": "af9c4d43-49b3-46c2-9498-72c9ba5f3667", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c0427cb-fc48-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769604869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769604869, "uuid": "dc562b4f-fb7b-4a06-aca3-d6bba54db2d1", "comment": "Malware payload (Mirai)", "value": "80d1b69cfddb0c8a7d8aa93bf6b8be8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769604869, "uuid": "8ad6a65b-6a08-4b0d-a54d-8b10713e0a0e", "comment": "Malware payload (Mirai)", "value": "b222b32c771a0099e0253a1e934b4ab79d64ce9f4348c224ea5d57f81e6ee4ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769604869, "uuid": "5d33f386-abbc-42a0-adc0-703ee8104994", "comment": "Malware payload (Mirai)", "value": "800c328655faa18850fbb0fa651bf07cc1c7b379", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769604869, "uuid": "116aea87-743a-4746-8d3a-c988aa71f1c1", "comment": "Malware payload (Mirai)", "value": "bdfdb4e0e5ce913885775a491f47a7f765668b305fb2eff25fa6d78f3443078e0142e7932789e4aa57af095a5a2470cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769604869, "uuid": "f408b6dc-88db-4d79-a7cd-fd33335de51a", "value": "T151431B55B986CA16CAC46677FF0F529C3B1643A8E2EE73039D296F20279B46B0F37441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769604869, "uuid": "36db4a01-c957-40ec-9d51-061820b1050d", "value": "1536:WN2eMNZAAC2/bJm547euZvBaq2UAT5qX:k2e2AACetm547bl2pFqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769604869, "uuid": "8544865f-fa7e-432c-be37-e2509ff929ae", "value": 56288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769604869, "uuid": "4a579883-208b-4654-90d3-913e4b826cce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769604869, "uuid": "5dc67080-307b-413a-93c6-c724b4758e49", "value": "nabarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf090285-fc55-11f0-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1769610565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610565, "uuid": "11919fcc-31e0-4deb-ae89-597e383d5ac3", "comment": "Malware payload (DarkTortilla)", "value": "e5b2b0a357487ae8caefc4e5d9f64e33", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610565, "uuid": "f18a4f66-5fd9-472f-8846-47e797b1f507", "comment": "Malware payload (DarkTortilla)", "value": "b59f237069f8faccd2b47d23767c95ef269ea70bd910ad816728568afb9bec65", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610565, "uuid": "c1c3ff65-e8a6-4796-a6ee-045fb1cd3c52", "comment": "Malware payload (DarkTortilla)", "value": "79fe976ae9197046c1e9aeda3a6cbfd1519bb722", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610565, "uuid": "ceffd30a-5943-4999-afa0-af3eb04ecd1f", "comment": "Malware payload (DarkTortilla)", "value": "bd519099995ae5f62fe041b3a082e9b43567b8e0f19b6877c10bbf946b0aaedda82c3e619f537edc1804058ab9af862d", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610565, "uuid": "1dd2361d-9c4e-45d9-bf91-e73845eba9fc", "value": "T1C9F4DF0813E88648F8BEAB749177361547F0B40AD93AEF9FA3C460F918367A5D593723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610565, "uuid": "7be01a26-2d48-49c0-8628-6e2da5dc03e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610565, "uuid": "b6048fc5-9f3d-411c-ae10-048deda5a486", "value": "12288:9fMUtvCnolCsoYdAA9mJadBeFZYBpqEC1xv0oi7QxK5OpB/hkjrG:9fMUdfMs1hsAdBen2pqpdJiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769610565, "uuid": "4052c6ce-4062-4b0f-91ea-0e32ed8a9ced", "value": 755200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769610565, "uuid": "1180496b-1070-45a4-9b4f-a8030462ff51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610565, "uuid": "b5b141db-75b2-4471-ad9f-a9fb29c8078f", "value": "QUOTATION 8026844-20262701-UK.pdf93KB.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ca464a-fc2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1769593935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593935, "uuid": "98421186-8d82-4fc7-a170-6c19a449e83c", "comment": "Malware payload (Vidar)", "value": "79b50158103bf744886797f652c36577", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593935, "uuid": "65a7d80a-44ae-4d75-92cd-565e50261444", "comment": "Malware payload (Vidar)", "value": "b5a43368e9c98061920c5322080077a18838b699b016c204ccb286694139856b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593935, "uuid": "132a179c-26a3-495c-bcea-9f79586b7e4c", "comment": "Malware payload (Vidar)", "value": "4b643651cca4d41e2569500e09ad8e6255c47155", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593935, "uuid": "4235aac0-e175-44a5-bc8d-2120e06cb075", "comment": "Malware payload (Vidar)", "value": "362061fcd7b37beac76786970e295a0abeee03c4056ec97fb6d04fca4e3f4145f8ac0699b2d121ae2c566f2dff88a8a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593935, "uuid": "3448fc6a-8381-490a-b177-ea33e4abaad8", "value": "T152064A536D928DA5C0AAD139DC76914977703C094B3133CB2A937A3A2FB77C0517BBA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593935, "uuid": "68b1b81b-4e35-4180-bfb7-298e7aea4fcb", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593935, "uuid": "3b4f64cb-8caa-49a4-a7f2-f4dbd1413b46", "value": "49152:pHq6fu5XovuHv27muGhVLec/YrcxqIQ+Jn5gfg6/:p76ijchL6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769593935, "uuid": "5cc1e7e8-787b-490a-889e-bb52f623acd7", "value": 3968216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769593935, "uuid": "2cb37e79-a2f5-4de2-bac3-938ccb8bcc5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593935, "uuid": "85c7bf97-dcf0-4c01-b1b6-a53727e6d1cd", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7cb30c9-fc82-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769629853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769629853, "uuid": "e56991e0-2990-4ebb-a1d8-ca46fba4e6a9", "comment": "Malware payload (Mirai)", "value": "6f511cd51c4097dd463cd27dceb6b96f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769629853, "uuid": "c39e4ee5-c87e-474a-a6c2-95976982a3f9", "comment": "Malware payload (Mirai)", "value": "b66fb87f09220c9c0c858cb5a934c8849c4b6df38778c89840c1a1b14f09375f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769629853, "uuid": "c9d790d9-9a46-45ce-85f1-6160c93f4c20", "comment": "Malware payload (Mirai)", "value": "d54469b66878c2b75ed2c7d853a7ada7262a1508", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769629853, "uuid": "ef7197d2-d834-4b13-881f-668d196bb263", "comment": "Malware payload (Mirai)", "value": "f839852a4734a30f2e28fc0e07b818adcf3cd038cbab34fc90bc60ae1c7a9abe683e9e595fa6f08000568abfc7de2ae8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769629853, "uuid": "d4a47f59-a214-4d9d-93c2-7993f9fad5ac", "value": "T17C210E66B5D9EC72CB2601B7A2C19F4F2715C9E6595BFF07CE604803EC286C1D831220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769629853, "uuid": "10f54216-f35e-468c-8582-0028f825beec", "value": "24:FlmgMoJ5ZdWul6ZSiSZSLOUrYaxwAQqGrpkruQ6RMNfTh:f9xvZMgsSi0SLOUrBwAQqGpYHHNV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769629853, "uuid": "0e54ffc1-e134-4b9e-a49f-33f420b45405", "value": 1180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769629853, "uuid": "be56e458-1675-4122-920c-858e4ae6821c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769629853, "uuid": "92ec772b-b784-480f-8ba7-ed746c996efb", "value": "dlr.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd40dcd-fc54-11f0-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1769610026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610026, "uuid": "c3af45da-779f-4b1d-8d53-300f4031c1e4", "comment": "Malware payload (DarkTortilla)", "value": "714bf8f5f4a5e55ddf651fe669a7bb4e", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610026, "uuid": "a66c125c-c089-4691-9173-e75f8152ab97", "comment": "Malware payload (DarkTortilla)", "value": "b6eb415d7b1be65850ede04ebe14006c319b11be80702c1d10ffd58a915a4f0f", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610026, "uuid": "1a6269ea-3cd0-4c6c-b079-462b3eaffa7c", "comment": "Malware payload (DarkTortilla)", "value": "4adc6b75623561741d9b8fabbc1ee4c59d1177d4", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610026, "uuid": "2dfca200-c8ac-458c-96bb-4d9c56395604", "comment": "Malware payload (DarkTortilla)", "value": "0aae72010deb734a1a928a04275da1c303f4c271ff7ca9bf645c5b83d62f2a2e589feceb580f2188de14a9fce8c346e8", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610026, "uuid": "45681e2d-8500-4435-8a5b-6b0d7e656338", "value": "T19595010813D4864CF97DAB3480773A1297F0B40AE97AEF9FA3C460AE1C357A59697713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610026, "uuid": "b51d5da8-c011-48d4-864a-306ef2f303df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610026, "uuid": "0a121f35-fb74-4c08-904a-88678e7dfb10", "value": "24576:gnfMs1hsAdBen2pqp/IeB/eG9B6VjqIkcSAB9NAIQn+:gnfTfeXB/IV+I7Di5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769610026, "uuid": "85ca0ce9-a765-488e-a4e8-82984386f1b9", "value": 1897472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769610026, "uuid": "3de02398-6e2f-470b-a59d-d9c456699c04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610026, "uuid": "070f74bc-ff18-4f2a-bbf5-1cc6dd15295f", "value": "VRFBT2025ENG037.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fd1a53f-fc51-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769608714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608714, "uuid": "8185f5f0-731c-43d5-96de-beafd28c1cc5", "comment": "Malware payload (Mirai)", "value": "6bf32fcc5ffba836d720df8733258d5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608714, "uuid": "f133971d-27dd-48ae-9d55-75ded493bbac", "comment": "Malware payload (Mirai)", "value": "b86e2472b3637223ab876135144eea5fb916cb0cee01603b458d93d738aa7e34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608714, "uuid": "3da06051-661e-455d-9dd2-595d51b737a7", "comment": "Malware payload (Mirai)", "value": "f807608c416d3496d7466ebd5786a4d69aaa4c39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608714, "uuid": "c100318f-75b7-4f29-83ad-c7b58d983476", "comment": "Malware payload (Mirai)", "value": "686fff37e8fe354e59a388cbe7a3ce7f17e836388f17a270d33916b8cf6bea3efb6278f721d939bde17c01f8084e7a6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608714, "uuid": "fbb1a50d-0c34-4f65-b288-fb1f0fdce0bf", "value": "T1C2731981B8819A25C6D513BBFD1F018E331697E8E3DE731299205F647BCB91B0D27E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608714, "uuid": "ae79426b-daf3-4fd5-81a1-fa52d928d45d", "value": "1536:Idn9YYtkiuxZw9NCYMygPLW++9gZ3z5yAMS1faXygceI6iDJqwsjcCs:Npi2ZUNiyi6++9gh4XStdJqwsjcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769608714, "uuid": "8e84161b-6d03-4563-be26-412cd5727b61", "value": 80448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769608714, "uuid": "9f599435-182e-48d9-bcc4-28fdccd47e4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608714, "uuid": "798dea71-f2c3-4e31-9614-981bbd57d6bc", "value": "astro.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d741b2f-fc3d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769600067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600067, "uuid": "fbdc4c2f-2454-4dde-bd9c-313032be9470", "comment": "Malware payload (Mirai)", "value": "2e69117f9db01adf3697415ab025fb37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600067, "uuid": "9a25b4bb-1124-4e9c-84c9-311d6ad811ec", "comment": "Malware payload (Mirai)", "value": "b895b9f2816586128af14e6c501472aa134070ac1a6eeba7a424389e5bb25d8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600067, "uuid": "84bd9fd2-15a7-4b6e-951e-cccafb7d2359", "comment": "Malware payload (Mirai)", "value": "9d1e30488b74c8043ea290f7fcfc52d25e60f1e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600067, "uuid": "264c9cea-0220-44c1-969b-c69a1fc4f356", "comment": "Malware payload (Mirai)", "value": "f72d0b3cbd71bf8bd8a17d92c1d75adb4c447e1fbbc2bc793169088caa6887b52bb24c0546df86e23c95d5e41c636a26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600067, "uuid": "1cb7fdfc-af87-4756-8a16-0a8f624a0f68", "value": "T100636C32BD791D2BC2C4B57B51E74231F6F6439A21B88A1E7CA10E9CFF546403217AB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600067, "uuid": "fb01182c-86ab-408b-bf5d-4821862e30c5", "value": "1536:bLE0EoL+pwLO4gAyjfRR8PjOZ0N+N4sqdZDdns:/eoL+pw/yjJWK7Wtdns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769600067, "uuid": "12f3bb0b-4d67-4722-a94e-de84f267f078", "value": 67012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769600067, "uuid": "b1c2b180-4b26-4c5f-8724-490bd6b8ed4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600067, "uuid": "cf3f2ce5-30be-483e-9122-b5de5bb019a1", "value": "nabspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b82be27-fc7c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769627014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769627014, "uuid": "449a9dad-d379-4405-9f43-1d5f350cb63b", "comment": "Malware payload (Mirai)", "value": "ee75c2d571a6d1386fb414a4521f93ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769627014, "uuid": "bd08b125-c3b3-4931-9708-374f51626b09", "comment": "Malware payload (Mirai)", "value": "b8a9271df82cf2a378c26e2fe52eec759f3f84b81602a61467ef62652147d149", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769627014, "uuid": "7dd1010f-ab14-498d-981f-a29c2df3d573", "comment": "Malware payload (Mirai)", "value": "13153442dff7a5caa2e42aad20c009175fc7a8f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769627014, "uuid": "f4ab9b1b-2d9f-4fd2-adac-fb90b7539ed3", "comment": "Malware payload (Mirai)", "value": "4b2f836c4d853ec63b79117b23b2fa3a391ee52745f5b0603459be291d6e56546aeafebdcdec145aee6b026581666c88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769627014, "uuid": "cd7748ce-154b-4d4f-bd44-4f2a7bd49b99", "value": "T137C33B4AEB408B17C0D21779B6DF42463323A795A3DB330659289FF43F867AE1E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769627014, "uuid": "c20a9459-f243-4a74-934d-2024e28d33d8", "value": "1536:B4nlryiFmcomQGfVBJFJgiTZe4QAR+wv2lNfNi28Sqe7LmoPizw/9Z5M8MA62rl:PBAFJgiTZe4KB8Sqe7So6M/9kQnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769627014, "uuid": "925ac0b9-2609-4265-ae88-fb496e89db1b", "value": 120615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769627014, "uuid": "6ab2886e-d657-40aa-af63-932e8a586763", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769627014, "uuid": "24863506-4a73-4e0d-9c0d-3cdd34873453", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f36f83-fc88-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769632164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632164, "uuid": "91460028-369f-4585-99f3-f338f2190855", "comment": "Malware payload", "value": "6f3e4e990b41b0056183828e463f9516", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632164, "uuid": "0628ea46-0370-4e74-b166-6d88e5d005ca", "comment": "Malware payload", "value": "b8f6b53d0c2330dee76418f6666f742362d39e3ee1c320db6f26fb8bf996a283", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632164, "uuid": "daf60152-9e7c-4d6d-b26a-8fa68ff6c220", "comment": "Malware payload", "value": "183162d070401627179b4a20df9cebd0ed398707", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632164, "uuid": "df3f9987-2348-4805-b935-4cc493e1f58a", "comment": "Malware payload", "value": "b2ae6963ba442b6ba0151917ce488c38c941d0beb176761b5c5ce81da1726f2f5978f7f9e273e533e6854b94153baf95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632164, "uuid": "59fe7515-ceb3-4102-8923-87a6cf38e944", "value": "T19FF37B73CC256FA8D624D5B5B4F48F785F63A85081872FBA59ABC2744083D8CF2593B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632164, "uuid": "cce3b3a9-6aff-4649-955e-0862851abe72", "value": "3072:YV/ZFKpUBu3jFIzqZBrw7uELSBpTZ0W9EjkOk:SNuFIzqZpwpMZt9HOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769632164, "uuid": "1545d068-7689-4234-82e3-1e606a62a612", "value": 166528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769632164, "uuid": "5fb446b0-24cf-4a90-b374-71fa5334a4c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632164, "uuid": "b64e2598-7ae2-4d98-87d1-5bd6eab15378", "value": "herios.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c138748a-fc1a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769585228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769585228, "uuid": "e81c3f51-3e54-4a48-a150-4f89f0d9df86", "comment": "Malware payload", "value": "8a82f1f6130c64f08b7b00255d16e0be", "object_relation": "md5", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769585228, "uuid": "8fb4737e-a8bd-478a-a881-58a9d791f402", "comment": "Malware payload", "value": "b967fe70daacd0d1d0b8094d20bc5b10d890ca34a8ff1b2a0ff80d355241c37c", "object_relation": "sha256", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769585228, "uuid": "be5a41d3-e65d-4146-86c5-42c3e25b343d", "comment": "Malware payload", "value": "e4d50be45121520bc664997a29e45c2873874cb7", "object_relation": "sha1", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769585228, "uuid": "864011e1-fd62-4e79-87f7-d8a50a44401e", "comment": "Malware payload", "value": "34f7629d82eb168de58fb0b67e1b90b41c980292882ca2f1b6385cd37353ba857dc88e38f0348ce411a136be66c4edad", "object_relation": "sha3-384", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769585228, "uuid": "cdaf00fb-060f-4925-9172-594149006a32", "value": "T1A815D0376E695D84EF950FFF8232D1A18CD8E987A465C4E1BC400940BDE87D4F9687A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769585228, "uuid": "a23a7974-fddb-4555-b698-390e8cc00e25", "value": "12288:7uX4Nc/t6oa5xFnJAvaNppDSket/EaxmNrdnjZpsiS:iXL/IoUzJUaPArmNHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769585228, "uuid": "cf3985b8-2ff7-4f4f-8444-8c1ba5eedee8", "value": 947986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769585228, "uuid": "35127e01-644e-4ccd-b515-17abe586d777", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769585228, "uuid": "658b5eb6-a762-4245-bd00-15023d19248a", "value": "WormGPT_MacOS.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a98ec27d-fc62-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1769616113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616113, "uuid": "8e99b190-a75b-4d6c-93cb-6e8dd5f6fec7", "comment": "Malware payload (AsyncRAT)", "value": "4d6f28bdb99b8e969046e68084fc9d9f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616113, "uuid": "2ff17804-f487-4f54-be75-417ae9c86fff", "comment": "Malware payload (AsyncRAT)", "value": "b9bcb58a007f500432d69d733cd9e2c41e806cdeb088c415f7c8e46debb88a1b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616113, "uuid": "94aa49a2-3545-48c1-8c29-432f6448026f", "comment": "Malware payload (AsyncRAT)", "value": "244b82b13c2eed56b2fa4d1b8803b8d59bcc7b8d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616113, "uuid": "594a1e3a-83f9-4d2b-91d4-a8a089e24dcd", "comment": "Malware payload (AsyncRAT)", "value": "58d7ae3b484b00eb87e1978e53fc3e2afb7e595ebb34f472e6c537318e21ffccea98bf1be5522373dcc41936c8c48d9a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616113, "uuid": "c666474f-ecf3-4513-82ad-b59daca818ac", "value": "T142535A042798C965E2AE8AF4BCF2950006B5D9372106DA5E7CC405DBAB9FFC646123FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616113, "uuid": "1226d57e-c4ca-4097-8d94-5a58c4d2d308", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616113, "uuid": "96bd635d-e137-4cc4-9290-78b8b1321130", "value": "768:P9gRaaZPiP9GBi49J59c4ROF24Xx3nzhIs1+jKSCv7mqb2nGp1H1oE5cHmQJnz8R:PkZEC5sFzzhIscGbbB16H+G2IVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769616113, "uuid": "f48143c3-2135-4dd4-8536-eac08ca77399", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769616113, "uuid": "7e327d5a-1ee3-45a5-8636-597ea05566f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616113, "uuid": "c0f42863-c95b-42cb-87fd-61c04b1bcba3", "value": "NexaraEndpointGuardian.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f7ef75-fc56-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769610823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610823, "uuid": "7cf501ce-1bc4-41a3-b475-c344e1206372", "comment": "Malware payload", "value": "cdcb7d2594821077b771c9b772ba3854", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610823, "uuid": "a2e8af66-a4f5-442a-b11d-9aaf992f99c6", "comment": "Malware payload", "value": "b9c6cb5bc86d933fef212abc895f2f1d475ba80c51450266d6f49959c33273c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610823, "uuid": "1414a17d-4c0f-4d8c-ab9e-305728db2394", "comment": "Malware payload", "value": "b8069e130e03499666fd5deffa016233de17f37b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610823, "uuid": "83b4f563-e02c-4334-bbca-38cd6208bc0f", "comment": "Malware payload", "value": "44aa8e3b2a9852fde31256947c17e728ad72984f472e7a3d22186948943743b98ced1bf763af76b54a09041508129ab8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610823, "uuid": "045359b7-f918-4678-9ff9-5d681e9a1ff8", "value": "T1216512B0988D3496E574871BC06DA2D5EAF2192EA802861EA2850DDED37FFF115CCF74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610823, "uuid": "e39cc454-4541-40f1-8954-aeb4a0a64b98", "value": "96:Zj6dEcGtAKDxlebLFDB/vVKsTUX4DDHwyglGe0SKo26jYYE+up/MP6gYyexsz1LU:iK2FvL3wtQfSVKy1LFsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769610823, "uuid": "ed87c8c4-8070-4dca-ba64-36e1404aa7fd", "value": 1450663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769610823, "uuid": "40c4e912-be42-4038-a81d-5b74704bc9b0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610823, "uuid": "acf0cc5b-808d-4dba-9c9e-d536a32ec7a1", "value": "LUK.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf9ca56-fc9d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769641271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641271, "uuid": "cfc1c6fe-eecd-47ce-9823-d940af3cfd67", "comment": "Malware payload (Mirai)", "value": "1cf8d5444f06b408cffc66232fe12dd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641271, "uuid": "cee0806f-2f7e-468b-9406-81f874c63648", "comment": "Malware payload (Mirai)", "value": "b9f8a36131fdec35b7bf835b48117850b493e21e9f4902455229d1602f2c9689", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641271, "uuid": "2446fd3d-9b90-45fc-bb91-34c217fc4959", "comment": "Malware payload (Mirai)", "value": "442f488fbfb1e422c24a4abf9f273ff34b63122f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641271, "uuid": "58c40b63-66fd-46cc-b9e8-0b584fb452c7", "comment": "Malware payload (Mirai)", "value": "f08c9dfc9b540d667fff93a5e6ca427ce852793192b9c0db0313c032e59ac3ae37d349a77e4b2de4762539b197b62d87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769641271, "uuid": "cc7d9eea-51fb-4db0-a5aa-6483a3389ed1", "value": "T127B34901B3690447F2A74DB1283F6BF593EED1A221F0F285694EDB0F8175A321596FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769641271, "uuid": "f63896ae-6691-4070-ad39-b41e46b11bd1", "value": "1536:M9zcHjOZNjcn49ekrLYIHiv29lqXMS0uwmy/xzaxVyePg0ay6arrGTqe+ZrX3T:zOng4NqvA/CC056Z6X3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769641271, "uuid": "ed3316bf-d2f2-476e-98ec-8fb93b9745e8", "value": 110404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769641271, "uuid": "eb4de2db-164f-473a-8734-708bed6c496d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769641271, "uuid": "203a6411-6bcd-40c3-b32c-b4f4b1952f28", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b257af93-fc7e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769628153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769628153, "uuid": "7d17b152-dac7-422b-b58b-ca16a93f6bd3", "comment": "Malware payload", "value": "a87ad312a127b28a072ec5ed2f498555", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769628153, "uuid": "923f61ce-0d6c-457d-9467-0983c4f90f83", "comment": "Malware payload", "value": "ba6c147f4cc674188e38a3ce9ed575aed70c2f53c08d3ba4c103c6222d27c842", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769628153, "uuid": "d80a1784-1599-4f11-a5d4-1a17f4ce0f35", "comment": "Malware payload", "value": "9a96b578a0e1efbdb1ac88c35a37ba32cd7a6c9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769628153, "uuid": "894008de-bcfc-4403-9ba6-c21f2349f04f", "comment": "Malware payload", "value": "eed3b76c34bb6771b02370095a13c96367504701f66381388bf40a6e9a2ccefa98d053249766c886fc646b9bcdcd3e16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769628153, "uuid": "7977aef1-c0cd-4b00-820f-e5ddf0836916", "value": "T18DE533D2C95E5AF04BC955C5B70B16EB9A1019356D8BF037B0DB627942B8CB83D8630F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769628153, "uuid": "41408e8d-ae99-4007-9d65-dad5f9d6353d", "value": "98304:26oqLbHxY/ahfA8jSe+Qqes4yeXo8zHUehQxp8FdMGhKpRIiX:ZFbRY/7Rco8QbR91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769628153, "uuid": "b3bd2cb7-495e-47ee-9bb3-01d9b39267ed", "value": 3244425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769628153, "uuid": "37c17302-2072-4628-b162-96f7b8de4172", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769628153, "uuid": "0f48aba7-c22a-4ab8-8e23-c28f4448525f", "value": "SecuriteInfo.com.Trojan.Linux.GenericKD.70211.24869.12374", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77bd899d-fc6b-11f0-a129-42010a9c0007", "comment": "Malware payload (Amadey)", "timestamp": 1769619894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769619894, "uuid": "3f7e1ff7-9907-436a-973f-2cfcb956636b", "comment": "Malware payload (Amadey)", "value": "40e502533b2a521d0974e1d9b6076c82", "object_relation": "md5", "Tag": [ { "name": "07072f", "colour": "#19557B", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "clip.dll", "colour": "#3A8D51", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769619894, "uuid": "e367673b-47f3-4873-93df-e663c3e8706c", "comment": "Malware payload (Amadey)", "value": "bae0f38f58ad93728261f09840721ebedb9669a445f40083396fdd0da38a22a7", "object_relation": "sha256", "Tag": [ { "name": "07072f", "colour": "#19557B", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "clip.dll", "colour": "#3A8D51", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769619894, "uuid": "fbf096a0-1d8d-491a-aa25-fdbd94eef58e", "comment": "Malware payload (Amadey)", "value": "1f5fb33bbe2f8b6c5758113794be2f68a578cbf3", "object_relation": "sha1", "Tag": [ { "name": "07072f", "colour": "#19557B", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "clip.dll", "colour": "#3A8D51", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769619894, "uuid": "bf8dd2da-c173-4d25-9e8d-ca6108635098", "comment": "Malware payload (Amadey)", "value": "629b9c3f0503d1c7c11dd99cd030c042bcc76538c58cf56a4b6de2cf4d3c9be1bc34beac409958d34c7f92538a04dc24", "object_relation": "sha3-384", "Tag": [ { "name": "07072f", "colour": "#19557B", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "clip.dll", "colour": "#3A8D51", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769619894, "uuid": "32378718-8f56-4f50-87f7-37a5c5104382", "value": "T1F7B33A617466C071DA6C9ABE0CA4AEF4477D6514DFB00DF737840A7B9E242C2AE34D3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769619894, "uuid": "91e57d39-4218-458c-9d55-d3694cf4b29c", "value": "cda8b276589b0eb996828b1190002db6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769619894, "uuid": "9a81d8b0-94d2-4da1-b800-789cd147e96b", "value": "3072:WypL/8fEftiF3Xz7MTZ08hT5RbYNG0hZtpN8FHLjZmXJ:rpL/8fEftiFHat9FYNBsrEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769619894, "uuid": "9b70285e-6a7d-4639-94af-b7e3524ab664", "value": 117248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769619894, "uuid": "627c0051-270e-4d55-bf27-0e6bd85e16d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769619894, "uuid": "ced0ed7d-0820-4b5f-b0e8-9f9c61c89830", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04609c22-fc88-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769632156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632156, "uuid": "bb580770-16ee-47e5-9670-1585020ae3ee", "comment": "Malware payload (Mirai)", "value": "110c93336e1c270e25940e2be934e489", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632156, "uuid": "bea6564e-336f-4ec2-bcea-028aa84ce7b5", "comment": "Malware payload (Mirai)", "value": "bb25c747f9d408fe0e9b189c7a66f1d661fdc11283ce711dcc66abf68d96302c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632156, "uuid": "bee74f23-a0fa-498a-aa1a-dcf092afca1c", "comment": "Malware payload (Mirai)", "value": "9ad0869d86535c085068359c4c2293e3dd2f7e6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632156, "uuid": "7d4e8322-1c84-4979-9d1a-155ed803aa85", "comment": "Malware payload (Mirai)", "value": "7fa07eb56f7915ebd333a2cf0c0cd4771ffc7aa4f5ce821b322322eb33c99f67524b065d152227172329e78588f10203", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632156, "uuid": "0efa4c75-a2be-4f7e-87da-42b17914803d", "value": "T1D6141956F8819B21E1C216BAFF0E424D33131B78D3EE32129E186F35778A96F0E7A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632156, "uuid": "83f974fd-cda5-4d8c-9127-967e745225d0", "value": "3072:trN9gtnl8WhsOSTz97irCU5B0Z+Xa1+i/sza20Nvyf+m49rKm+w3xz:Z1WhsOSl7irC60+Xe+UGaZyU9rD+w3xz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769632156, "uuid": "bb8ef03f-3ea0-472b-a775-1b0e0e2e2320", "value": 193180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769632156, "uuid": "a9b9b983-24a2-4991-a027-9baee3a69151", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632156, "uuid": "c6caf93b-b6cf-498c-9a66-28206a166606", "value": "herios.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8246b5bf-fc7f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769628502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769628502, "uuid": "b8e31546-55fb-489c-8afe-f36f2e95f4ce", "comment": "Malware payload", "value": "037e75583c1c8b8b538bd07b1dad2c61", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769628502, "uuid": "347de6e2-0b65-453d-a303-e808bb99c306", "comment": "Malware payload", "value": "bb2bfc700c75a1ec8db3abe3dadc23f3d91d3b1a49266ddadf5086c18fb8cd52", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769628502, "uuid": "501628e5-71cb-418e-8151-d8d8101b73c4", "comment": "Malware payload", "value": "0e96ffcb0009d6810de2487c55154c1188faccec", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769628502, "uuid": "30507c21-bc9e-496b-92f0-d7449bc35657", "comment": "Malware payload", "value": "46b43fd0be79572113e53d35f391993ef1ecc3c9e87b42cb6fa931eea146e3782c17adb61430452d1ff751350813faba", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769628502, "uuid": "df61c09e-6e49-46a3-b1e9-eb6e69eab1bb", "value": "T156F2B41F63267B6EFA82F07C528172346491F464093FD2E60BB99BA1A5C73C4D9DC29C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769628502, "uuid": "c4fea5b5-d026-4ff9-9f54-34ae693a7552", "value": "768:2DdeCcf7PqCRJn8UmxDiddy7pmwk0jKWeZ4:2DgTRJnnmxum8wkCKWeZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769628502, "uuid": "efd6dcb4-0784-423b-9534-c41c25a2210b", "value": 36123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769628502, "uuid": "b0f58271-dbc9-40e8-a7cc-1b25df58ef3a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769628502, "uuid": "df256e58-89ef-49b2-a349-0cc174025f77", "value": "maksbuild_obf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a7772d-fc51-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769608643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608643, "uuid": "6e24e114-2fc5-42a9-bbf4-dfc6c551c9e7", "comment": "Malware payload (Mirai)", "value": "f875595093e51498f1c20273f30fced8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608643, "uuid": "61d2107c-35e2-4460-93c1-9c9e81edde0a", "comment": "Malware payload (Mirai)", "value": "bc99a099a6938268f9ad972d4b4c29bc826f00687aee1630ddae87dfba6f4820", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608643, "uuid": "199d295e-0016-4a74-a4ba-fa306b0800d2", "comment": "Malware payload (Mirai)", "value": "b7bd9d857a73e814d68f62b056b2b8fa0033e060", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608643, "uuid": "ca2e087d-86a6-469f-bd7c-50e7ffb648fa", "comment": "Malware payload (Mirai)", "value": "145bd3f99a4dd8aa1832c918ef6de0a2d3305fbf2ab42758ec4152daaf0dbe193016f37a66073860496e9e2c002e2cef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608643, "uuid": "38dd957a-78c9-4f3a-b8dd-c26f1bd54a85", "value": "T1F5533A99B8029E3CF8CBD5BD84974E09B92133D151831F276AABFDE37D321649D02D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608643, "uuid": "e4b33be4-df38-4f3d-bfd7-4fce4c570855", "value": "768:cFITkNDUIbw4MfJs4NvqJWmfqQnZcgFH1K+Pum8g8vsz+78ilfXKSWNob2q/SY:Zg9fMfJsB8mfHNF1K+mm8g2D8ilf6SWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769608643, "uuid": "dda98049-d115-4d32-a4dc-c054d93eee79", "value": 66232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769608643, "uuid": "85b0988f-5478-442c-b2a5-d315971c4ed6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608643, "uuid": "7d440a30-d342-4e78-b325-7244bd940c4d", "value": "astro.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "428ddf1b-fc51-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769608638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608638, "uuid": "ba5e6bc8-5131-438c-b114-821a85ec89af", "comment": "Malware payload (Mirai)", "value": "5bf8aab5268b537088c4b15c1dac15d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608638, "uuid": "e19d1a9d-c3ff-4695-ac59-0daf748e995c", "comment": "Malware payload (Mirai)", "value": "bd4f65755f5071794e396d6890380524f9f1d361af2bfcc31b6977b1f8f515fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608638, "uuid": "2a888188-a1f5-466d-ad10-bc9b500f15ec", "comment": "Malware payload (Mirai)", "value": "3382ac29206864251ea7964e605f1b7a3689bf75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608638, "uuid": "1964aaed-e8e0-4a5d-9b5a-3ea21c111b6c", "comment": "Malware payload (Mirai)", "value": "4fdba6c3c6068888262e1b9f162857f28b418b166e5d5082c6efc8b5f1b1b178dade7a4d7c8623c9c5a7ab1b2170485b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608638, "uuid": "061325c0-ce33-4856-9861-e41d15d023ce", "value": "T18FC2E078D3867671DC70C3B5B1B0CB432B839B65D2B2F0072A5061649B8ECD3A4FE686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608638, "uuid": "3caabe94-429a-46c5-aa5c-d3c3c4b2b07f", "value": "768:UvHCJX0VGCSgdIB2JhXtw9YxQ+/3hyR8gemm6kas3Uoz0:UviJX0QCndIObhQ+ge1XXz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769608638, "uuid": "23881319-9e20-4255-abaa-aaab5db8db76", "value": 27528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769608638, "uuid": "d5ccd61b-8ff0-4af5-b3f7-f2c2637803c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608638, "uuid": "876d048d-512b-44ff-b3be-23b5f3cb5401", "value": "astro.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6721f8a-fc0c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769579251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769579251, "uuid": "c9096e90-d916-4d57-84b7-af9b312d447e", "comment": "Malware payload", "value": "4403f3a3e626e11cc6c9fb3b9d6b5477", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769579251, "uuid": "5e5ef091-a96e-466f-9d62-13b36c77c43d", "comment": "Malware payload", "value": "bd7eff537e917ccb959311ac470365ead524278a36cc4380e227c9cc70108a14", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769579251, "uuid": "25dc8468-a9f9-4719-a860-6d11f5eb3b5f", "comment": "Malware payload", "value": "1da2c84c5d5f52650abc841b9eb3d762a5e20afb", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769579251, "uuid": "1ea109be-c868-460b-b0fa-1d90824251f6", "comment": "Malware payload", "value": "714d3d9bbf1a6ba7f1fba011196389b5ce8c3b8ae13e952166f3babe1129452eaa93e91e10151ff9e0a6a8c8bfdb751a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769579251, "uuid": "0aacfd9a-1487-4d58-9b6d-9ce246393ebe", "value": "T1A0D6339497E00897DC63993F94B58262E372F8901B92DA8F0758772D3E7B2D55C3A3B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769579251, "uuid": "97267acc-dfab-4d34-aae5-29463a32d234", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769579251, "uuid": "e0c22650-516d-4612-89bf-e74231eec938", "value": "393216:PVuEH2g1NOPsZg2KeiLK4CHsF5laSsZbYotHS4:NNj1NrLXzEUS0b9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769579251, "uuid": "c082597f-df9b-4af7-98fe-1718d53fbeca", "value": 13333533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769579251, "uuid": "7d7fb478-8351-4060-be1b-968288e1ddb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769579251, "uuid": "36c25e53-9bcf-4512-903f-af51403cb74a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb30f6a3-fc79-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769626021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626021, "uuid": "aa2dc252-8a05-4160-bf94-a482e0819105", "comment": "Malware payload (Mirai)", "value": "f917ddb13102034a98cfd5df673999c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626021, "uuid": "1eb49b2b-6358-4429-89bd-fa6178a734d3", "comment": "Malware payload (Mirai)", "value": "bed4874351b357999a7a25d90c29d73b7d8a428478da4c209187d11089ee9e50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626021, "uuid": "274e3350-0af0-4cfd-94fd-76a39321d39d", "comment": "Malware payload (Mirai)", "value": "0d83d7b66a1316efad75c21212ee3c8f0c818532", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626021, "uuid": "e5ad92da-9dba-4b64-86a5-3cfef5e5113e", "comment": "Malware payload (Mirai)", "value": "21165ecdb4ce454488e44124ca1aa5515178321ecb3dbdc9248a0ab6eb52c54eef968214d8a1e655b9450f2c2c07f90b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626021, "uuid": "2f3ba198-759b-49d4-bdbd-2ee12e060424", "value": "T17D0429C7F800DEBAF80AE33748530909B130B7A114925A777257396FED3A1D91977E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626021, "uuid": "bec13350-1bb4-4cc9-b185-2cac2382a3b1", "value": "3072:3yDsBUSlE2Z2XmfVchN8yim0n3SgIYJtyc72Oo7HPjpFD7zbV3jbiDLL67aqzSJM:z8BUyiPnigdtOf7zaL47K2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769626021, "uuid": "f8ca4feb-a2d9-453d-8d16-6a3ee01d37c3", "value": 177668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769626021, "uuid": "3825e174-802b-4aa4-87b4-e26c7f4f7df2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626021, "uuid": "148a9e2e-fc73-447e-8c99-5480994af33f", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d512ab-fc7d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769627708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769627708, "uuid": "be24140a-959b-4775-bec3-402e9819e7cb", "comment": "Malware payload (Mirai)", "value": "ec5c7b4c40f63df2f4076a169a7dc285", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769627708, "uuid": "e8309c46-b752-453e-9e80-65e961361c98", "comment": "Malware payload (Mirai)", "value": "bf35d7b55839426e06de89b4ca4b96c345915d10ea626ea86e0c22ce75e98d76", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769627708, "uuid": "bd5da3ed-133e-4414-b322-b197e40248b8", "comment": "Malware payload (Mirai)", "value": "893442be9e80a41ed290f7048f9375831c141ba0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769627708, "uuid": "c1c13f29-c25b-4da9-8ba9-e702b349e236", "comment": "Malware payload (Mirai)", "value": "0f57e240064864dbbb87b9ed26c980f8d155c83f3f47eacb5367ea1425cc69b0139f9e29627d46454bbf4390716fe1c8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769627708, "uuid": "685f7d20-1b54-4c8e-84e5-8c28deef4379", "value": "T10E5178D92372497B1D34EA9BE66AC44CE261E5DF0B9E6F5428DC28B840CCE1A5001D7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769627708, "uuid": "935335a7-b7d4-461b-ad8a-76277477ee8f", "value": "48:vj3r3rj3x37j3w3Xj3a3rbj3n3fj3Ah3AuJj3sQ3suj3Y3Nfj3M3Vg2j3W63W0/y:vTbrTx7T6XT0rbT3fT4rTHLTiNfT2Vgh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769627708, "uuid": "deacfd58-91d4-409c-aa0b-ddf55ab23922", "value": 2466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769627708, "uuid": "c5768109-8c16-4bb7-bf7e-50b193a14526", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769627708, "uuid": "21f0e4b1-c3c0-44de-9443-7d8a9a48d165", "value": "o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "465b4851-fc51-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769608645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608645, "uuid": "da9d9440-01ca-4e50-8401-003832d88e28", "comment": "Malware payload (Mirai)", "value": "ef7498546781e8abd3e9f82e6b7d3104", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608645, "uuid": "a39d891f-6938-4627-bccc-6ca92f0f3237", "comment": "Malware payload (Mirai)", "value": "c1e5034618b2140ab4b3dba6107593f0f1ed44c61242b6a2e11d468335dfb9bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608645, "uuid": "f701a120-c8a1-40d4-aa07-37b9dd61f208", "comment": "Malware payload (Mirai)", "value": "b757b2f47d40823cce76df09c120e6eaec111eb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608645, "uuid": "314f6694-f97a-4268-97d6-2fb923d81d3d", "comment": "Malware payload (Mirai)", "value": "85e7dc6ecdca8dfbd7295ac3b99c7980b08c0e8253b683af093c8b3a9e4605748bef57e3e3ecf839d5a9a1728b26a8fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608645, "uuid": "e3fa4d97-29b7-46d4-ae28-a7293d4dd0b9", "value": "T16A538D39E06EEEA4C54646B478548F749F13B18483672EF7D79082A5A843EACF408FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608645, "uuid": "91de74bc-ae60-4581-ae52-72f7285b58e7", "value": "1536:BtmEjH4FlswtZt9/jOIJfs3nfCJH/q7TEgK2Cj:BISH47s4iuf+nKJaTEgK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769608645, "uuid": "2a9b5e5d-8bd6-4edb-9182-606c8fdaeaa2", "value": 64344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769608645, "uuid": "18441a61-c1a7-40c1-8535-a3712cbcc4f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608645, "uuid": "ef8e0ff0-9e7d-49b7-a227-19c250fc46ef", "value": "astro.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2901e4b0-fc65-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769617185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617185, "uuid": "860f0709-cfbf-4dc7-83a9-9a2898efda24", "comment": "Malware payload", "value": "8054f08f9997fecde9a6b8b3ad711146", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617185, "uuid": "6c9a2e8d-dcc7-4e24-a76a-6fd6b1499e4f", "comment": "Malware payload", "value": "c252441da9a1d5c2b95b600daf86014a106a0d093bed9da5ca9ea4adae69610c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617185, "uuid": "6745e3f3-8d77-4052-ac9b-836c5a8dcda8", "comment": "Malware payload", "value": "3bfae7dea752147713fb66ddeb7e983665e912ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617185, "uuid": "25c1c915-db19-44e0-aaa4-3ba421aeafde", "comment": "Malware payload", "value": "83e5950d02affaf6e9764d62f891912a57e4894d0c39c3139423013851131685b80e3f734ed152870877e8f3f25e63f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617185, "uuid": "465e26e8-30bb-42dc-9e9c-8eb8aee0252c", "value": "T12972E813AD919ABBC41ECD30456DC20602DDDCAAA2EA231F3174F78C79796468AC7DDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617185, "uuid": "674120d2-2344-4e90-a85f-197301118079", "value": "192:XBldkMmoDZeojkJF/cBcSGMUGop/xKFqEKBTQxLnkpuF73GiHw/K78wZ2sHn:XDCgZoJSsHnGN7kkWiQ/+jZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769617185, "uuid": "095e9411-ed99-4c52-86f0-69069cc3241d", "value": 17248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769617185, "uuid": "6a121207-edc3-4287-a3de-e8cec39eba1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617185, "uuid": "abfea26e-e63d-45e4-85ad-6b1bc345d808", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10fe4545-fc97-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769638620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769638620, "uuid": "1fa17918-ca84-412c-9b0f-6aa6142e0329", "comment": "Malware payload (Mirai)", "value": "441f8be223dfd3b91e93b10af53d10ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769638620, "uuid": "547215d4-51a7-413c-b403-42c9a2d9ff00", "comment": "Malware payload (Mirai)", "value": "c3165d3397c9e1fd98f55a6b168b121da0e186e69c3b369b9b8b78d5fdb1905e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769638620, "uuid": "08c4f2c0-5914-4fb9-a45e-1e38bd2dd04e", "comment": "Malware payload (Mirai)", "value": "8ac9cda986a69e9989b8a736044c3d8ee2882fcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769638620, "uuid": "25fb2339-a2d6-435a-b926-0fa05721953f", "comment": "Malware payload (Mirai)", "value": "2f916086ff8f8d5b22dbc3c4887960f4a7cf043f296ee8b5cd5b2ead620c8b17220c052c7bda57d0d67ce297bb367645", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769638620, "uuid": "de8dd0e0-2c18-4278-9083-0835bd75c442", "value": "T1E1B33CA6B410DC7EF80BD7B744530A16B131A3F54E526B27761BBD13EE3E1B81812D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769638620, "uuid": "a5769a6d-f11d-4bed-844c-f0843a94bab9", "value": "3072:79dhSEpQOub9TxEMARFXzAkM8JnEzPTXhQl5UPF:7NSEpQOunEjSkM8JEzFKMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769638620, "uuid": "177ba10e-5686-4833-97b4-5d76f80b6abc", "value": 110992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769638620, "uuid": "5e80ee1e-85c5-426e-8d43-7034bc07325c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769638620, "uuid": "58d72824-7ad7-4905-af56-3ee251dc1be1", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aea5a44-fc8e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769634771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769634771, "uuid": "4f908449-940c-4413-82a1-1f0776954bcc", "comment": "Malware payload", "value": "b76afea0f1b5b72c3a20606ce3ede597", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769634771, "uuid": "9020701a-555e-41f5-bf8b-05cba249cd34", "comment": "Malware payload", "value": "c3340f7f279d4362a1a3a7182a4e07ae41a74febd11299b97b468c3aeda3473b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769634771, "uuid": "882e2804-be30-4f8d-9e64-3f0f2052639f", "comment": "Malware payload", "value": "df757d847f21f028e51f4fd8badada0f488a1d40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769634771, "uuid": "62cb2732-7448-43e8-ab08-809cb967c14a", "comment": "Malware payload", "value": "81b877af0481cc87c3bddea7f7c572a755687cd2e19f87f9a2534e4b8a1b3b36911b8d48772edf97faa05047ec228dbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769634771, "uuid": "3ff28c1e-64ab-4fff-9b0f-97e84233562c", "value": "T1A9358E46F1B374FDC067C03083AFCB626836F46955222E7B25C4D6352E92DB41B2AF66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769634771, "uuid": "d37e7c1b-d54d-42a5-b48f-b77ba233e313", "value": "24576:84ttFdEtalLVRLB9feOKnnrTQf93rolS0liN:7jLVL9eOKnnnQfAST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769634771, "uuid": "94fc4b20-0e1a-444b-8ada-2cd347d12031", "value": 1124520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769634771, "uuid": "78b9fa46-9108-4cef-9abe-0ffb250b4876", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769634771, "uuid": "c32f45d1-f731-4d45-9a4e-d8ed029de936", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7ec261-fc87-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1769632148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632148, "uuid": "bf6d6f3a-7e83-4682-b807-0292e89cdf90", "comment": "Malware payload (Gafgyt)", "value": "35b22812b6486c98e261f65b64048d6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632148, "uuid": "57042084-5d3d-4e28-ba95-95019abb34c5", "comment": "Malware payload (Gafgyt)", "value": "c374fa88a1a8faea26897feece96ee8dfaabfbaa95579c392a602641d9203ca4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632148, "uuid": "150635db-1530-4a71-a368-83635d108aba", "comment": "Malware payload (Gafgyt)", "value": "776d1d1b94f2f8b9413b453f6f73257eca996860", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632148, "uuid": "d8fdd9d9-e6af-458b-829f-dc4b2368d6a3", "comment": "Malware payload (Gafgyt)", "value": "02b7203f687f1bf8e30759081a55f587f58e8af85acbfefd7d1dd3a6539c476579cbce88c5d2049adde1cfdb4b844cde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632148, "uuid": "a567d3e5-477e-45ee-bb42-e45ba9551cab", "value": "T143C3B91E6E21CFBEF65A827407F78E31965877D62AF1C585E16CEA400F502CD241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632148, "uuid": "159cea49-7479-4a10-92c3-06ea666613a8", "value": "1536:tw4lPfv7d7Y/YLddso1LVNyHvftEi8hPDoM1ISWlKnKevNeThZF:7lPfDdMOdso3sHvftuhPDoMCsnShZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769632148, "uuid": "05227568-d993-42b0-bb4f-ca690329dc78", "value": 118300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769632148, "uuid": "ccb83396-627f-4d84-9cce-4b4f71ed1bf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632148, "uuid": "2bbc7e86-add3-4989-abdc-6ae93ddc4dde", "value": "manji.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d290383a-fc46-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769604155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769604155, "uuid": "0a034707-38c9-4f44-874e-ce3f43136842", "comment": "Malware payload (Mirai)", "value": "14c460bebb104c48de91c15ec1bb1520", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769604155, "uuid": "76c1123c-11f4-4deb-ac5d-9d44532610db", "comment": "Malware payload (Mirai)", "value": "c3960241a657fd76a114452ad9a3bebd9d7db943e335f69a12ecc9e2ea76c3e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769604155, "uuid": "ddf76b11-44d0-41a4-af2f-9b7e23c7b54b", "comment": "Malware payload (Mirai)", "value": "5fcd50c7637a4e7400c75fc265bc39c635c572d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769604155, "uuid": "2525e6ce-aa96-466b-9eec-8e5ca200f8c9", "comment": "Malware payload (Mirai)", "value": "b8b1b6c5ae32ab72561f1c353b9f2df176636cdc764695e02511471ac910b4277b3773a829048d20fefc6786db60402d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769604155, "uuid": "a4750c35-4c28-4655-9afc-12c9d1443b52", "value": "T19E735BC0A243E8F2ED4802B4617AF337A532CA7801B9FEF7F358567654259A4628774F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769604155, "uuid": "8db86383-f89b-4c8e-be03-c90c3d57e9bb", "value": "1536:V5BEBL2lY7EbE8LCKe8AV3jM2DHVmksR76BiA+eE1Ngm74KENVoFOEdBVf:Vv4qaobEyqLjLH8ksR+BiA5C0zT2pN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769604155, "uuid": "96c741f3-3d43-46ce-942a-d88686ef31f1", "value": 79028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769604155, "uuid": "83d75f10-02d1-49b6-a7f6-f4d4045ce41b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769604155, "uuid": "0dca8beb-2d97-4c4a-a01c-1910c769e3d3", "value": "zerx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7a3e26-fc59-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1769612391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769612391, "uuid": "5c913e2e-7ba5-4102-8fed-a0e908340496", "comment": "Malware payload (Socks5Systemz)", "value": "95e2fa165cd7d5a0dd2fd1f44d972149", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769612391, "uuid": "ac7ef401-0bff-4e3a-8581-19646eeb07fd", "comment": "Malware payload (Socks5Systemz)", "value": "c40d29bbfcaf6d8f7d8a92dbef911e1853283822a2e2055431788095a4c2af35", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769612391, "uuid": "50b2722e-ed26-4855-b050-bb91e6f1463c", "comment": "Malware payload (Socks5Systemz)", "value": "44bd7cab45d8b31ae33af87bc021d8b60cb4f76f", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769612391, "uuid": "3d23288c-bef5-4a10-beb5-c4e2ee03f46c", "comment": "Malware payload (Socks5Systemz)", "value": "f45f1598d76bb5ee351165280ffcf5ac5ac1ecd9598888453ca3d0d11108c1ed92d62de8b115565f2d1dc4302506985e", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769612391, "uuid": "3eda83d5-cfec-4bc0-b2a1-80dd7c8f217c", "value": "T1E0A523067FD476ABE1A703B510D21393E9B1B3E0076891BF216489B6FB937D487B1B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769612391, "uuid": "b5b85a19-a28a-4a08-a0be-1438e0412110", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769612391, "uuid": "7598bad7-2d29-41e8-ad57-802dea8375f6", "value": "49152:ArXkWua5ZXwksovj6ouX/bfPSglH22+2X0duYG:Ak3a5KksobXuX/bfPXH2Lc0duYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769612391, "uuid": "a750a362-2a5c-4b3f-b523-81c0ee4f7b28", "value": 2084352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769612391, "uuid": "da79dc4d-4a9e-493a-a9b5-6ab8a360cf45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769612391, "uuid": "909c1566-0a35-4196-a2ce-143c78bdf39e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86c18f8-fc44-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769603253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603253, "uuid": "2e6b7eb7-897b-4d95-9aea-b9a75ec450a0", "comment": "Malware payload (Mirai)", "value": "bafab224812aeb2fb6f457605b23279a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603253, "uuid": "10dab332-db0f-42f5-9c9d-59762762555f", "comment": "Malware payload (Mirai)", "value": "c41cc60efa39004f1d069ed9af1c3560b69646dc2fc2e7eb18e210a0ae0a8af7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603253, "uuid": "cdca989f-b98c-46a9-a1be-70bdb81f356f", "comment": "Malware payload (Mirai)", "value": "b93423d21f9dcdf26dd09356a3879f999c074e54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603253, "uuid": "d76ef309-729a-4831-ba00-b8993f436736", "comment": "Malware payload (Mirai)", "value": "6166ab3abea058f4ae9d85f7f8cf861cfd01876cc81d127f9beb75f55a69a9e0f3de09e25a5a8588f0199a91bcd382a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603253, "uuid": "f78b807a-1fd1-4984-877b-7b18f73fa15e", "value": "T179D33A86EA408E13C0D61B76FAEF41493322D754E3DB73068D185FB43F86A9E4E63649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603253, "uuid": "25de4f41-1065-48b4-8551-ec31f3050e52", "value": "3072:5gH6EVnGGtYVRXaCgk9mrsplDKZUmQBKXAVanJX+F8Jyv64hL5AJI4+3jJNx13SK:5gH6EVnGGtYVRXaPk9mrsplDKZUmQBKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769603253, "uuid": "59edda85-b253-4984-9bd9-7747fe64eb85", "value": 142651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769603253, "uuid": "ee71abeb-0ed8-4dce-911c-d57d21a9b1aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603253, "uuid": "9948148e-641a-4eaf-9a25-42993646f0fb", "value": "pandora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04357b9c-fc18-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1769584052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584052, "uuid": "f0ee5052-6bf3-4ebc-b200-210a8e9a66d9", "comment": "Malware payload (AsyncRAT)", "value": "dbebc254910da52b9ccde197d5ac6000", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bknoww-com", "colour": "#F8EF07", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "wmk77-com", "colour": "#33F251", "exportable": true, "hide_tag": false }, { "name": "wmk99-com", "colour": "#F3305E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584052, "uuid": "98ab1e0c-045e-4d69-943f-5cb8ad1a076a", "comment": "Malware payload (AsyncRAT)", "value": "c453863d6439ee0c6ab1b18084a5eb2ab299958e903df0700d5c7d704cffb6f8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bknoww-com", "colour": "#F8EF07", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "wmk77-com", "colour": "#33F251", "exportable": true, "hide_tag": false }, { "name": "wmk99-com", "colour": "#F3305E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584052, "uuid": "d66101e6-7f03-4cf1-b122-bc429bf29c4e", "comment": "Malware payload (AsyncRAT)", "value": "fe5ebd28928fef8ed82df0f109cc5884d19966b7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bknoww-com", "colour": "#F8EF07", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "wmk77-com", "colour": "#33F251", "exportable": true, "hide_tag": false }, { "name": "wmk99-com", "colour": "#F3305E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584052, "uuid": "1f91d94d-8afe-4caa-a8b5-9d4d60595d85", "comment": "Malware payload (AsyncRAT)", "value": "493e4083fca3c3e09a1554415f49779fd8eec1e4c92a94d4d40eb9799d9208987c4b7bd40b37654deb0c8f26d73c39f5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bknoww-com", "colour": "#F8EF07", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "wmk77-com", "colour": "#33F251", "exportable": true, "hide_tag": false }, { "name": "wmk99-com", "colour": "#F3305E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769584052, "uuid": "89700568-251d-4777-9c14-b0a01ee2d63b", "value": "T1F9C08C318064013DDD1CDA4BE1A4FD9ED4AA6058E3B725A0A8208A8C0B103329305024", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769584052, "uuid": "610daff0-5932-4e69-818e-da838f6e5137", "value": "3:VSJJFIGFGMF17Nf/sWvER6f905QRwJAFBALTZHpAUFIjyOGGiTZHpAUYE:s8GFGMFn3sl6f2ORwrLTFpAcKzqpA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769584052, "uuid": "4f283bd8-283f-4270-88a6-16e5101518f1", "value": 150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769584052, "uuid": "7878682a-9e73-43a0-9cb5-3d2c4e207722", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769584052, "uuid": "c91b1ba0-9baa-4912-aa86-91595746c26e", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a392fe6-fc3c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769599551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599551, "uuid": "b86b2879-c891-4952-b3fe-6e917cef0d5b", "comment": "Malware payload (Mirai)", "value": "0f88be73750c258642a2a4c3bf109a77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599551, "uuid": "b97f9c35-11c9-4a00-a6c1-76605ee98e02", "comment": "Malware payload (Mirai)", "value": "c4fe739308f310665bdefd49ffe713a48637476678c227ae52e3876366901aeb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599551, "uuid": "4b593b48-b042-45dc-8499-bbc4b3b477be", "comment": "Malware payload (Mirai)", "value": "68e4d4092132d2348ddc30a1fdac335121541122", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599551, "uuid": "41afcba6-3258-4ae0-a372-ee95d1f4a0cf", "comment": "Malware payload (Mirai)", "value": "cb9776166292d451ff0835fc10bc4cf0184b3bf3d9c90cec3946a9e4cd9ef6b2d34a7f1403b9cb716fe7391ce58fc78e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599551, "uuid": "7e9152ec-10cc-48b1-8d3f-957b3e2500cd", "value": "T12B330240D8F178FAAD2EAEB95B99E2F63F61456F63408FC535C5AB20453013EE189A4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599551, "uuid": "23ebf0ef-0200-45fa-aef2-e64cf1822944", "value": "1536:Hk6MSpNwzDbs81ncOkuxeV9N4u+qgw09e:HkSWs81cb4u+qgwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769599551, "uuid": "c887eed0-a85d-4dfc-b10c-41e6d02400ab", "value": 53356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769599551, "uuid": "a3a9174e-d70b-40cc-a4e2-e3b78e6c1d40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599551, "uuid": "21c83c08-9f2d-4470-a8a9-ec38b282cbdb", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ae80c7f-fc3f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769601056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601056, "uuid": "07bd3318-a646-40f3-91bc-1efd0acf045a", "comment": "Malware payload (Mirai)", "value": "802f2308fcfd52d15ee4f83d559d74a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601056, "uuid": "04667be3-a829-44cf-911c-b1cbd0972fe2", "comment": "Malware payload (Mirai)", "value": "c53ddf5b78c75a44e89c8b5b2ade8f8c18939a43f9821412ca6986926a83c0d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601056, "uuid": "afbfd52d-17fb-43f0-926f-7db5f0bde81b", "comment": "Malware payload (Mirai)", "value": "adab2e87968d2c3e8029fc9aedb688ed91ecceb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601056, "uuid": "6d99db24-ad58-48a8-8b13-7526d06c5073", "comment": "Malware payload (Mirai)", "value": "5edac8584980206e0b83159372d06c90c825985ea99fbb71500de5cd543fa59ad5f402127c804d6f79c0502e1a36df10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601056, "uuid": "95eface7-6860-44a1-9198-69d9a68124ca", "value": "T12DB3B74F6E529F7DF32C83344BB38B3AA655239633A1C185E29CDA411D6034E586FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601056, "uuid": "a10bb69d-4278-49c8-bb89-5fc1678a49b5", "value": "1536:cdiyYDvA7jB7jEfjggJHDPmHeH6qwBLyMGEM7GbVqa6eIOneSnPSXA:cPYDjJPxm+68Oqvb0PSXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769601056, "uuid": "3323f91a-0bf6-45ce-bab4-41bb2f20c1d7", "value": 109392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769601056, "uuid": "4d2603f3-0a23-4c48-90f7-e7205d9bc272", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601056, "uuid": "6ded52c5-b987-4a8b-8e23-f863eacab8ae", "value": "zermips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cb82a4c-fc6e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769621164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621164, "uuid": "0dcf640b-2a9e-4601-a5da-c65e342fc3ac", "comment": "Malware payload", "value": "bbaf3820cb28c0d1ed88a073158327a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621164, "uuid": "f7d65b3f-0f0c-4a42-bec2-c35187ea321c", "comment": "Malware payload", "value": "c5444c6f040fa49183564bbfb146584b61accb74b56be6ec326fa73147cac5f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621164, "uuid": "1b8b9343-86f2-43c4-8674-7e9b0a05767d", "comment": "Malware payload", "value": "474c0ae729ef3c1689763f73d42794d8c3ea4151", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621164, "uuid": "a9f5430d-1c95-49ee-9085-db17a0c0e245", "comment": "Malware payload", "value": "6b824d9b638b115eba743a785cbac71226697d36e0cb2a1f6d912af7550e9929b08e9b7406ef46320c2f5f81dc814975", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621164, "uuid": "e61a48f9-2be1-44b7-a57b-3c4be674ffe2", "value": "T1FCC17705A3EC465AF0FB4B7459B3071127B6FE519E76C39D1998021E7D21B04CD12BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621164, "uuid": "af62d934-f1da-4559-b02f-1d5ad04321fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621164, "uuid": "475e5389-51dc-4f9a-b8a3-9b156ab78b7c", "value": "48:63vMsnRObdw2LuKn3EKJ2Sj4yZlmappV6fL24yejW5Y52jS9mySzEuulZxGqXSfG:/sRObKquqFZlmIfFeSu9mrG7xmzNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769621164, "uuid": "847b7cfe-7be5-4e8d-bcf5-11dc55e1cb55", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769621164, "uuid": "0437a690-f4f8-4d87-a10d-1e7fdbfb8ee5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621164, "uuid": "ab04e1d2-3ed5-4b1d-9acc-c55246286d3e", "value": "SecuriteInfo.com.W32.MSIL_Agent.CEF.gen.Eldorado.9417.14641", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3df24fb6-fc9d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769641272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641272, "uuid": "cc4ebefd-5402-437e-876c-a78e1ef4c894", "comment": "Malware payload", "value": "8deacf4ffaeee8aacf5a61e28bc42fec", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641272, "uuid": "f954e9ef-bc00-4f03-812e-f9ffa5d0cb05", "comment": "Malware payload", "value": "c5790d70c433138c1b88ba002d1639daccc4e111c788ecb9ea0cbf9473dc88dc", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641272, "uuid": "ff576cb6-4777-4496-bc00-5a012822e870", "comment": "Malware payload", "value": "c0dfce1878c3907295053c562e255f3c33ea6876", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641272, "uuid": "14ae0e24-d5c9-4982-bb96-d6e504aade54", "comment": "Malware payload", "value": "25ff48ccc870faa950c64b0fc2b25018f222491ddc0659922a4cf27aae898e48c90d59fdf1e31494cb634a4eeecdbc6e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769641272, "uuid": "99c4afa3-b9b9-4f90-b480-71358d6bda16", "value": "T1F823F84C5B9D8923F6AF1ABD9432425387B3E227A532E38F48CCD4E9379338558453A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769641272, "uuid": "dfb80721-a1e1-47cc-864b-55639a286c18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769641272, "uuid": "d3857e2a-93d3-4970-9d98-efaa01441fe1", "value": "768:0dhO/poiiUcjlJInI2gH9Xqk5nWEZ5SbTDa2uI7CPW54:Ow+jjgnILH9XqcnW85SbTDuIw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769641272, "uuid": "065c89e9-ab1e-4f20-bcdc-210e523ae9dd", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769641272, "uuid": "ab6b5496-ad57-4f8f-8752-397ab284ad2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769641272, "uuid": "84d64222-e9cc-48e5-8836-d810c4abe7ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c65454cf-fc55-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769610577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610577, "uuid": "4a92f73d-66cb-4628-96e8-1a05c2278eb2", "comment": "Malware payload", "value": "e76b934079cc7bc727d4273c259017b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610577, "uuid": "1301800c-b284-480b-95f7-4c82ec6e2375", "comment": "Malware payload", "value": "c6cf52d8673ca3f170779f30f90e3709b1c9f1372476e76a52b9e776f0e4b08c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610577, "uuid": "b821408f-4cc9-4d6c-aaf4-8686f4251d7b", "comment": "Malware payload", "value": "eb7d2ae32c17861afb5919d448cac7b4d3af323b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769610577, "uuid": "e1aa15dc-7a06-428e-8b81-9c940fc7d89c", "comment": "Malware payload", "value": "70461c0d3de7cd508ec19e745751b973d9d8e463a2aed02203c2caf330b95dc12cc593bced3e44a6b141cc868706e9fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610577, "uuid": "2a072247-611b-47f9-abde-574ae4d2e1ec", "value": "T12C740912E6507429F85389B03E78A65668283D3A1640ED0BB78DDF5A3B72AC371F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610577, "uuid": "6e735f3e-4d29-43bb-b7c1-a875a12df73a", "value": "9f614ac8f5b17f11f2407d3f616409e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610577, "uuid": "9b2492f4-7058-40c6-8204-87f5218e087a", "value": "6144:MxYhgnl5PEgGjAvXPmV5PcP5PmBPXy99SpGzALZ0GRy0Dby8aqDg:MxYhgnsAvXPmV5PcP5PmBPXy9YSALDEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769610577, "uuid": "0f6b36c5-cc87-41e6-9870-959b1267e444", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769610577, "uuid": "a5009b1e-779e-4427-ba18-136edc286a79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769610577, "uuid": "afa2da91-9bf4-4291-ae96-a5f1089a3570", "value": "orden de compra OC_272.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3619b2f-fc91-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769636289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636289, "uuid": "2c5c2caa-027f-47ae-9a84-dbd69edbb004", "comment": "Malware payload", "value": "227422175ad5dcce8efee225d0eb2919", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636289, "uuid": "393821de-a31a-4f1f-896f-94fca591a30b", "comment": "Malware payload", "value": "c7a766b2eb8d28d9300c45073c6cdc2d08c2cdc509554ab4b73530a15e25f29d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636289, "uuid": "e6dc0db6-05f7-4f83-b1f5-fb77f8a568da", "comment": "Malware payload", "value": "6b1d7c027e52728c1828c564e37932f0dad292d8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636289, "uuid": "30ea7a71-5663-4579-a3a1-6c8f6ec67575", "comment": "Malware payload", "value": "d0f05e282b1a65b75f2645cc37a2f56522606c77062bb23fb5e0fd86905c1dadef027097a6a15909160825967713dc52", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636289, "uuid": "89b94b70-e52b-47e7-b51b-621c040d2f84", "value": "T17C336333D410FE0641A1EE55A2799B04D672D97748AC6418B60C4E4D0FCA9EA3BBFF4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636289, "uuid": "64d12c48-df6c-4ee0-b5fd-c26448f01a2c", "value": "1536:CcHg5Ajyw8IDFSD4zNq94AbluKlAGRhl0IGFv1kA:CPtN/ovB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769636289, "uuid": "40719ae7-6213-4aa0-903b-87765c008c69", "value": 55045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769636289, "uuid": "a5502e94-d49d-44f3-9a20-03c4d3257d9f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636289, "uuid": "dbaefa5a-2042-4eeb-93bc-7d0e7b8b0729", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b2cb5a8-fc76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769624490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769624490, "uuid": "9653682e-eb10-4827-a2b5-5e5ed8a5c2c4", "comment": "Malware payload (Mirai)", "value": "623ed6a1f6bcdfab86d19f290cdd0624", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769624490, "uuid": "f0a08889-f34e-45ba-9168-b1f60e9cae73", "comment": "Malware payload (Mirai)", "value": "c8a4c9c627e17ab6f17df8fbb791a86dc72897e4395b3d3afb48feba3b5739a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769624490, "uuid": "f23d762c-3dc3-411d-af37-a440a87235e6", "comment": "Malware payload (Mirai)", "value": "e0932ec2d52cc9b2cffb5e16d91ecb2df756efb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769624490, "uuid": "0a17c6f7-08e6-4d07-825f-3e996fc11653", "comment": "Malware payload (Mirai)", "value": "56c6e0424cb6561c40b073fda8f56ffb05968a5aeffd85c1152a9801d909002f5ada1527f78a49430694ed51439cc9a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769624490, "uuid": "93245145-98a7-4f24-bc82-5e9020546d58", "value": "T100F20895F8839A1BC5D50376E6AE698D3721B7D4E3CA3303CE604F213AD521B1D6AE44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769624490, "uuid": "f73d5b92-b293-44f3-aaac-733862ccdf2b", "value": "768:ftech2ZzyT6b4U52kn/OZQjm8sHoqiuDCAypec9PZJVyDJqifa:fU5Zn2kn/OjMIqii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769624490, "uuid": "cb5de85d-bc2a-4a68-992f-4954d106c7e7", "value": 36256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769624490, "uuid": "2a3eba1b-33e8-4601-90d5-b8be9867333a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769624490, "uuid": "afa2e12a-8a89-4f87-bbc1-c1343fc0c290", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908d3cd1-fc3b-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1769599320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599320, "uuid": "cbd96fe1-0456-4ddc-ac35-2d0fdb96f8e9", "comment": "Malware payload (Vidar)", "value": "dfd2cb7dbf15735bba2ab2c1e68a925a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599320, "uuid": "8c473bc8-f6b5-4409-ba22-25cc247e3937", "comment": "Malware payload (Vidar)", "value": "c8c6a1a0cb846b0e93b34a59dfb91a57e0b4873b8a2129424cc4509cbe306b8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599320, "uuid": "0171268e-eb7f-4b10-8acf-f7aaf92cf493", "comment": "Malware payload (Vidar)", "value": "49c6df396fb04ff26a31057895e6fb0697176a6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599320, "uuid": "fd9fb124-bcf7-4ae3-a265-390d878c1387", "comment": "Malware payload (Vidar)", "value": "820dd40c3b14ee96af00ebe35aea9eddc91689cb5e32dd793a3adc329b2ccebb956d92adc01f33f59b96cf5951b2d614", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599320, "uuid": "c24f3d17-43da-42d2-9ac8-2336136193ae", "value": "T1EA165B57ED908564C0ABD2399DB6618136747C090B7032C32FA27B792FB7BD4127BB29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599320, "uuid": "2650eb58-1b80-4ec2-82ea-1081b419bdeb", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599320, "uuid": "04f3fad4-4efd-4643-a0d6-04ba31f1e414", "value": "49152:fp6Ea2kwohXqAPgJ7POXesaB9GQNPsS82paRwnLKb0NePYBiMTiBQnWF0b/I9OLG:fcNATNxa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769599320, "uuid": "8f3a6f27-726c-4a42-b093-314a1421df2f", "value": 4338864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769599320, "uuid": "3c8e9e81-7335-433c-869f-44aeade847c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599320, "uuid": "c36daaaa-8864-4642-9528-5e4e6c2e737e", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "180a9e1c-fc45-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769603413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603413, "uuid": "62b4e30b-6aba-4746-aa45-43534b0fdebc", "comment": "Malware payload", "value": "647d1c27e6278c31b6506d18b7198f7c", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603413, "uuid": "07f18c58-e829-488d-a52a-075752ba7384", "comment": "Malware payload", "value": "c977ac0ab9fd657c8da5b5f633fd0faced8fdee6ec4df70f769d03f63ccc1e2d", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603413, "uuid": "eeb4469a-5cdc-4b24-bc4a-03212b2f06bb", "comment": "Malware payload", "value": "64d4829f4cd317274d4c9c9931c2c6427c0905d6", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603413, "uuid": "7289673d-2e18-4a45-951b-91af0db87e41", "comment": "Malware payload", "value": "80be53f2171a36e8157b4575a26042d8c8bcd7f37d6eccc394579ce21c6a372133355002f9fae94a3ce2222d17fa703a", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603413, "uuid": "73bc5ee3-2cc9-4934-a05d-7c875748f859", "value": "T1B6563360F21B6043EF584337FBA5BA112D0137A90B118B57016EDFF267069DFBA0E969", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603413, "uuid": "47f55fa6-6a6e-4c15-91c4-ae592e469c1d", "value": "24576:4rsvorsvzrsvIAyeW4lJr/+TO9qQvSrr3eZrsvxrsvxrsvJrsv4rsv/rsvkrsvWz:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769603413, "uuid": "f162ef75-51c1-4b0c-9c20-f9b1cf2693f7", "value": 6285312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769603413, "uuid": "69756682-a1f2-4944-b165-5d568732dcb8", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603413, "uuid": "d7861072-28f8-4fc8-b81a-8aa80268cf9d", "value": "nBIG_CESTAS_FOLDER_2026_pdf______________________________________.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0493d42a-fc95-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1769637740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769637740, "uuid": "9e07287a-1ae9-4f0e-9054-c0fac6af9504", "comment": "Malware payload (MaskGramStealer)", "value": "bb59f6144f82b1f056053518b9785435", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769637740, "uuid": "7fc76de7-df5d-4ea9-80bd-f98372ae9250", "comment": "Malware payload (MaskGramStealer)", "value": "ca2c000a17f88dfec57ad41b850ea3ef0399574743d1c7df57730ea80c22ea81", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769637740, "uuid": "d890952d-4c49-4d76-85e9-8458b30f65de", "comment": "Malware payload (MaskGramStealer)", "value": "9d227cc70e1d9e85548b7fb311d760322ef50aff", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769637740, "uuid": "7183251c-3926-4073-8bad-a07cb906f3c8", "comment": "Malware payload (MaskGramStealer)", "value": "f8fda34c0e49b1a184e4a73821d3bf2e080c0cedb51f72d5e4eaa9ed80c5e11d8ac36763e9015a5a7f65a7e3f5c2d275", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769637740, "uuid": "cf12e762-1ade-42fb-acc5-a9a3fcf858bb", "value": "T1F5E533F07998FD90C57199F33698C69F050A55B6ED2EF213980385F7BEB21F722085A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769637740, "uuid": "a1c6d60b-cdf2-4aeb-a6f5-59e00051279f", "value": "dc6b57a7282f87959d9942f26d5c0b74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769637740, "uuid": "660d2f91-870b-4339-983f-ca5138a5872e", "value": "49152:6B+m5rSNc5ufbqRCMNTmRhDSA/hjNqhNfWsfNdEjJw+Lqmj:5LMmP22jNxiEjJBe+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769637740, "uuid": "a15d34f1-6e1b-4a70-a205-4d2ee6763add", "value": 3024384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769637740, "uuid": "fe225ae8-d612-476a-a516-ea165f34e6de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769637740, "uuid": "2b083d92-3385-467a-9ac7-db23c05fbf32", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "679c3dd1-fc41-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769601828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601828, "uuid": "9e211f34-430c-4f2b-af47-25d6d9c9bfb4", "comment": "Malware payload (Mirai)", "value": "23025874b2d283c7fdfd6e1c2183a620", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601828, "uuid": "4f2cf5ef-88d8-4e44-a70f-625cf0638989", "comment": "Malware payload (Mirai)", "value": "ca754f6e5de06a81836d82e34baf15b2e1cbcfc7432bdb24148cecaaf0f576f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601828, "uuid": "74af53f8-d0b3-4222-ac8a-21bfc60321a6", "comment": "Malware payload (Mirai)", "value": "0ddd673b356369140dbc8e8acb33bb44c0805efc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601828, "uuid": "1a66e1b3-d6e6-4f25-81e3-77a5507d4317", "comment": "Malware payload (Mirai)", "value": "d155af10694abe4e9ec9adb0e397f204849bec441a2b938ae32cab32a4707fbbb4995493591539ac08acad0c5d841e45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601828, "uuid": "911bdf83-7b12-4935-a8e3-76850bda701e", "value": "T1E0933AA6B410DC7EF45BA7F780070B16B121A3E54E426F27B62BBD23DE2E1741862D47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601828, "uuid": "755a0a80-3061-4667-b489-63bf78032c12", "value": "1536:W+seWJFcSXB740u951J7YMwURkQQOblfeUWhRK8ybdy:W+seINx74J9F7YMhS4bIUWhR+bdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769601828, "uuid": "e4145009-c10f-4ee4-8661-e9a5e475b526", "value": 93588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769601828, "uuid": "e8d5fe00-841b-4534-8daf-f5ab3543702c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601828, "uuid": "f6108c25-9446-4e07-b5ad-8db646b3cdc3", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a40918e-fc6e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769621160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621160, "uuid": "68294441-37d7-4023-867a-0868e6ead4de", "comment": "Malware payload", "value": "da1848ca828186f3a497589b69fcd8e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621160, "uuid": "d0ff90f0-44ec-417c-b313-dce89e2559c3", "comment": "Malware payload", "value": "cace381e9f84fa8c23a7bb7121c26c5aa409cd28b6613133f22d2374520c58ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621160, "uuid": "a82dc133-813f-42e6-9e82-39a0adf97d8d", "comment": "Malware payload", "value": "bad87fac900a8398a6eaa4e7286559d29e7ededa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621160, "uuid": "82f9e8a0-32af-4406-8a2c-41e144f23438", "comment": "Malware payload", "value": "c9e58ebe3efebfa265aa75b4983a64eaf52bc06275d32bcefdf39af588acad281bde64ffd3d0e1e31bbccc78bb12a8a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621160, "uuid": "26549f9b-89a5-4bd3-9ef6-bee3c93ad436", "value": "T1FEF59DD2A7A600E8E977F23C85468117E7F2B817537097CF16A48A761F236D12B7E702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621160, "uuid": "54a3fd0b-48b0-47f9-9158-85d1756f3d7c", "value": "a41de816070f4232d93c4e8ee8f581bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621160, "uuid": "b0e95fc5-d0cd-489e-9bac-1cd76806495b", "value": "49152:AdZEy2B6vflQf6X8uZQoy3vR6QVQy5Z+bm4M/HMFvfGW0/7Z7Ib3jxL5lN1:0HvfGfZvZj1/N/z/oLbN1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769621160, "uuid": "e163c82a-8dd5-4e38-9d6a-8fc20c353f87", "value": 3607691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769621160, "uuid": "bc815632-ebd2-4e4e-a843-fbc8a8cc7d06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621160, "uuid": "489d0fe1-cff2-4af4-bd5c-2af70f707a66", "value": "SecuriteInfo.com.Program.MeshAgent.3.19246.31236", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7747cb2d-fc43-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1769602714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602714, "uuid": "9c3a2dd3-1a2c-4df5-87a3-7b704d9d9d3e", "comment": "Malware payload (AsyncRAT)", "value": "744c7ce8ed76fec36e583f6b8d47b841", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602714, "uuid": "7e9561f7-aa0d-45a8-b263-49f9fc871c60", "comment": "Malware payload (AsyncRAT)", "value": "cb4c548f548652d92b21d4bbb4831d7b6ae12fbe94a7fe682381598c6ac43724", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602714, "uuid": "c0343198-bf03-4bba-a361-a13d0f519e96", "comment": "Malware payload (AsyncRAT)", "value": "f0f8e1981a908a4247e61da748ea94df6b1860fb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602714, "uuid": "af8c9fc0-187f-4d0a-8999-cf5d180ad6f6", "comment": "Malware payload (AsyncRAT)", "value": "8f2c0652ecb10c672a43bc4b055b4fde3d5c665f224e4a97d4a8129967da9880a859880e556eccdd9b8ecf1d3c94a49b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602714, "uuid": "9585acdd-5178-4df5-8c5c-43ef61af79b4", "value": "T1ABD22A08B7E48665E1BC5BB98D7292009376E9474C67DB9E6FC440DE2623789CE10FF0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602714, "uuid": "042964ec-34dc-47bb-98b9-075af8f83117", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602714, "uuid": "f4f27b89-fcdf-4735-9a3b-e1b47449af89", "value": "384:oUXVtAVpwgSGd+QKIcjNh93buUsTQxnCJf+jJGIjJl6ox/+:oKVtE9SGAQK/jTRbVB/jFx/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769602714, "uuid": "a9526034-3cca-4b0c-8300-fce54459d6ec", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769602714, "uuid": "b3fd6f23-f31f-4fe3-860d-9cb8ad0f29cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602714, "uuid": "82ae5a5d-b9e0-456d-8eaf-5ac103ee9ff1", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2963ea61-fc30-11f0-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1769594423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769594423, "uuid": "11017df1-3592-4153-b0e5-d27b99c92d61", "comment": "Malware payload (SantaStealer)", "value": "8f049982b5a0c688ef616a6eab101eb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769594423, "uuid": "051db7ee-220c-4bae-bec0-0bcad2cd6b78", "comment": "Malware payload (SantaStealer)", "value": "cc109a845c4e4a33e0316672af3bfbf4a589015a33846c3d1caaf7c6862fe6c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769594423, "uuid": "e4c9e2cd-db1c-4efb-b90a-01734283c866", "comment": "Malware payload (SantaStealer)", "value": "7edf4be1059c6d99fd622323b13191b0023c0917", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769594423, "uuid": "9c5b1427-2a38-4ab3-b586-8f2cd9249993", "comment": "Malware payload (SantaStealer)", "value": "750b2b5112733cd1992844a5135ff23e4c1ce80aacea71e57f6d34ca065d86c04be0073aad24401ee179984d45d0da0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769594423, "uuid": "bf12ff0e-dd3c-40f2-abca-ee3636877737", "value": "T11AD59E0AE6534AD5C86BC4BCC39A7132EA317D79CB242EDB17914B613F51780273AF86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769594423, "uuid": "52bab74b-778d-4750-9b59-f666b5c3c75a", "value": "05bd6e8744f90bb71890ab6a9a60cc45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769594423, "uuid": "64439959-2c5d-4355-97c7-8ed3756823b8", "value": "49152:cYotvMWc5nZnA0gC3hsfzJ7L5vEbq8kwxJ9:EtqnRAC3ozJ/5R8kwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769594423, "uuid": "ffe96cec-dafc-461c-bff4-086857547d2e", "value": 2909184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769594423, "uuid": "498d5b34-981c-4cab-9f65-3a2c8b9fd30f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769594423, "uuid": "79ff9c9b-df10-4bd1-89fd-fea0e9ed0242", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e87d8e19-fc8a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769633398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769633398, "uuid": "edd1b57e-5058-4395-ab0a-b51af771095f", "comment": "Malware payload", "value": "c1bda3cc232b26bb76b60209a90b3548", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769633398, "uuid": "e3b26a9a-cb07-440c-ad5f-51426b6049e6", "comment": "Malware payload", "value": "cc81fbbe9b48f43ed8482b7695a0dc4aab5076705866986051e078a5e9657795", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769633398, "uuid": "66ef12ca-7943-41f6-87d9-b1f3d010d863", "comment": "Malware payload", "value": "736ab09985a1a390dc50cf6bd6c9cc79cf20831e", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769633398, "uuid": "1d012db1-b4dc-4962-99f1-ac2d95a955ab", "comment": "Malware payload", "value": "6b093d1b64129dc9d53bc68c4ffc54e06c1417db8b9a17eeba870a1af98a80255af7f2b095e165396fec1aae7d480067", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769633398, "uuid": "eabdb7bb-c621-48fd-85fc-f881e4af928c", "value": "T1CD664A7B62A9812DC25EC23EC0A78F00D9F3B1751737C7E752A207689F569C19E3E261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769633398, "uuid": "15fc8bf1-5928-4a21-a280-a1624ed9f3f0", "value": "9692762365b0d3385170e1ababcdaa1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769633398, "uuid": "f0edc894-e1d2-4f01-90ce-cbe45e10831f", "value": "49152:DLcLOnXF09KKdYbIK4KdgL7dPSXceQJQ+4KJL6gH4eY2FKTf50Qn23AHn8y0LYUl:nswpn23uVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769633398, "uuid": "c0b188c3-e88a-4764-acec-166446dedb00", "value": 6871040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769633398, "uuid": "fae4d9db-a0f7-42cc-84d1-9323ef09a864", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769633398, "uuid": "ae90d0c1-c9ab-4618-823e-088bfcb1beeb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a14b2e-fc3a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769598757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769598757, "uuid": "dcffa1d1-d881-40af-94e1-157e73db7fd5", "comment": "Malware payload", "value": "89d220c98253b6b0e9c00d0641c275e4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769598757, "uuid": "a38e2178-c07e-4cd8-a8ba-2f5b21d566fc", "comment": "Malware payload", "value": "ccc4a15b30915c8666c93f7a4e19dbd4896c940029fa909291b8ddbcdb360433", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769598757, "uuid": "cec500f8-ae2e-4363-a046-4bef0a16e0c1", "comment": "Malware payload", "value": "01d746c34715a9d37380e5b27aaa0d53a42942ce", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769598757, "uuid": "819e12b3-7912-41e1-a152-b51c0947f898", "comment": "Malware payload", "value": "51b4a3a70db5d652f06f48237ef3e9bc83458849b56fd9b49dbeed761196897a98b20f9b2fc400fde3383e3f1d2b3996", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769598757, "uuid": "f6950fdf-5adb-445b-a110-5823fe969e77", "value": "T112C5E114A878D0E6FCD741707756A212B4337E378F282A9B11A4875CD94AEED1B3E327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769598757, "uuid": "abeddf60-7a1a-48cc-956a-28e20872d617", "value": "155dfc2d31fa3e5e20315bf41423c877", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769598757, "uuid": "a5257716-02dc-450e-94f7-396e7ef4d64c", "value": "12288:F8t+QhgNvxsdSUPSzGYTkeXQvFYx7Amt0ulXeOf8SqEVrYb4NDLWkBZ8zlQH8a6Y:T4gNv+SSFeE6x73rUBW7NlJ8axxW9FC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769598757, "uuid": "6def041f-0948-4fc9-bc86-eb58289c1293", "value": 2607104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769598757, "uuid": "4efca8b5-e49f-4002-be40-8e2211e15fb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769598757, "uuid": "a1e2c861-876f-4535-9570-d41796eac3f2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "013defb3-fc88-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769632151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632151, "uuid": "eceeefc8-59ba-4807-aabc-f39068cd39d6", "comment": "Malware payload (Mirai)", "value": "076828eeddb5b54808ebbeb7af95d462", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632151, "uuid": "0073ffa5-13d8-45a2-b370-f43216f9447d", "comment": "Malware payload (Mirai)", "value": "cd84476db975633a038c4859d914702abfaef1b87b2df45adba58e9d6dbd9806", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632151, "uuid": "ce84c016-f714-4787-bad8-d1948d04320f", "comment": "Malware payload (Mirai)", "value": "ca659af3327cd6cf98ea43feb8862c026b926208", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632151, "uuid": "e1c1c8db-f169-4bd3-90c6-a72e73737fa2", "comment": "Malware payload (Mirai)", "value": "8f21725dad0a89b0ad2fc7325d626f229efdffd559a62c97b79e687b80c35fda7df6e44f85cad3e40efbbc436f527f39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632151, "uuid": "827f6987-152a-43f3-8a7b-4cb8444cf831", "value": "T1EEB30946A9429B11D5C631FAFBAF414933136FB8E3FA7111D9206F6023C69DB0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632151, "uuid": "548a1514-8ab0-4879-9736-fa14caa35a23", "value": "3072:hqiKVqVEpOFnYfG/7/0tZYC4dmnJokaZFbR17b5A7UfZpg0U0z3+f:hqiJPdYe/7/0tZYCCyJokaZFbR1pA7Uw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769632151, "uuid": "0546e142-cd70-4387-99e6-712180872221", "value": 112648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769632151, "uuid": "dd1f933a-040e-44e6-b06c-15234e58ab21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632151, "uuid": "ba7a7f7d-fe9d-4ee2-b8af-4f85789cbc9d", "value": "manji.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a4182c-fc4c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769606389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769606389, "uuid": "d1df901d-ba12-45eb-b27b-384a0f20c71e", "comment": "Malware payload (Mirai)", "value": "6cfac0ebbe0b521647f1c38985bc64e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769606389, "uuid": "a2302923-19f4-4e89-808e-a203ed6f1e63", "comment": "Malware payload (Mirai)", "value": "cdff7fef4b97acf58d07747e4e48049cb75c6e3ac79a7429dcfffbbd3c56fac8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769606389, "uuid": "a2338431-3be7-4a7e-9003-07944e263488", "comment": "Malware payload (Mirai)", "value": "1698deebcbcbfd3d84b198aec2c7270e3602eed8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769606389, "uuid": "7e8cd42e-4eef-4b3e-a58c-c37fdffcb7eb", "comment": "Malware payload (Mirai)", "value": "de0d8fe8ccc012fd2444476f7e03142df3fad114ad6063ef503bcf3687649963af266db6b7c699fcc566a53ba27c88d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769606389, "uuid": "f61403e1-a290-43b5-ae43-bbffcbec1e37", "value": "T13243026A1FA8451CEC1284BE66B193542ECC0E3F8684CE3F114BCB976E33599B5758F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769606389, "uuid": "33191ba6-adcf-4284-af92-44c86332dd95", "value": "1536:IJlBDufe38QHZ8CSeTl9IhYoKhXVEVx7UW/VJuT:IjBIdteTPIh4hX2UW/VQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769606389, "uuid": "4ba5dd16-ef3d-4321-91ea-14ddd608965a", "value": 58744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769606389, "uuid": "b8a8465c-dc3c-4def-a8f4-d1305f2dd77c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769606389, "uuid": "91e58166-0a41-4014-95fd-8d109dce17c7", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e6d2ed9-fc18-11f0-a129-42010a9c0007", "comment": "Malware payload (DCRat)", "timestamp": 1769584284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584284, "uuid": "bfa2d5d8-278e-4e2b-be15-bc9ccf217a7d", "comment": "Malware payload (DCRat)", "value": "a832c46aecadc660c80e304e04e87f80", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "ou6060-com", "colour": "#700AA1", "exportable": true, "hide_tag": false }, { "name": "ou6161.com", "colour": "#46BA63", "exportable": true, "hide_tag": false }, { "name": "ou6262.com", "colour": "#BF8AB1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584284, "uuid": "ee6a6097-4b70-468d-bb52-a96f93a035ec", "comment": "Malware payload (DCRat)", "value": "cf17a5f8151ea851616d7dca5742a206a0f2302479665880c2089415651624a3", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "ou6060-com", "colour": "#700AA1", "exportable": true, "hide_tag": false }, { "name": "ou6161.com", "colour": "#46BA63", "exportable": true, "hide_tag": false }, { "name": "ou6262.com", "colour": "#BF8AB1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584284, "uuid": "793fa22b-e796-48a1-a160-64ac3cf5b108", "comment": "Malware payload (DCRat)", "value": "60ed574e93900b66762de7f04fa34eb9445ace60", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "ou6060-com", "colour": "#700AA1", "exportable": true, "hide_tag": false }, { "name": "ou6161.com", "colour": "#46BA63", "exportable": true, "hide_tag": false }, { "name": "ou6262.com", "colour": "#BF8AB1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769584284, "uuid": "902e3334-1410-4144-8df0-09d256e9b6eb", "comment": "Malware payload (DCRat)", "value": "2f78f57978bf2c3c56de43dc6bf5b36946c8e7e79ffcac30cd058310d2960ceadc481894735b91ca99246512feafac91", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "ou6060-com", "colour": "#700AA1", "exportable": true, "hide_tag": false }, { "name": "ou6161.com", "colour": "#46BA63", "exportable": true, "hide_tag": false }, { "name": "ou6262.com", "colour": "#BF8AB1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769584284, "uuid": "222a4ae6-2ccb-47ac-ba06-4ce9122a4b7b", "value": "T14E3633097954DA04A82C369FD5D188EC9BFA7E147C54BC8DDE87879EC41046AEF0E2BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769584284, "uuid": "7092632d-da81-46a4-bbbc-b2f1178b1837", "value": "98304:z/W0yPMq/aYSZ21XR2IG+qonsjQVii9+K1PsnY8qjzDCYogDN5o8i:z/ZmMq/aYSZ/qsMH93WnojSYosG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769584284, "uuid": "e570243d-e571-4e38-ba94-07cb7e5198bc", "value": 5030173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769584284, "uuid": "e315753f-e227-4455-b1f4-665f91865202", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769584284, "uuid": "a7a625b8-225e-4a11-a9ba-49b4f522f8ce", "value": "cf17a5f8151ea851616d7dca5742a206a0f2302479665880c2089415651624a3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b898d5-fc74-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769623839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769623839, "uuid": "fc7718da-4f3e-4fc3-a334-eeacd27b7574", "comment": "Malware payload", "value": "e4593ba05b55b42903ce82515d446ea4", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769623839, "uuid": "e63aecef-24b6-4921-af3d-52acd9e825a3", "comment": "Malware payload", "value": "cf6fd869dcfe5037a295468fcaf32f319847f47da2999c3d629f3cf83677ecdd", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769623839, "uuid": "3ffd1603-ba20-4891-be18-ce813843f644", "comment": "Malware payload", "value": "d18b7e12adcc68397b710f5f3d5b8fd06dc81ab8", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769623839, "uuid": "d4143fc5-0d27-455c-a14e-ef626659271b", "comment": "Malware payload", "value": "1cc78a75ddd92697684ed22dcd91c83c96c438e791600568d1bdd1c56f40269c24726e1364dc25fdab6452e8b254186c", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769623839, "uuid": "c2439415-a146-4925-a6ec-af4a8f504338", "value": "T1E0564B93AE5446A9C15BE23EE8F2124522B47C44077231D36E447AFA2D77BC41B3B72E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769623839, "uuid": "bd77d454-a7f2-4d22-a4ce-8c536154d2fd", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769623839, "uuid": "2dd0c965-92f0-4cfb-8bd8-f095ae90d079", "value": "49152:Q6ocGlL60CthZ56tPercahqpNEIkJhOuQu17tSSixhLui9Qrj+12/Pt3:QHcgUHOjMthqhLhyG121", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769623839, "uuid": "4fed9881-40e5-48bf-aa96-63f09cc0b5a5", "value": 6007984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769623839, "uuid": "fd1f0fd3-2f6a-4165-bd98-e7706387d667", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769623839, "uuid": "72b075e5-9c2d-4af2-b56b-4d2ab4b612df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c0e04cf-fc86-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769631498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769631498, "uuid": "3fbf9c90-a200-4b54-b8ba-b24d9ec4a46d", "comment": "Malware payload", "value": "7ea26dca53dd3b4de57c8ee8991336ce", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769631498, "uuid": "4eb3a786-eaa7-4b4f-ad2f-191af135db83", "comment": "Malware payload", "value": "cfc606adbe1ad3ca39db38ad7167ededf78c28da07be0fdbef79d4d90aed352d", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769631498, "uuid": "b26da0c3-7254-47f3-984b-cba3bf8ab279", "comment": "Malware payload", "value": "dd3ecb57c0e8e1ddcee0fd107a28cc0e26fbb272", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769631498, "uuid": "4e682e9e-2819-427a-ae4e-56ec9eae3f68", "comment": "Malware payload", "value": "9c1bc2e97a96d32ed82920fbd8acaf962861e7866f3e4664a804372725aa04c4e8ea13d1a195265f8c43f20808261f11", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769631498, "uuid": "a6afb96c-f32b-4a7b-8ee2-6166030576d2", "value": "T168A533F55E4191DFF66930B24086FF3042E7EEAFA5B2D1C5D3C0B48EE5364448A6A583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769631498, "uuid": "63b8d0fd-fd3f-4da6-8b9e-a8d5004481ba", "value": "16115189c3817c69eaca44014ebe16e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769631498, "uuid": "81d540a4-741d-4239-9231-df3dc7477cbd", "value": "49152:QcsOVdv2HutVqsNpd6NGuWMvqqGit/H7L0Xvik/hBcYTTgXyge:AE7vPzsbGm7LWZpl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769631498, "uuid": "fb2b4d73-9049-4193-b990-92da480e5651", "value": 2236416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769631498, "uuid": "b01475dc-9818-41fd-acf9-65809a0f1d80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769631498, "uuid": "215efc91-3a18-49b8-bb62-2127e2bb80ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b170bf9-fc51-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1769608733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608733, "uuid": "a3603797-e5fb-4677-a176-ef9cd24384fa", "comment": "Malware payload (NetSupport)", "value": "aab32944cf3e4d1a01ad32fb3ee6787c", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608733, "uuid": "16f83e46-ece1-4995-9b44-a57d95089910", "comment": "Malware payload (NetSupport)", "value": "d06f795676ffe5d9119976ceda9272ea2e7e09c2d7f63a793463ba4bdc8b8c69", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608733, "uuid": "61eee462-4f36-4045-88b6-7dc581811468", "comment": "Malware payload (NetSupport)", "value": "7c08fedb37a606f4d4e7b32ca794389ed8555612", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608733, "uuid": "34e356e8-8487-4e9e-925d-2da2f6d367f4", "comment": "Malware payload (NetSupport)", "value": "a89e60f9f27e47e9b7630a6234dd3dbb51e41fb50ec80087a27773658af0591c9c66bfba76122e5749504f372c85e3dd", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608733, "uuid": "93151e2a-f146-4e58-95ef-3e7b4242b5f3", "value": "T186D0A7644619C1E2D29B79861600FD80A42F74555DE9894C2248CAC944C8855D544AE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608733, "uuid": "2699474c-7cac-4feb-bcf4-7de68fad69e2", "value": "6:JyXSvVG/FTVtORYFeJ5Zbf5oeTckGhiDWRkadI9AF:cXaVWftOOFqRzUm3CF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769608733, "uuid": "0a5c894b-5695-46d8-9861-cc98b19cf2a1", "value": 223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769608733, "uuid": "ecd1133d-da06-45de-8332-2710afa9f8d4", "value": "application/x-mswinurl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608733, "uuid": "a6f5b279-1869-41a9-adb5-5efa0059b2fb", "value": "JGS_EXPRESS_INC_Broker_Carrier_Agreement.pdf.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c405e5-fc63-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769616661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616661, "uuid": "53659761-243f-4a5a-a8c5-e1857e37059e", "comment": "Malware payload (Mirai)", "value": "326143591da4f1041b8bf2cb5bf2e033", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616661, "uuid": "b1f7a4fc-817d-4c10-a9df-58c3121f2a33", "comment": "Malware payload (Mirai)", "value": "d1b06bfd9224a7199220c06f7fa672fd864044e5327b50610e9dca5c4827f2d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616661, "uuid": "171818bb-bcd3-4a1d-8c00-771fd1a6be8a", "comment": "Malware payload (Mirai)", "value": "ad0544a26b60d27a5ac8a7b06dc5ead20116c174", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616661, "uuid": "31994a5d-187d-436e-a834-7a16a11159d2", "comment": "Malware payload (Mirai)", "value": "456c7863f0beec8f4a121509eb25945aa453c57c33a7e4490ae18eda5a888fe6bfd5c344e5997deb8375ba3efcf66495", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616661, "uuid": "3c729e82-43e5-4d19-a6de-dd38ccb10287", "value": "T18EA339A3CC766F58C628D5B4B0B18F796B93AA6081475FBE1567C27480C3D8DF6063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616661, "uuid": "874be790-32b3-4855-8506-d977b437fe4d", "value": "1536:TxufPeqU2CxKysVN7lwLPS9PaN7WuJxLLRhqL9u:UbU2dy4IPSh27WufLLLcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769616661, "uuid": "7d3e63bd-f76d-4eaf-bf23-781de85d3be2", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769616661, "uuid": "8a3db373-35a4-4955-83c0-7ebd39acfdfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616661, "uuid": "5bcf8536-c628-485b-9cb8-d6b05ef7f380", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "548ff015-fc32-11f0-a129-42010a9c0007", "comment": "Malware payload (SmartLoader)", "timestamp": 1769595354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769595354, "uuid": "b3f9539a-733b-4421-95e2-9b371fde5e4b", "comment": "Malware payload (SmartLoader)", "value": "5721b6c66392b35fb08eb05c5ec04616", "object_relation": "md5", "Tag": [ { "name": "Fake-Git", "colour": "#271630", "exportable": true, "hide_tag": false }, { "name": "LuaLoader", "colour": "#717CDB", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769595354, "uuid": "0b2c3f67-fb75-4bc6-815f-3f5a6a51aa7d", "comment": "Malware payload (SmartLoader)", "value": "d24d8074d05eb744592b5eb4baf65d28dc96f14c4f5aeed76178b4184831825c", "object_relation": "sha256", "Tag": [ { "name": "Fake-Git", "colour": "#271630", "exportable": true, "hide_tag": false }, { "name": "LuaLoader", "colour": "#717CDB", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769595354, "uuid": "e745c492-2545-497e-85b7-0b99660ee2f4", "comment": "Malware payload (SmartLoader)", "value": "472de066c0f4ea4f2dad191b948167542d59e701", "object_relation": "sha1", "Tag": [ { "name": "Fake-Git", "colour": "#271630", "exportable": true, "hide_tag": false }, { "name": "LuaLoader", "colour": "#717CDB", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769595354, "uuid": "d3bc8d32-1b16-4d3e-bf4f-14931243b20c", "comment": "Malware payload (SmartLoader)", "value": "f4de87faee3d4933d59cee0908cfe8aeb306af826373d4c82c025c39e3ea6327bed4dbedae5889875d27fc2358856730", "object_relation": "sha3-384", "Tag": [ { "name": "Fake-Git", "colour": "#271630", "exportable": true, "hide_tag": false }, { "name": "LuaLoader", "colour": "#717CDB", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769595354, "uuid": "15ce6375-dc35-4b69-80f6-8c9f17825f27", "value": "T12B553346C17C28C44F7D0A677BBF995C62298EFC10021863AF569CD7293F38B86745AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769595354, "uuid": "92b1770e-3f6c-4f17-b8fd-7ef434a112a4", "value": "24576:BcjASGYdsxQ3PoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRD:ijAedvoZ9bq+MmMEL+hcjXHC/wnwdD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769595354, "uuid": "300193b3-a95d-4716-badb-3a4d12ca2539", "value": 1395076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769595354, "uuid": "a0f55d92-1ec3-40e6-9452-f71570aaf070", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769595354, "uuid": "2c4e0473-3910-4f2e-bdf8-0e99a55fd0af", "value": "brainrot-script-roblox-unblenchingly.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "004c2c9a-fc88-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769632149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632149, "uuid": "9ee087dc-abce-4ba1-8c7d-91957bf16e4e", "comment": "Malware payload (Mirai)", "value": "5bebf323cea7c09d5acc4d3f92ad5e88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632149, "uuid": "eb728a77-b1bb-46d8-8de3-df1289c06785", "comment": "Malware payload (Mirai)", "value": "d2adc155413f21cdd28dd6d4da4921c84d64097a055ac5b40ed8090ba3d9fad4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632149, "uuid": "dabdf74e-e8a9-4f3e-819d-5d591b6a697a", "comment": "Malware payload (Mirai)", "value": "d42f64c1e79a83c066269e0bd8873b7851ec6edb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632149, "uuid": "967c13a7-6358-4909-832e-9918cbd68853", "comment": "Malware payload (Mirai)", "value": "d7dbd9061c25c77c02d705fa1d8f97be5f25d621ae53a11f2d418fc1c8065c1f9f3c01a45c74decb085cd5bf139d5e0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632149, "uuid": "44b48fea-93ca-4fd0-8339-9d96fde1f6d6", "value": "T19DC3C506BF114FF7D89BCD7346FA0B05258CB82B16B92B757534EC58B24A1CA1AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632149, "uuid": "6b77b1e9-a29f-453a-a1dd-70ab996c82fe", "value": "1536:j4w4zW/h4SZsqEzXcDgiDSAPLfO4jaXbzjZjCfPNXm/iRK0UgSSWF:0xW/rZsq8cLfHjarzjD+XWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769632149, "uuid": "fee8bae3-1c63-45e3-b9c0-5806ed63fa9e", "value": 118300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769632149, "uuid": "3e42aa6f-46af-4f9a-b9a8-17bea1f7d5e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632149, "uuid": "60753869-c36b-405b-866a-b60789866652", "value": "manji.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59271690-fc2d-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1769593214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593214, "uuid": "6edaef02-d4ee-4f76-85a7-3a8d063cd169", "comment": "Malware payload (Vidar)", "value": "706509196e339b3a7b2063f46dc54c2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593214, "uuid": "529c4082-3313-411a-afd5-fba36c001e00", "comment": "Malware payload (Vidar)", "value": "d3233d19030aaadc54622221d93c41c0d940b82634337a11f00a3d50bb84d943", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593214, "uuid": "aca8814a-a234-4a6d-af86-3757e0ad8cc5", "comment": "Malware payload (Vidar)", "value": "6d89bd692a251d7e3e99cb0e90272c80fe193253", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593214, "uuid": "cdd260e7-bb7a-4e4f-ab2e-98f4a6f82a27", "comment": "Malware payload (Vidar)", "value": "003232d1bf45c4219a37c48570169c1da8015760b8aeb55cf790293f4c6b099fa9380a80802662d9212569a90e57fbee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593214, "uuid": "8fa84c6c-2cc2-4058-a39a-095c305bbc6d", "value": "T182165A53BCA04568D46BD139DCB622417A347C490B3123E72E52B7792EF7BC0563BB2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593214, "uuid": "ea9d04c3-6fb1-4111-9ea7-fdda3211c38c", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593214, "uuid": "5f672602-09cf-4b3e-8dd2-d7b06bec5a23", "value": "49152:9hwjVOoUFIEyD+pZz+UAZ79z/2H2EmSa1:9y0g7vd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769593214, "uuid": "00478f40-968f-4c14-b133-e6f75bef6ce2", "value": 4161200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769593214, "uuid": "fa938985-9e64-49e2-8957-38b2ef900b8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593214, "uuid": "0ac9a9f3-170d-4809-8e16-14b37f50dc30", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "108e371a-fc77-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769624875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769624875, "uuid": "73e8e83a-b027-4f17-ad09-379ec56ed4e4", "comment": "Malware payload", "value": "f0924feb581b99111e0fbd992f115549", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769624875, "uuid": "18e1306a-34be-4724-9f3e-8cb0a634721a", "comment": "Malware payload", "value": "d37cbbf368dcbe1a193e7b5b4e677cdc2160698694c18c5d7c62887df295684e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769624875, "uuid": "0d100fe4-7b3f-4e53-bae4-6bc6c8418460", "comment": "Malware payload", "value": "b7aff414e524ff9b56ca0bd6f071d383497d755c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769624875, "uuid": "0333085e-8147-4f5d-b751-4ea8eb964b9b", "comment": "Malware payload", "value": "df3226c770ec7920944290f47be67ab11e00e604f8ed229cfe3ea0a29740757bddd02dcc2ee56c1920a8ffe80a33c7d7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769624875, "uuid": "e5f879ed-8598-4a31-8a8e-bde9331d02c7", "value": "T18AB533823584B1B4EC24C77484E6423DB2A37F892C1A0987BFBE3D559F362D1663D19B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769624875, "uuid": "3c7c889c-508b-4270-b4bd-e7940e566b30", "value": "815e1ba56e855b07daa7197697b159cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769624875, "uuid": "899c1a60-3078-4f9c-8837-3dc41b3e0d45", "value": "49152:cEATE2uttdIuNC2tTdjl9YLU3xT5pMd2127VrKKb2F6P:cE26I6CCTdjgY3dh8HKF6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769624875, "uuid": "14637fe2-3641-4d6f-8df0-7088f24d91c5", "value": 2331928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769624875, "uuid": "7f660183-2879-43d0-add1-98cae1c5a373", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769624875, "uuid": "7d5d29c5-0178-4239-8003-d5bda34d5398", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b382ee17-fc40-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769601526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601526, "uuid": "36c31dfa-d280-4394-aa89-b57d06e94536", "comment": "Malware payload (Mirai)", "value": "3873186b2dbadcf41185762a02459e28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601526, "uuid": "11d6f4ee-b179-4375-8a22-50e9c000ff22", "comment": "Malware payload (Mirai)", "value": "d3ecd23edc602c60ed59d02ce448b2ca487bb43ada1c4a8c7fd2700f161ed5b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601526, "uuid": "a95106af-8c36-4f53-89a7-2c3941a14720", "comment": "Malware payload (Mirai)", "value": "582289f757b73d42be47d548d52bb8742b5c16b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601526, "uuid": "4c031805-d91e-42bf-a8cf-408bce96b163", "comment": "Malware payload (Mirai)", "value": "58d0e06872cf3a049983053f53d0223574048be01d49ba6153bf3493aa8e26fd804a4ce62f24a72346bdfaa23d263307", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601526, "uuid": "e96d5051-963e-44d5-b8ca-0cbe85777312", "value": "T14E14E909BB510EB7DCAFDD3702E92B0128CC645722A57B367274D528F50BA8B19E3D78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601526, "uuid": "d0ca6597-0c33-49ef-aa75-5e15eabc211a", "value": "6144:/8+0sazdWq+CMk028xeBhpxqFgzEaIuH:0pD+CE4BhpoFYII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769601526, "uuid": "f20a2ef0-197a-4bc3-af09-77302a4de4e7", "value": 206448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769601526, "uuid": "0a0c4217-5f41-4b94-b3e8-c9cc41fa3e33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601526, "uuid": "5cf92e1c-8546-41cf-9e4b-a305034a30f8", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c70fa8d6-fc96-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769638496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769638496, "uuid": "1c86a1ac-e83e-4ac8-974e-f6d48998e189", "comment": "Malware payload (Mirai)", "value": "04059956808c9a1d5fb50d194096ae64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769638496, "uuid": "09d63df6-c5f2-40b9-8a22-399603d494cd", "comment": "Malware payload (Mirai)", "value": "d4649c4962462ad21fc1f392459b58836411ca39e0f66231f8761506a3e02aca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769638496, "uuid": "b1eab4f0-522b-4777-a278-988e59e0dfd0", "comment": "Malware payload (Mirai)", "value": "755844e499d5d55644afc20a486941015e734d0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769638496, "uuid": "25b6ba4a-f088-41fd-b56b-298b1865b5a8", "comment": "Malware payload (Mirai)", "value": "28603172733bfbb4766dd54c9a3e66a92d18ce84ccee18d25e653f164d1f7b9c2cef4e7d727b0190fac02439fa79a7de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769638496, "uuid": "90dbe265-caa7-4109-96d9-d97769579593", "value": "T109B34C22FD355D27C5C0753A11E34631F5B643A925BC9A1E3EA31D9CEF18220316FAAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769638496, "uuid": "c67f9214-ca42-4a37-999c-30de5b717747", "value": "1536:0wODbK9LNBegzohunC+A63uX9Dn4W4DVt2ZkOiTZ0EJw75UCEYMDsyJJt07fBn9k:qnephne63uXMDaopwVA5in9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769638496, "uuid": "febf67ae-968b-4dd2-96d3-ab1a58f09256", "value": 116168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769638496, "uuid": "55440197-b254-447e-85a2-1165fff5d861", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769638496, "uuid": "c17ed424-a8a1-48aa-85ea-6408b9d73bec", "value": "jklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "415051d3-fc70-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1769621951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621951, "uuid": "b3852ba6-714c-4c52-9b1a-0e2fd26012ac", "comment": "Malware payload (njrat)", "value": "eddc8c32ba826ded251b320e8d7d6097", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621951, "uuid": "873da0f0-ae8e-425c-8e52-e5a5fa39c84d", "comment": "Malware payload (njrat)", "value": "d4a68d8a848dd0af45a07168ddb2cae1598d3dff26c7e1a82d55881af058c43b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621951, "uuid": "ad3a8943-6c80-4934-9ac8-21b8b445a254", "comment": "Malware payload (njrat)", "value": "2bee932c4c7f465f1731a1eaebab76f768e9386a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621951, "uuid": "f17511dd-03c0-414d-88fc-de4aad3c68fc", "comment": "Malware payload (njrat)", "value": "55d46f174369c43431a12316a76c33b0cb25b67211cf1e02aeb25b60dccf2e28c2927bed240bb460bd9878eaec3bb048", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621951, "uuid": "4f1d759d-4ad8-4fc4-87d3-fe005d56a72b", "value": "T18FE23C4877E44312C9FEAFF02DF2710A1675E11B9923EB5E0CD8899A2B639C146907E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621951, "uuid": "7750b955-0d65-48e6-b2e7-71bc39649b3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621951, "uuid": "60c76a5f-03ec-4389-8698-ba1440ac2058", "value": "384:hwaJWq4Ava7Rm32oDuuw3+q5XwYeLBEUKvh0FbOKTCOQ9sR6pkFTBLTAOZwpGd2g:zxC3fOJ5yVvGFbO759sDFo9jnOjhrbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769621951, "uuid": "d980dc65-8601-413d-b796-d2cb71f52e8f", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769621951, "uuid": "2cde7eba-f63d-458a-891d-a09a32180c1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621951, "uuid": "3d45bf8b-9206-4903-a9d7-3c1bf891daf7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "120702fc-fc48-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769604691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769604691, "uuid": "868a3f29-0697-4c80-805d-82b5b02d2c6d", "comment": "Malware payload (Mirai)", "value": "3357e279f0c62e08771a40277ac3a3d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769604691, "uuid": "b3fc1882-9df5-4fed-a3af-139982470ee6", "comment": "Malware payload (Mirai)", "value": "d5beda892991d6888abef4fd2a4c26b37416ba69d9b234751fcbe0e7b3cce243", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769604691, "uuid": "e1f56cfe-1111-40a3-92a3-8d31a4a74d24", "comment": "Malware payload (Mirai)", "value": "dbbf41db1394765565c93b31a5e822362d762724", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769604691, "uuid": "42ff14e8-41f0-4ea4-a728-42b372a94c13", "comment": "Malware payload (Mirai)", "value": "83f5154efe314a54aa80e5de8b356eaacb3c7f856ec15ed290dff440b04bceea9ffaffd7974a25e3ed6532a77928a6bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769604691, "uuid": "cc0c4e27-7bcc-443e-89f5-70807b2e4ade", "value": "T114430890F8825A3AC1E11379F5AE798E377077E4D2CA3217CD644B217BD518B2CA6F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769604691, "uuid": "551543e6-e0c9-491d-be09-7333e7ed1e0c", "value": "768:htzyFpnLfWE64b5fM05a5W1hDS9l3rIIZQUVxjlaEsBrFMgXyXrHoqiuDCAypec8:h2nqIyia5W1wl3MM/xjlazWyzkGLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769604691, "uuid": "b4283bc4-ead3-4833-9a5e-bb4c889289c1", "value": 58704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769604691, "uuid": "20af9f79-953e-482f-a1c6-adb886c3261b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769604691, "uuid": "92ec9759-16f2-466c-86f3-dae1ddab5029", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3472d64c-fc1c-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1769585851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769585851, "uuid": "ca0c501d-56a4-4ae5-927f-db4af1fdcdb9", "comment": "Malware payload (Socks5Systemz)", "value": "8f569a275371638999fe71a99899e3fc", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769585851, "uuid": "d6fdcbdc-3870-4955-aab8-23289e253ba2", "comment": "Malware payload (Socks5Systemz)", "value": "d5c3dcf3d68f6984b24708e0e98a71ab8742a270098b3c01b2807f985b17bcec", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769585851, "uuid": "1ee70259-cf8e-449f-a215-23016106a8ca", "comment": "Malware payload (Socks5Systemz)", "value": "85b300195ac3ad16cb11486c3e3d83b6326c454d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769585851, "uuid": "12e3c2f2-c1ff-4d8d-8fc7-cae66cdb933b", "comment": "Malware payload (Socks5Systemz)", "value": "ac0846b9d699dfc40e0ef7fb722c11a4f013a06e4ab58c8f9804cdecb358d36fdd752a1493fcae4853811ff50c272460", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769585851, "uuid": "e429b08c-47c1-41c6-8d79-c9536e594fe5", "value": "T1E4F533F2D06844F5C581FB3CA7E58280DA2357BC897854A232EE9E1FAB5E5C0BB5C107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769585851, "uuid": "5b68cb5f-3433-4348-a428-fd30881b30c9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769585851, "uuid": "e4086cae-d3b7-4801-8d86-d93d42897344", "value": "49152:C9KDopcA1j7Fo+uTnm/Bs+XWDlBXz4GiO+gpvgzxIsNlQeYOwl6T0GHRr9yQ7YY:MrjRhuS/Vy4GDwIkHwl2lHh9yQ7YY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769585851, "uuid": "6cac7e53-a3e3-4202-a6f3-dbdd02088b74", "value": 3556022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769585851, "uuid": "2b152edd-94bd-4ade-a627-62a4cfeef5c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769585851, "uuid": "abb43239-7b34-4172-bbc8-fda7825b6ae4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4198187-fc49-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769605366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769605366, "uuid": "52e860fc-1795-4d3e-ae5d-c8c7ad4d07da", "comment": "Malware payload (Mirai)", "value": "240ea7492bb48fd0f2210b782d5b00ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769605366, "uuid": "37224f24-53e3-4d6a-8bea-5f85d95162d4", "comment": "Malware payload (Mirai)", "value": "d5d514e36bbe0ed7708f7f3eec8776b63b95fec509653f5119bc85fa31dd1e84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769605366, "uuid": "c1710818-a8be-49d4-9839-359ebef3a06a", "comment": "Malware payload (Mirai)", "value": "a115b75bd824ed1b28be86d9b9f29514f70a2e3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769605366, "uuid": "9f9f4869-eebf-4b73-89f0-9b8d95edb25d", "comment": "Malware payload (Mirai)", "value": "a3a07528532f199e915dfd74bc3075f4715726a8fe0064d7bc97e1d50a7d80cf1ca686fe159396810c8066ad3aeef2e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769605366, "uuid": "a06147c9-8326-407b-81fa-de80ab9b0d2d", "value": "T1E4A33AC4F543D4F5D8570130603AFF379E32E1EA6229DA43D7BA9A26AC615C2D809F6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769605366, "uuid": "85f11312-224d-4d66-9bda-debde0b1bc94", "value": "3072:Nwg/GvmcitmhhIDl+et+WgKMPDo1kfl/wsJC:Cg/1cichhIltRi7D7JC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769605366, "uuid": "a4e1e827-85a6-40c9-a790-b68211729334", "value": 102344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769605366, "uuid": "8576e677-312d-402a-8bb6-fd859b1a35c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769605366, "uuid": "12643a39-d3a2-4abc-9201-f6736d988e3f", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9fad435-fc58-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769611872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769611872, "uuid": "7527a5a0-6779-40f2-9c4d-e4b5761c52a1", "comment": "Malware payload", "value": "7a7f9db9c28f7b78acfbfa32183a7e8f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "f397a7", "colour": "#FAFA18", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769611872, "uuid": "fc91ae2b-816f-410e-a68a-027fb63421b3", "comment": "Malware payload", "value": "d64ebcc4b8bc44d60849ca3fa89fbfe4ed0963eb199f7267875cc3c991c144a3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "f397a7", "colour": "#FAFA18", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769611872, "uuid": "5de18dab-99b9-40e7-9119-9f69309b7d6e", "comment": "Malware payload", "value": "6b664ef306eba0ed9d17ba73b0825e01dddcdd23", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "f397a7", "colour": "#FAFA18", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769611872, "uuid": "f64bc8a1-8d8b-4d24-a01a-753c8ba36726", "comment": "Malware payload", "value": "58b03b4074168d056722351781585bb20861825d65c99b1df0a3fa2cb7c55aeffcc8d4291c0de6b265c5f5972aead69c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "f397a7", "colour": "#FAFA18", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769611872, "uuid": "f46de357-77b8-4839-9379-6f95e986df9e", "value": "T1BB745479F90688C5BCCD0CC865696AF1D33B271743A54A92207A331ECB1BC65CD1A9EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769611872, "uuid": "edb9d91a-25db-4944-b478-e87f93b6c087", "value": "6144:RcyWHd6HyA3hS+vohx/Fbg67of2kimmcsBNH+TprFZN/xvwhVSHhPhnRhha8PWrd:RcyWHd6HyA3wyofE2kimm7BNHWP/xvwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769611872, "uuid": "cf2cdcc4-7ccd-42fa-8464-8dfbcb17982f", "value": 349525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769611872, "uuid": "388fdcd3-0279-4cec-88ac-bd3e18c1a9af", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769611872, "uuid": "475f7807-2723-4451-8cb1-c31654073f0c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fee8169-fc40-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769601413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601413, "uuid": "2ce25dd7-b89f-4fe2-b3b7-0c87c570a958", "comment": "Malware payload (Mirai)", "value": "9af52bd4a3bf165f9cfa7794c6dfdc9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601413, "uuid": "ddc2de7a-a8d7-4a85-a057-d345258eb260", "comment": "Malware payload (Mirai)", "value": "d731d39811fb70f431dd6f035f7ec1f4981a863e3716fd48bf247d18820b19e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601413, "uuid": "0a48b3ae-242c-423b-bc0b-405d19d00994", "comment": "Malware payload (Mirai)", "value": "b36464ee0e135dd963307878c5aac07ad2150b9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601413, "uuid": "2e3e548c-a52c-4f5d-b016-050cc088ab04", "comment": "Malware payload (Mirai)", "value": "7d156e03852ad06e5d70167a74060050a9895fac299bbaff166d21f96ea2c37c5daad752aa39e749d83d49d48b8bb707", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601413, "uuid": "1987fe34-d3da-442f-99f2-5a1c0e799855", "value": "T161D34B46FA414A23C0D60779B6AF524A3322A7D1A3DB730699249FB43F867DF0D63E05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601413, "uuid": "f7d54685-ddf9-4242-9ee5-4293f6871a2a", "value": "3072:+cvBt6QvVVZNR99oMoMr+KYJIe6UtM/9/15:+cvBt6OPNR99oMlrAJIe6QM/9/15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769601413, "uuid": "5deaf25c-56d0-471b-b37b-6f2b481d816e", "value": 142668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769601413, "uuid": "42eac93b-7be6-4068-873f-f489d1cf6b45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601413, "uuid": "c0e690c2-5636-4f3b-b254-e453f33caa02", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c86a8eb-fc51-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769608655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608655, "uuid": "939221b4-54f6-4fc0-ba5a-081198a3ce33", "comment": "Malware payload (Mirai)", "value": "0c24365eb9540b36d527bd5a4a6e0c41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608655, "uuid": "14add813-13ab-4eb7-8bd0-342b43696c31", "comment": "Malware payload (Mirai)", "value": "d81349fc12074feef84c388399c1e4803b3038f57731cc227d2359084d7555cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608655, "uuid": "9e311826-5690-4316-94ef-6566ecc8eeed", "comment": "Malware payload (Mirai)", "value": "fcb54860785568d3275a22809e63555dbe5b5ab1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608655, "uuid": "f7db360c-5cca-4fa4-a618-d72eb9a9c05f", "comment": "Malware payload (Mirai)", "value": "7fe5adce6ef463f843bb6147fb987c9d2ae275cadcd3ef4a611615a69cc8ceb9fe7c6a3fd737e719088f60a5b9cb3d47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608655, "uuid": "ec236e05-bacc-4751-a790-1cfef7a8ba2c", "value": "T14DE33A46F6418B13C5D5177BFA9F024A3322D794A3DB730699285FB43F86A5F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608655, "uuid": "753647ed-ae10-44e5-b8ab-d2ffe6414644", "value": "3072:muM5qbxbwPgjnaaZJX79Jot8lCw5I+X7CyEnOXze4M/9D4z/AP:zM5qbxbwPgjnaO68lCw517MOXz5M/9M+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769608655, "uuid": "9913171c-100d-496d-b531-b1a501136c03", "value": 144580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769608655, "uuid": "dbc1110b-8cad-437b-be14-5fd061ffe7a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608655, "uuid": "a672e95d-6576-4b6e-81b4-98bd53449687", "value": "astro.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f206e7c-fc40-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769601465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601465, "uuid": "265f3431-8c1d-4e91-8428-582196f04888", "comment": "Malware payload (Mirai)", "value": "d6de6450164fba51f0227f596bc217c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601465, "uuid": "2ffba046-9fd5-4bd7-8caa-d85bd9ad5c9a", "comment": "Malware payload (Mirai)", "value": "d957b29012f28c713468ca2f9e1ba741a4120eecc08ae798fe44f2f2411aaafb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601465, "uuid": "9325436a-af90-4f0e-982b-60bc79283536", "comment": "Malware payload (Mirai)", "value": "1e7781d9c5ab4c1298ccbd8c36ad3f54b24983ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769601465, "uuid": "0323b0b6-9f90-4e9b-8be5-1a772fd4d334", "comment": "Malware payload (Mirai)", "value": "fb8ce78ddc18da3b1c389dc315043130e010439108600505c41a868fb64674d7817a5ad6db018c360c5141f01cee25c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601465, "uuid": "d92a4457-113c-4df8-998d-eb7957f5b407", "value": "T1C15302CFF493E584C80D7D3D26BC737A1E06A196B12E8F6522106D48742391C79EACAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601465, "uuid": "fc4f269f-2a4d-4a87-8b3a-1c00778c3271", "value": "1536:UzDdlBDsiEhapA8yPdR6oYR3FEXGro7qMDjBFoNp0hpF:+lB8hAXgNcn0G4BeD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769601465, "uuid": "6a0fab74-c63e-4ce4-a25f-b5d1c7560b6b", "value": 60960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769601465, "uuid": "a06a86e4-1599-4178-ae78-cd09042c2e28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769601465, "uuid": "b8daa1bb-9e94-46d5-a781-1a88f69f6b11", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2744b77-fc67-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769618248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769618248, "uuid": "dd6797e4-af0d-4118-8087-58e7d9611452", "comment": "Malware payload", "value": "83ab2bc2ae99d38b622abec99aaff346", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Convagent", "colour": "#086F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769618248, "uuid": "ebc9aa7d-b73a-4cbe-bfc2-cd307b45934a", "comment": "Malware payload", "value": "da1426a5c9aab4b886004523b03d9c3eda067f145c19183ebcce611dc0c4e9e1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Convagent", "colour": "#086F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769618248, "uuid": "aa586c72-3f1b-482f-bac8-2b7d3d0db60b", "comment": "Malware payload", "value": "fe4557e9c79f5911a06b2b16e9b8ddf7cd6eb0df", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Convagent", "colour": "#086F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769618248, "uuid": "281ca1de-3904-4881-bef7-ef5941b775d8", "comment": "Malware payload", "value": "3366574f3722d518f214ec58d739176b18aadd430e921cc03864064ca60e150513ceb3c4418ebc0c181cda9b5a0c99d9", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Convagent", "colour": "#086F82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769618248, "uuid": "c1e04f29-9bd5-464f-8be0-294534239546", "value": "T1AB669DA9AABC00A9D8AAC1BCC6975227D772B45517F057CF1A6486FD0F23BE0167F700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769618248, "uuid": "aecb4fe8-6597-4ddc-ac57-383a0ac62805", "value": "cb7fb589c76b4b8d4d12ca47e7d202fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769618248, "uuid": "a3c1506d-e4a4-4da9-93d1-0d7f49d3fcea", "value": "196608:x2AoplvHObLIPH+wZGZ5sKIBkOwxlnIo:xNoplvHObLiewZGZ5sKIBkOm5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769618248, "uuid": "58bf06fc-58fe-4e17-9bf3-13d4580c5ce9", "value": 6618112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769618248, "uuid": "cb0fe29f-04b6-4f66-8b9d-f3c8689b3075", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769618248, "uuid": "fd46cbd6-f48a-4f6c-9fc9-d92af6f88c20", "value": "u266107.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49cedf6f-fc51-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769608650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608650, "uuid": "09ce3405-4528-4f7c-b51c-14851e31fd1c", "comment": "Malware payload (Mirai)", "value": "ab3a5261f6a925b7973de2199784daa9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608650, "uuid": "c4fe5369-26a8-4106-b065-b48b57b0b812", "comment": "Malware payload (Mirai)", "value": "da613a27cbdb9b59c3e33ab0bdd0f373784b40f15d731fc357cf4dcfa3437bac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608650, "uuid": "0171223d-35f2-49c1-863c-8d99f4a8543b", "comment": "Malware payload (Mirai)", "value": "6671532985a7bfe3d9f545fd4dcbc8e98bc67afa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608650, "uuid": "b3e538ee-a960-4621-8d79-a4f8714d9739", "comment": "Malware payload (Mirai)", "value": "b8c10f523d29264b9f77d2b4d1a8761a4b747791c1ded290eb33de54a87c44ee4850a6cd06a3f285023670fb5aae22db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608650, "uuid": "cae70f24-df42-447c-8186-24b6225ccb8e", "value": "T124E2F1090031A978DBBC2235D861538EE35F0FFDA4EB3E97AA90426D55D311799387C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608650, "uuid": "57fe3f2e-aac5-486d-a043-872f5a5b5cdd", "value": "768:zUSVB3kuzVrwloNTJ8vSL2zoolbts4RddehnWSfGcj7cua9q3UELEW:r3kuzJIqivSL25lbts4bdCndfGc7cuPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769608650, "uuid": "5398da85-8be7-4376-a559-9d1844030f86", "value": 32052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769608650, "uuid": "587c1153-43a4-4cf5-b11a-d9424f6562d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608650, "uuid": "8cc52c36-4165-4fca-8eb0-2a74852e43f8", "value": "astro.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6589d05-fc63-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769616671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616671, "uuid": "8f1be1fd-7fda-407a-8012-0c9bee63a6ec", "comment": "Malware payload (Mirai)", "value": "a644fe2bd9a1550790f3604d51679686", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616671, "uuid": "ade4b681-fa4e-4475-b063-d9ad77430c7d", "comment": "Malware payload (Mirai)", "value": "db2329e547bc4ccde5ed3af2bb71f2b782d3ca268cf780e4db9bf1e67afe02ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616671, "uuid": "22b538c3-e468-4736-afd5-4573104f056d", "comment": "Malware payload (Mirai)", "value": "8c5e590c556ee94ae843a1ecf9dec87abcb730b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616671, "uuid": "e5d7f362-326d-4a13-afbf-d36c1c943d55", "comment": "Malware payload (Mirai)", "value": "e8b95cc5ac2a0acfa7e7b2130f910e8da4c17126cad1facd3720bb1287f7717dab56dd99322c46a98aabc2a78e1d9f84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616671, "uuid": "4cdbc455-fa4e-4a36-b31d-acf940fe6805", "value": "T1E1B30945FC505B17C6C652BBFB4E428D7B2A1768D3FE720399256F30378B96A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616671, "uuid": "3a7475bb-c5b6-4f2f-9a74-271108be6230", "value": "1536:dUK9yqnU8vGRz4VA4j6Tpmq8by6OxVZZpq4cBlKxwywXvqcVqafFPCwMBFvN:mixnUHz4Z+NmVAnv8EN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769616671, "uuid": "69c637ac-80cf-4a50-8f44-19cf018a4a0d", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769616671, "uuid": "5f9e3779-a993-4633-a2cd-deded2540e22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616671, "uuid": "b32396c4-de4c-4271-937f-ca23675fcf71", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf4283d-fc87-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769632145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632145, "uuid": "eb2b0e61-7400-4907-acc5-fc966ed6115f", "comment": "Malware payload (Mirai)", "value": "9dec58244701758ebd18ca260fc2effe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632145, "uuid": "c1cdbedb-44d8-44d1-aac6-1a4863e24820", "comment": "Malware payload (Mirai)", "value": "db67019f5fdc337c2ba54793b0cbf8da506eaba16747bf7f1f63fdcc3a38e781", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632145, "uuid": "871f7feb-ad93-4992-83d1-d0d3914be2c7", "comment": "Malware payload (Mirai)", "value": "d904bda8134432c479e8b6ebda5d0b3230ccd07a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632145, "uuid": "3311f9be-3af0-4709-9349-01fd8eee1b5f", "comment": "Malware payload (Mirai)", "value": "96a0865439275fbe7e6d75bce166d52ed925b27d828cbd3a96b4ca20d6834c98fb39748697f795c9ec8f70823b0e7cd8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632145, "uuid": "e1ddc710-304a-42f8-9dfa-add667cbd397", "value": "T118730981BA43DEF3E81711F502B7DB365A32FD3A083AC5C6E364FCA16A515C1A5163AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632145, "uuid": "17b74809-b088-4be8-8400-00dacfb762ff", "value": "1536:RcK8MffyU5RL+r9RS3TlU0f/wFBO4kVgu3Urpbr5ag1416mEv6+8p:RcHCfyU5MuTlU0nwdYgu3Spbr4q4HDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769632145, "uuid": "37ca8e6a-be91-460e-9eec-fd4433b02151", "value": 75560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769632145, "uuid": "e9175759-365f-4fa3-8d90-0626e4716dc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632145, "uuid": "5681df6a-9573-4898-9a41-0278f4025ef5", "value": "manji.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e0da36-fc7b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769626864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626864, "uuid": "08cc89cf-95d0-49c0-a7d9-fa993dc2f96d", "comment": "Malware payload (Mirai)", "value": "f8b28500ea59e7ecf4030d9ef4dfbae6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626864, "uuid": "1433797f-1ce8-47e1-b892-382dfec3ec7c", "comment": "Malware payload (Mirai)", "value": "dd2db525932597c88b01ffa5ed9b36e00215806ba320aebd7bdf36dba2794c0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626864, "uuid": "6f6b23c8-8fbf-4525-a2c8-7364cff76488", "comment": "Malware payload (Mirai)", "value": "5e4757a5d333b9d49af9f24cf06e8929eebb3e27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626864, "uuid": "c58b9053-5c2c-4d04-8b0a-a744d8c10518", "comment": "Malware payload (Mirai)", "value": "01d5a870ca032f9c26d1aa9b540d743af2280b47e8ab7e1ddbc5542d5d6ad0ca3ddd188467d5c878baa1d58452598253", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626864, "uuid": "99dad237-0ae1-4574-a709-33c1f340db07", "value": "T10433F1B6AE8241CAD78D81BCA4B903ADF102B3C277D93E56332D9646F65442F114B0EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626864, "uuid": "f8bab2bf-bb9a-4a05-9cb2-24394e0aa1f0", "value": "768:OzPHAjKDXyUTUc6Fta/5BrES5h70CYT7lyIrq3/G0zmXN4NkPhRY1LHocWx4:WgjkyCwu55ES5t0CU7frIRO35qLa4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769626864, "uuid": "9fba2fb0-6150-47b5-9443-baa6aa0998a9", "value": 54948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769626864, "uuid": "94b19ff4-6cbe-4650-af3e-23cd27b1d75c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626864, "uuid": "4fd22189-74e7-4dda-b7d6-980766db42bc", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b10baf9a-fc2b-11f0-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1769592503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769592503, "uuid": "c45562ce-1008-487b-978a-c5b492689e96", "comment": "Malware payload (SantaStealer)", "value": "67c32ad41ab6ca1871e1b6d65aec7d23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769592503, "uuid": "84353f96-a12d-4355-aaf0-a512151bdafb", "comment": "Malware payload (SantaStealer)", "value": "dd3251010efac018f809ad69ed40ba2d30f32147692c25e83938236d13f2aafa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769592503, "uuid": "97261b43-5d23-4107-ae48-1ab5283d0cb1", "comment": "Malware payload (SantaStealer)", "value": "25fd4d5b1bfcc6694d9a3cbb9bd1515d0e317e54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769592503, "uuid": "b40ecedc-5df8-42ef-8918-8b84dbd76caa", "comment": "Malware payload (SantaStealer)", "value": "d16688901bf99fa9119eb1cf068823bdac6c63503a25ea857d412abea4f0572f8ac0ded8a73272c852505953deb2a0a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769592503, "uuid": "37ac8cec-8971-4f89-b06b-9912727790aa", "value": "T12416F147E2A320ECC16BC274466B6673B931B85551347EBFD590DB302E62F602B2EB35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769592503, "uuid": "3f193045-ec7e-43ae-9497-0ba1b2b102c8", "value": "86decc6ebb11144606632964f65c138b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769592503, "uuid": "9d08fefa-31c3-44af-8dd7-55287d89183b", "value": "98304:RGGA8NDwYmHjo8xwGW9Iy8ca8A8mhjZZdlWyQKoUsB:VNDOo5G2abNbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769592503, "uuid": "8b103331-ee77-48a2-8af0-d51876291fb8", "value": 4211896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769592503, "uuid": "8cbeb0b1-9a43-42af-80e7-2d45dbe16550", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769592503, "uuid": "1c0edcf6-fdbb-4df4-b1ce-7656329d112d", "value": "Executor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a846f525-fc6b-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1769619976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769619976, "uuid": "59190d8b-ff36-4d89-9e99-98b85278ec6e", "comment": "Malware payload (Socks5Systemz)", "value": "d509efe38fcccb3924f70d62619024ac", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769619976, "uuid": "717f0288-47ba-40e6-a838-73e5c9c27c33", "comment": "Malware payload (Socks5Systemz)", "value": "dd35aabf932fb65124a1d0224b6ee1654637c4114310b2c5987456c7ec783ed9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769619976, "uuid": "387d6686-8cdf-4387-9c05-2e8fb6135b42", "comment": "Malware payload (Socks5Systemz)", "value": "9c67f28ba8388872742f397c1229fc265d9a669a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769619976, "uuid": "c0ea91d2-c32e-46b0-9909-edc8b421fbe5", "comment": "Malware payload (Socks5Systemz)", "value": "513d5386094f5aba37aa51e20b6c921f1fa24e465a044fe5f626e78fa6cd964ba00e59b43a0ba506232d3d7096e6581d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769619976, "uuid": "ab3e2128-cce9-4567-b2e6-0cad570dfced", "value": "T1F1063332FEA5023FEA7149B08A34895655F7CE167EFC19A573CE27DC1B620A0A50C736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769619976, "uuid": "a9152749-f153-479d-af1a-726c094aeac0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769619976, "uuid": "db166386-cd43-4f18-9c0f-7631fc741fd6", "value": "98304:MbH83x1zRYHMoTRf1cnIZoTITxO1sF1J1Item:qH8Btisg0IZ+102tem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769619976, "uuid": "ab5c917c-9ed8-481b-875b-f5c3b19e94dd", "value": 3734809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769619976, "uuid": "bc3107a9-31e2-4c73-91e7-22cbd08df7b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769619976, "uuid": "f8863667-6c7c-465c-8874-1190d5705416", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec37f46-fc2d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769593277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593277, "uuid": "c5347f67-e836-4e5e-bf0c-1c2e6f513f77", "comment": "Malware payload", "value": "b9a470938eb707b12acccea5083eb343", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593277, "uuid": "2873e0ff-d0ee-4c7f-8b2a-fc15ca4fb3b8", "comment": "Malware payload", "value": "dde23371c70b8c4324ba8438fa8092b760736012895457df0e391f8f1a851245", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593277, "uuid": "cba733ce-0585-425f-80a6-5e9977409019", "comment": "Malware payload", "value": "fc28d08b9258e8298107383a9690223a6efd6c80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769593277, "uuid": "44106e41-0060-4db0-a0c8-d3e3d702ec08", "comment": "Malware payload", "value": "813ab5dc731de84e71ec751bb1c819a4404876ddf983d3b10cbb5bbdf3d1e1f76c648e536db3fc342a4ee66bee1ac35e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593277, "uuid": "cc7b5cac-a52d-427f-9ea9-5f0d835ce566", "value": "T1D995AFB876043DE6E66F577BDA96ADDC137627239A8BA4CC8064B7C30563371FE02805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593277, "uuid": "63f7b460-23ef-4498-bfe2-fd227215779e", "value": "ad72aec9efd201e91e27001d8bc8ee2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593277, "uuid": "58f5b5e0-6625-48ff-96f5-18c0c16285b9", "value": "24576:DiRxehCnxTRj9RtgI1Kn6KUib0m7Gpptt/dPl8W6HhXbomLUbXAdkHlyc0uWyRgA:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769593277, "uuid": "cfbe8c93-ea96-455f-a90a-d8af9d2fa92f", "value": 1972736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769593277, "uuid": "9edcf794-c279-4bff-bbcf-991bfcba2e49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769593277, "uuid": "18eb036a-4da9-449a-8afd-406ba9cc9f77", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e0865a6-fc89-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769632709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632709, "uuid": "e838dd97-2fd3-4981-8672-aa7adb4b39cb", "comment": "Malware payload (Mirai)", "value": "b39a4f0e5ff13a49739ab12608558508", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632709, "uuid": "f6e8d982-f7af-4086-be8b-9c0e3f995925", "comment": "Malware payload (Mirai)", "value": "de6d9e299cd4ca9fb1f7748182b656434b014a25329319f8b8acd86a4ac2fd64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632709, "uuid": "a5f84bdd-00ed-4455-ab99-83d315fbd615", "comment": "Malware payload (Mirai)", "value": "fa9f228ee28ce7184dde7c5c841cf621816c9353", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632709, "uuid": "f5ee77d1-8fb9-4bb2-aac9-760f74ded8dc", "comment": "Malware payload (Mirai)", "value": "1267d610bd4ad16ce1d2a4a6e2d8a433a3f45c905d795485a9a677fa6d95206ccf45b06dfb1d605922bb64dad29358d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632709, "uuid": "259dbb77-d89f-4943-81cb-69b5496fa98a", "value": "T118A39D12CC705AACF07B6E3010B9DDBA4327E5C9991B6CFB3C86C2261057E94F496BB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632709, "uuid": "43e8765c-99fd-4288-906c-f1ccfb9a6e3e", "value": "1536:PDT5491b2XEd+mDvJCH8Mw5kXkiwcuz2VmOYKzXv4ultHCezKbZjuXKN:PRy16w+IvJa8MykUBcgMznltH5qduXu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769632709, "uuid": "a8a357c8-d445-486f-9bbc-8fe3481b6cfd", "value": 105772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769632709, "uuid": "d7c73f6b-632a-4470-86c6-c3c93ba7ba44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632709, "uuid": "55f38acb-f60d-40fb-9053-809debece2bf", "value": "jklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e45d19d-fc8d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769634320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769634320, "uuid": "9ca8b821-02fd-484d-9e2e-6f3309199f45", "comment": "Malware payload", "value": "0f33bedace26da6c6850a6f95fea4c5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769634320, "uuid": "e326c4be-f8b5-4eb2-85b2-7a7907c2df56", "comment": "Malware payload", "value": "e0207d8f191257a46b9ebc289398ff80c7995998a74c20b073e8d108b89da010", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769634320, "uuid": "59c044ea-326e-48ca-8f75-c735b7873d3d", "comment": "Malware payload", "value": "63d3caa69b2e287ed0cf8ff39971713e8a85cf55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769634320, "uuid": "2e42ac0e-4344-4465-bdf9-46d00ff96351", "comment": "Malware payload", "value": "904a534e031dd56980f1ef93ca809b547218140331740b31be91fd45bc12db10334817123252b0dfaf1c7cf01c2cb5c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769634320, "uuid": "5ad4204a-9df0-46f8-aef1-100c1ebb8996", "value": "T1F3056D227B21CF69D354C27009F3C7525AE524A217E2508AA37CC7287AA166D2D5FFFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769634320, "uuid": "068320f1-ae72-41e5-8c7a-1903594744e7", "value": "24576:B4pgl4YxMg8OGolxq1KObPXKv71C7dppKP:B4psrGovq1KEW71C7du", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769634320, "uuid": "944af0b2-8824-472a-939b-1074a6457388", "value": 860884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769634320, "uuid": "4942a5d8-f928-4aad-b33d-e452baeed604", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769634320, "uuid": "988042b4-0288-42be-9c7f-337e5524228c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f095f23c-fc79-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1769626110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626110, "uuid": "fab530a7-8763-49b1-bdf2-a0a3aaaed224", "comment": "Malware payload (Adware.Neoreklami)", "value": "568054e117f672fd6bb4c1e15d714ccf", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626110, "uuid": "3c586d22-6377-4df6-91dd-55e503a78eb7", "comment": "Malware payload (Adware.Neoreklami)", "value": "e0b02ba5ad2f0594ae0a5e42e76e91e3a1836dc793b626ad3289558c6f70f779", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626110, "uuid": "9dfca917-8852-4b7e-990a-e0eab55d55fb", "comment": "Malware payload (Adware.Neoreklami)", "value": "1c374a20066b4f1c1c728ae8aa260a5cb056bdc7", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626110, "uuid": "7a7162dc-f8af-4c8f-974b-945c0c769975", "comment": "Malware payload (Adware.Neoreklami)", "value": "2165c63df25089f3cf660a595b3e08b1779081715154e9ab71d4610bbfa48e25f3d6ae49f9bb64e1d3af6e6947471b86", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626110, "uuid": "1b982934-5ac9-4457-b7c7-ca4c9d24d98c", "value": "T10B7633313DC2847DE66505336490FFD8A17AE1AF5F21ECA3A3F4578C186DB91A12272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626110, "uuid": "fc28e198-58fc-46d6-af93-6a2be29e78b0", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626110, "uuid": "1ee95b40-8d5a-48ed-97d6-ea58d085ffc7", "value": "196608:P1O3gKBfV0a28csLcLgIgiET0AUIhH8jgWGkaHDN7Bv4x5WWALb:tOff72qbwcUlkIeJFvqwLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769626110, "uuid": "3307fb29-5eb2-4032-8118-e825e9d6bf72", "value": 7504201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769626110, "uuid": "8c555922-5476-4b07-ac9f-83454b040296", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626110, "uuid": "537dd589-7d33-4c68-8dd9-71447630e132", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e44cd3-fc36-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769597296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769597296, "uuid": "2b23ca42-4c86-4d5b-8531-0eef64a7e7ca", "comment": "Malware payload (Mirai)", "value": "28d63683c4abf6de917fe26c5456e4c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769597296, "uuid": "e7fd2644-b9b5-45b2-8f30-47defb01ec19", "comment": "Malware payload (Mirai)", "value": "e15ce931f64fb95cd28b67b04f354997e6b8c105f6ccc75c8656e860398d4590", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769597296, "uuid": "5d999649-86dc-4444-b762-f59ec54eb36c", "comment": "Malware payload (Mirai)", "value": "d9e4330edbfd93922a2b4dfcb4a0de74ecf26065", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769597296, "uuid": "ac177170-2aea-4104-92f2-a3a2f5138018", "comment": "Malware payload (Mirai)", "value": "e640e9e99b13c6789d663837023f0edb33eef1e9d8300ee8446ac8317885ccf7efdcdf7ef993f1dad3308517b3286f22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769597296, "uuid": "e1aa812a-d320-48d5-b1a4-a7ab6371526f", "value": "T19DC3B64E6E529F7CF32C83744BB38B3AA65527D233A0C186E25CEA411D6035E586FF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769597296, "uuid": "36be0041-5d06-4e91-9172-0d019867682f", "value": "1536:lCJ5PTTvvZvvMTvcFTx6DvF4ZeIAFnLd2vawvA0fZyi48FpoLkMWxzOPXsXzo:l+PfTxEv+HAt4a0y+oL9BXsX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769597296, "uuid": "ebbb2026-285f-4893-88b5-ea5fe45473d0", "value": 121728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769597296, "uuid": "abf6fc2c-ddde-4ee7-9d3d-ad60c16f7787", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769597296, "uuid": "8eb90a3d-7bef-44da-8963-42548491b093", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "174232df-fc5b-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1769612861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769612861, "uuid": "09906af1-cfd6-480b-82dc-7dc3cd9efe31", "comment": "Malware payload (Gafgyt)", "value": "8526b44220e0c103f843854638746dcc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769612861, "uuid": "1aac9e43-6a42-40a5-893a-84bc2a87228f", "comment": "Malware payload (Gafgyt)", "value": "e21b7bea60a9530514cc047e69acc0a4f8fcd4aa0b0b740b44420536df8db05d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769612861, "uuid": "54844602-681e-442a-81e2-aa3d99ddf0f8", "comment": "Malware payload (Gafgyt)", "value": "216950561b3f0d8d5d8d93f0608b912d93c0ba11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769612861, "uuid": "a5083c09-a7fc-47c4-9dd3-c1780ff552c5", "comment": "Malware payload (Gafgyt)", "value": "8c48aca9beeb12e558623b0fa92496046435304fb7be0b0e35239711a9cbd21a2173fc2c5a645ff3f8d455d170991a37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769612861, "uuid": "4138ca2c-c635-427b-952f-fb922349e232", "value": "T14A93B71E6E218FBDF259C33547B74E31979833D626E1C685E2ACD2101E6034E685FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769612861, "uuid": "9f566267-16d2-440e-948d-c246eb5cef05", "value": "1536:3K/dK+HBEIhhft3/BOuBOMMOrC60Y00/UrFE4negijkWJCteu:a/dbJl3D5T/CE4zeml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769612861, "uuid": "7e3cf8c7-0fea-48aa-a6d2-b9f9560fc773", "value": 97332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769612861, "uuid": "a2f05837-e302-480b-abe7-9a7b1c358c57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769612861, "uuid": "303b6aee-8f61-4cdd-a3d3-6c0743c3c858", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a303e1-fc91-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769636160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636160, "uuid": "30e0e2f8-d563-4517-a9dc-2450f84c712f", "comment": "Malware payload", "value": "b8b2598d3e28aed24a6283643c4b3bc4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636160, "uuid": "af3bb041-24e7-44de-ae98-1bc69bb286e7", "comment": "Malware payload", "value": "e273b1b1b97cd2d6a8b21bc0029f2b7ffdcd775cacf7c6f5f5ac362167835f99", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636160, "uuid": "47f7b386-3cfe-432f-9857-16d03f040107", "comment": "Malware payload", "value": "4a2104ac214fd117c778c4d2e93134164a47c262", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636160, "uuid": "65ccc7e5-0daf-41d5-bc40-6fb229e3c697", "comment": "Malware payload", "value": "dcaf46af47c6f86def23d3313e2117b68d2544a968aa7cc07a8ec909f0da92c67b2a58103dacc1b7dd797cb87b3a2038", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636160, "uuid": "e9057f98-cf48-4397-adcf-bf8c5f42d9e2", "value": "T142336333D410FE0641A1EE55A2799B04D672D97748AC6418B60C4E4D0FCA9EA3BBFF4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636160, "uuid": "62b15749-8c7e-43b3-836b-96024eec729a", "value": "1536:CcHg5AjywjIDFSD4zNq94AbluKlAGRhl0IGoO1kA:C0tN/5OB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769636160, "uuid": "63859677-272b-46bb-86cb-b89e98fb3a72", "value": 55045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769636160, "uuid": "78fa4842-528e-4c94-bd19-68e707397c70", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636160, "uuid": "de177fa7-3f1e-4102-bc01-5c2caa4afa51", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ed6f835-fc9c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769641005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641005, "uuid": "035eb8ea-3aaf-4a5d-85c0-44d3c3fa2606", "comment": "Malware payload", "value": "4685703483319a75ba6b8379bfb0ef4c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641005, "uuid": "3f4a88ac-6a62-4f07-b1b8-77d1b0ae262e", "comment": "Malware payload", "value": "e292acc951b7728195a765578170957c7a58ad3c67ca77d16c02de39f1ffe18c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641005, "uuid": "4cadc698-872d-45c5-b956-ba0e9b01eaed", "comment": "Malware payload", "value": "6c34b806937fddcfc06299c4a352384aa86bd6b6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641005, "uuid": "075e0087-9329-4493-bdd1-12a87b45836c", "comment": "Malware payload", "value": "a7c6939cfe406a47282d8bd031ab04e4b03cb6644eec6f9a8b737f9e1c56299d19552a76809ccb3e9f86a6650c94663e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769641005, "uuid": "18a117ae-3ca2-41c2-9c28-7c9638f568de", "value": "T1B5336333D410FE0601A1EE55A2799B04D672D97748AC6418B60C4E4D0FCA9EA3BBFF4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769641005, "uuid": "f47a2ca9-03c8-4b63-a1c9-198271fbd1ff", "value": "1536:gcHg5AgywXIDFSD4zNq94AbluKlAGRhl0IGLEOP:gZtN/GEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769641005, "uuid": "f8941fa9-a62d-42e8-8c9e-3a14d513856d", "value": 55016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769641005, "uuid": "5282146f-c9ad-40ed-bc5e-f739aebbff72", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769641005, "uuid": "7f109e6f-d360-4a03-a351-b5985e9b1603", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a7081d-fc3c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769599543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599543, "uuid": "2a8b6de1-127b-41db-89a2-43e176cc4fee", "comment": "Malware payload (Mirai)", "value": "a0d3d23ba3221ac8a43c5af3d082d398", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599543, "uuid": "90850b4d-3cee-47c4-9cb6-67016f925b04", "comment": "Malware payload (Mirai)", "value": "e295d162049669301f8fd374f811ea9417d892962ead03204f06e9b9dd1ee8dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599543, "uuid": "d5a56190-9a66-4881-bc53-d3be7e673fd0", "comment": "Malware payload (Mirai)", "value": "56473b76ccdf209a7173c4eb147e74e472fb0998", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599543, "uuid": "39e7735f-eb4d-44fd-ab57-238b7d1bbb77", "comment": "Malware payload (Mirai)", "value": "3d3fa7a3a07958dbacd369d5a789e5851d680c5e83131c0db4a18759302175a8ab671bea351aed3db00f68e33fc55ed6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599543, "uuid": "d15e891e-2b39-40bb-9d87-89aa910dc124", "value": "T197931AC9BC858B11D5C126BAFE1E618D33134B78E3FA7213CE185B2E574E86B0A3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599543, "uuid": "4721a3ca-7cf2-4a2d-b5e8-d2cb0592092f", "value": "1536:yRnrxxEIEe94DsrLP45f0EfIYfjQesfZLQEeQYPiR53us5M0iea8MQ8LxVE7YxY8:WEIEUFrLw5f0Efhfj5QZleKRna8MQ8Lt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769599543, "uuid": "fdf805f9-938d-4626-b296-ea77e3d6a868", "value": 95608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769599543, "uuid": "6662f504-84df-4db8-99d5-d9c6cd6eb336", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599543, "uuid": "5bc1c7dc-91ba-490d-8728-2c5c29b9df7e", "value": "zerarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "644094da-fc65-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769617285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617285, "uuid": "3efda651-dbb0-4173-a9d6-f1a938653b8d", "comment": "Malware payload (Mirai)", "value": "9e284d6c1c9363142ea6650d3c9218f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617285, "uuid": "7c5ff865-f615-41c7-80d7-7ce687661884", "comment": "Malware payload (Mirai)", "value": "e33a7b7a21b2e595bca6611d9808a9ef65722b3f89e3d852c57291a3b88f2ae8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617285, "uuid": "89062cfd-3664-4723-9dc5-37b4a5f41120", "comment": "Malware payload (Mirai)", "value": "3d57451e0d4ad557a560b6216d25eb82c405398e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617285, "uuid": "65ac88cb-468d-449b-83b1-e89e1b14e114", "comment": "Malware payload (Mirai)", "value": "0f3df6e521c3a3fc362a487252b9dcac29c6cfa4b63636456eeea9bdd2664d480734b7b5e374bea4621d24865234c5cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617285, "uuid": "dc9137c2-179f-460e-91c8-ced17d09d1df", "value": "T150630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617285, "uuid": "ec54b517-c69f-4877-b690-ac7306b20a74", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769617285, "uuid": "84ea1088-3655-4fb2-b06a-7d12a8489d6c", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769617285, "uuid": "4198ac5a-e319-4cec-8781-988f81eb5eb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617285, "uuid": "42a9aa7e-775e-4e9a-b86e-5eb005cb8944", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e08d4b-fc7c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769627216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769627216, "uuid": "06312adf-9fbe-4c02-98d1-b705db7b8393", "comment": "Malware payload (Mirai)", "value": "18061de1be242b22d92c9ca9f864cd73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769627216, "uuid": "c6cc7cb7-ec9a-4d2b-bf72-4d5cc741e84c", "comment": "Malware payload (Mirai)", "value": "e368bd223868997613b2ba853fe28aab85eaf1033e42e689c3ce506ccd044293", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769627216, "uuid": "67198550-d051-4bbc-ba07-b3b597278eba", "comment": "Malware payload (Mirai)", "value": "4650db9806ef1e191b25c6b920b184d156c18dad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769627216, "uuid": "edf3e8f3-8e4e-4423-8c34-343eee203a70", "comment": "Malware payload (Mirai)", "value": "b8822c57854b52a7590b6d9a30a053a456385c247c1c493526074be9324ce7da5abe404b73deaef2ca692e395150adbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769627216, "uuid": "f9e3a76e-162f-4982-ba3c-5f155dadc6ef", "value": "T1D423F1D413E998719B70EB739CBB0A4AEE17047461FB7777D7203A5E424E02AC674660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769627216, "uuid": "7a00be78-f2ca-4899-aca0-c9d83a5dbe4b", "value": "768:Ldinmc5qiTYs12rcXC3T8oXlNAU44X/2TBgr3nQkT2uj6vYsckh08fGjjGs3Uozu:LdimTG2riCLkeP2TY3nNT2a6hcKejjrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769627216, "uuid": "adc5070b-ff50-4e96-90b6-04865427362b", "value": 49128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769627216, "uuid": "e38aed97-4700-4171-a2e4-50b904843854", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769627216, "uuid": "f9299c3e-564d-4c9a-b84f-5ea193bc9ae4", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "791e1b8f-fc6e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769621185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621185, "uuid": "28dea1ad-6c26-4ae6-a707-c06059019ab3", "comment": "Malware payload (Mirai)", "value": "89af8c4b1b68e93c25c0d8b666aaee51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621185, "uuid": "ec41893d-2c31-41e7-9b29-2422be2a7089", "comment": "Malware payload (Mirai)", "value": "e427f187418425a5fe443633866b41df0d4db060e157ec3bd8313d71d18da47b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621185, "uuid": "19328bde-46d2-4699-b3ee-718f0a5bc765", "comment": "Malware payload (Mirai)", "value": "be201560d4c977f20adcbf03e959f997981dfd50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621185, "uuid": "d94de704-a5b0-4e4d-8917-ba80c2636852", "comment": "Malware payload (Mirai)", "value": "42f3e2c97827ae65780a454eac1772a800af7229e674ad2b7b9e782d993562ef9303669f823d3041ab329e0b65f555a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621185, "uuid": "7a0733b6-44dd-4ded-8cf2-24797ef24a59", "value": "T105633A817C80AA25C7D01777FA9F108E33156BD8E1DAB3478C142F9176DA81F0D6B79A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621185, "uuid": "69fd60da-bc50-487c-8c7d-48853a795bd0", "value": "1536:oNvhbZUxGVU2O0170yoVzyMNKHwNKnJeZWovjHJkKN4:oNvhbYNKJwpvj3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769621185, "uuid": "6942eb41-a259-4118-97ce-0464e377f935", "value": 70468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769621185, "uuid": "46fc8222-4011-4cea-bf84-8562f814514b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621185, "uuid": "aee612a0-b1c5-48f2-abb3-ab544bba8090", "value": "pandora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd198b2f-fc63-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769616682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616682, "uuid": "a85386ac-c2ee-4f2e-b679-662d94996465", "comment": "Malware payload (Mirai)", "value": "ed8126b2ed8d5326ab9f2d9cdcd877a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616682, "uuid": "c899016e-2271-4a04-aca7-ff011bb21fc0", "comment": "Malware payload (Mirai)", "value": "e4993d1973b90c88a7fd56579e2ff4038dda14814d8df4fd577387e62049a077", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616682, "uuid": "b2d42ef4-5131-4bc8-a7d2-6bcdbbd7c5df", "comment": "Malware payload (Mirai)", "value": "1ed8b778a7e3f10361b1a24b8bf89c9f4e867f60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616682, "uuid": "29572366-53b2-4361-847c-a53d7d41903e", "comment": "Malware payload (Mirai)", "value": "55fb96cebec1a03c70990e1b485ae96fb4f0e8f09f37e946ef514341940c8ddc2a98ed827ad93d036b50069acaae8b44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616682, "uuid": "83a9ede4-b5c2-47f5-9f52-6031231f9ea9", "value": "T1AFB30845F8445B17C6C666B7FF8E438D7B2A1758E3EE720399256F30378B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616682, "uuid": "7c950965-7dbb-4b9b-8485-d6fa0881d28f", "value": "1536:A7jnPq8azP4V8YOTUF1HyNOr4uGIwYeFGdPl4GVwywlQ3Ym3Xb/VBorUCkeQka:mzPqF41OIFp7GIxe0XRy8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769616682, "uuid": "41d40f65-53fd-474d-8fb3-a7b9fb6628ff", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769616682, "uuid": "9cfdca55-7855-4b87-b8c8-302b31dfb187", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616682, "uuid": "3012c058-ca22-48d3-859f-6adcdff3379c", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5e60973-fc6e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769621287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621287, "uuid": "e867d5bd-6e07-4bc0-903c-5e30c8af3204", "comment": "Malware payload", "value": "4a00dabb750df74e938765b402d2d9e8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621287, "uuid": "506d96b5-8c9a-4061-8720-0477bcd4f8c1", "comment": "Malware payload", "value": "e4a5c87828bd1818c1d5fc5aa8d8020b554b2ac2d09fc6f67050f9ceec3d7ebe", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621287, "uuid": "82af462f-b963-41c4-949d-6638556fba4e", "comment": "Malware payload", "value": "0efc1f4ea5efa7aa47980024c5ecf209f99d143b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621287, "uuid": "3c04e040-ade4-48c9-b4ec-2ae425cf3950", "comment": "Malware payload", "value": "075fc82a4560adc88c7b6e1802263614390f86bcf7081e7ce49ac1da96e00c8f02864a6924983f796835e56eed20187d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621287, "uuid": "1aecdaa0-ea2e-4cf3-8fde-63753bc6d32e", "value": "T1C224BE3A33E66C4949BA6B5BF4D2C007BE9E9CE74B3895CE60DF44A4378E0CA55F4481", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621287, "uuid": "1cfd2782-b7e6-430d-998b-5d811ca8e69c", "value": "3072:Ytp3mi7xW+bhaar1gyDvIbBRGFjAaO2MRwBWv4uk76jSzYY8xPHXI7pCwNa:kprxW+taaMbBHhRwBWwuzC853I7pCwNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769621287, "uuid": "ae78f7ce-618a-4606-b15e-969a5c3c1ac3", "value": 212871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769621287, "uuid": "55934761-92e4-42c1-a472-1d4ff4b7f4c8", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621287, "uuid": "725a5925-1cde-4fc6-9707-0fc8fc3a32d4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0241de80-fc88-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769632153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632153, "uuid": "346deb34-9e9a-4aa4-ae95-df754bf6aa23", "comment": "Malware payload (Mirai)", "value": "3558ddb8f56a667f1e1c286cacc77249", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632153, "uuid": "14ea99ca-474d-40dc-b2e2-33ebfd3cc4b0", "comment": "Malware payload (Mirai)", "value": "e4bdb7c0f9861b8ecb15631e39d2d07523a214ff7b683dd558115cf75db804ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632153, "uuid": "658fa141-f967-43c7-a720-1201e594b92d", "comment": "Malware payload (Mirai)", "value": "8736efa262bde59ef64a1af9cfb8b88b5efd7b82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632153, "uuid": "d372c274-2d06-4474-a2c4-7afc86d6c219", "comment": "Malware payload (Mirai)", "value": "8526d94bcdb82f489e10af7309a222374df919ee96b1571f5d2db2dced29d22029b39a01a581afe89eebbf26d1018962", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632153, "uuid": "213391cb-e129-431a-9af7-e08392cf1f71", "value": "T11C83E942BD429F13C1C221F6FBAF059837166B79D6EB3242D931BFA023868DB1D67611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632153, "uuid": "068e24b5-294b-4aeb-8565-1df2147247e3", "value": "1536:3KDLhQ3BlLywjmConIxqPON/6mKBJw342nKPrbdtGwEgvWj0AnqDfkna:3KDqXjmConIxq2N6mK+nwrbdzAqgna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769632153, "uuid": "59ee0af6-0efd-41ea-8168-c5fa5ed16acb", "value": 87436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769632153, "uuid": "2e7be2f4-e4f2-450d-9386-0b2a2530495d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632153, "uuid": "d8f3d223-d50b-4da4-9f3f-cc8a03337b49", "value": "manji.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56e2196-fc3b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769599409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599409, "uuid": "9ec870e8-8230-4403-8695-d4de04cdf063", "comment": "Malware payload (Mirai)", "value": "2029ad91d728ba04737e8f491cbe07a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599409, "uuid": "b62695cf-6bb8-45b3-839f-ed14f43981b4", "comment": "Malware payload (Mirai)", "value": "e5223faab1dd8f3a7bbf4739935b5c5460489bfce96ac36bef86a8d2435a900e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599409, "uuid": "150b241d-8dfe-4143-b48b-ea1ef2084991", "comment": "Malware payload (Mirai)", "value": "31bb4bbc77601a63603b69565bcdce3cf910a74a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599409, "uuid": "8d4e00cf-a839-486c-9282-efdd314b19d0", "comment": "Malware payload (Mirai)", "value": "80d4e2a9dbf12dd22c690883b287c4907cbca8ca675ec6eb4efa6cde0bbb056e33226e19afc0c512e3456ad72c0b975f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599409, "uuid": "6e731f76-486f-48c1-b089-e8c6fb5f2dff", "value": "T14983188ABCC5C702C5F0A1B6BB1F519E371643A8E3E6B107CD19AF29674F8670A37251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599409, "uuid": "cc94ca94-02b1-409a-96c8-7c62fc46214b", "value": "1536:7x0tFhbeQa/116XjtqK4vdbhUDDthx2ZpMF5zTX46bDAEAX:7xqFhiQo6jy1bgthx8MF5XX46bDNAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769599409, "uuid": "71bd2438-3a81-4118-97d2-0c1974bb4d46", "value": 88564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769599409, "uuid": "eac0ff40-2463-494c-ad29-8310273e99b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599409, "uuid": "0a2db466-3a22-4702-a178-3a5287d84139", "value": "zerarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "543f6b59-fc3e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769600508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600508, "uuid": "bbe998f3-7e41-4dcc-b48f-df6a40894aca", "comment": "Malware payload (Mirai)", "value": "75d61ca00ac70fd8e2dba1b50f22cf53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600508, "uuid": "37c55e1a-ebfd-428d-809c-619290ccfe46", "comment": "Malware payload (Mirai)", "value": "e5262eac8fedacf3c8b87473350cde7d0b31be8892f6fdef6d0f311ff0af7d0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600508, "uuid": "6ab42e29-483f-41a9-9f55-e431f916aeca", "comment": "Malware payload (Mirai)", "value": "4f4f6f3c3bf2216f03f899fa3aad6eb5fbaef152", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600508, "uuid": "6f869eab-7d80-41dc-a524-345e8fd48b0e", "comment": "Malware payload (Mirai)", "value": "8445d01454ff455021f3ecac00a403da7b372d865bec69dbac1f5aace8038018ad9f17986416a6ea0728ad84b8fec005", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600508, "uuid": "7cd55505-0662-4585-b23b-e8c90baeae15", "value": "T1A083185ABD819B11D5D525BAFF0E518933035BBCE3FA72029D246B2513CB92B0F3B902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600508, "uuid": "66539b45-aede-4b00-8365-c2b01dcc31f4", "value": "1536:Kpn7zwJBBA/sdepeH0UI6HOwmT8Vibau0P8eYrmBll01giPPqTsbZYY2XZ05:hBBA/O+eBHnibau0P8eYP1RPqTsbuZXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769600508, "uuid": "247f239c-41e0-46a6-8b14-543abf423e88", "value": 83492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769600508, "uuid": "4254e59a-384e-4bfb-bd8b-817f8d6d980d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600508, "uuid": "e3d9fc41-ef34-43d2-8ccd-ecf1155604f9", "value": "nabarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09877c87-fc37-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1769597376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769597376, "uuid": "8481bb38-f982-4fea-b489-013b0694dd6f", "comment": "Malware payload (AsyncRAT)", "value": "83608f1d6b9658388033b29439319dbf", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769597376, "uuid": "994b7720-5a7f-4e64-b72f-697dc652dc9e", "comment": "Malware payload (AsyncRAT)", "value": "e64ea1919733003e81ccf173f4cb27b02206602ccc21dabed13d6a8e9a62f838", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769597376, "uuid": "47b48ae1-116a-4f29-b2d7-f917447f4562", "comment": "Malware payload (AsyncRAT)", "value": "a0363a95de5121d94f1856c94cecf3290ffa983f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769597376, "uuid": "f4435203-85ff-4c45-b60a-ed8b5e317f48", "comment": "Malware payload (AsyncRAT)", "value": "c4859ea95a474cb7de410382bac98e1269680f7616bb60284f2235dcb6b65228e608e111397d27aa5e0747cb29786119", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769597376, "uuid": "dc50b535-912d-4a5c-8dcf-51a43b7d0eff", "value": "T14023D68CBBE50129D1BF5AB12D736209C7B079939506C60FACD442DB3B27B984691EF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769597376, "uuid": "b9d03e50-54d2-4f03-93ee-e95319f0fcf8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769597376, "uuid": "ddc37d85-b3a6-4cb4-8027-ab7f261fa995", "value": "1536:9dR6ClZnxQyD0bt3lUbtZNE2lt9e1OE4:9dwClIOMtVUbtZNNe1OR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769597376, "uuid": "192aec16-13c8-4d72-bff3-c9b76904c0e2", "value": 49664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769597376, "uuid": "024f5fae-8b77-4b31-a045-6e8870b92f1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769597376, "uuid": "493f828d-3667-4117-b562-391a63d6a3cf", "value": "Arcane.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b3936a2-fbdd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769558939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769558939, "uuid": "28d13a53-23c4-4496-bc28-d35e733d1e75", "comment": "Malware payload (Mirai)", "value": "cd2efdf3cb9e0dfa6b80c78256675aa6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769558939, "uuid": "2684f1e6-772e-4459-982c-0bcc1549a8b0", "comment": "Malware payload (Mirai)", "value": "e688a154c237e0771fd484e7a359961a6001d19c64586878ceaef3f582fd2be8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769558939, "uuid": "09c6e4d2-47d1-4672-9481-deaa745c7854", "comment": "Malware payload (Mirai)", "value": "170e42d9a8be569aeb27e4ecb128449d0a372f5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769558939, "uuid": "fe83e573-d0e0-438b-8d92-d233f55d16e1", "comment": "Malware payload (Mirai)", "value": "3fde20c22844473690a291ae7de7dab89323dcc43075a086842ddbac2a5ed1c8557f20df3adbfbce656be31ad1464598", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769558939, "uuid": "f6a01ae1-59cf-46c4-bf93-95f8a6f24645", "value": "T16153AFB5C5A8BD98CF698278B61498389723910555E33DFAE781C7A6D00BEECF04C7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769558939, "uuid": "de17d801-e41d-4bad-9a39-9bc8e524cef6", "value": "1536:7aK/iivQhuniwt4gVuNosja1Rpeycfs3QtLok1cY3CJQax:7rqiBiOVia1RGf+Kn1cY3wx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769558939, "uuid": "5eb47403-514c-4841-8dd8-c5d2fe74a74a", "value": 64348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769558939, "uuid": "3d9068ae-030a-4acf-af15-8261ff69d196", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769558939, "uuid": "dc6ad389-b4c0-4888-9340-aa906c385e31", "value": "xd.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51474cef-fc44-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769603080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603080, "uuid": "d45619ce-e9a4-4680-9766-bd26ef19f973", "comment": "Malware payload (Mirai)", "value": "f08032ed0921375f79bea7ef36d55299", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603080, "uuid": "d618f209-0d72-4df5-bf6c-dff3205748c5", "comment": "Malware payload (Mirai)", "value": "e6c447a89a4f91a32aadc22adbb8f4c21d2efe196165071eab5b9f9c7ec75e23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603080, "uuid": "f82070a6-4fb0-4264-b27f-24fb8e995d55", "comment": "Malware payload (Mirai)", "value": "2c4111375faf8e682ca058e8531c2a4faeb2165d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603080, "uuid": "8c6d9f30-bf0f-4568-bfee-6df2fabe9668", "comment": "Malware payload (Mirai)", "value": "2f8f8eb8410582cf124bedc8fa9ad182a3434fc6e5bceb9f0ec712f0e00c7d613f18d364ed270ff513b5bbf7a7b2614f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603080, "uuid": "133cb02d-b288-4005-b1bc-4cc26b84e78e", "value": "T18BD35A72E8266E68C661C474B0A4AF752F53A1C082435FBA2AB3C6755493CCDF905FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603080, "uuid": "f1fc73ce-a534-4029-a3dd-b27907822791", "value": "3072:9trQFjKOAd8VtOWIRcVE4uD3WvJ1mLkd1:9RQFjSeVlIRcVEFGvvekd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769603080, "uuid": "34ab5f05-021c-4b31-8f7c-796a9ed4b2a6", "value": 137924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769603080, "uuid": "ecb7cfc6-de16-4dc8-86aa-6dc67f61d203", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603080, "uuid": "1942e976-8986-4b54-b2bb-dff7c71754e5", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d0fcc3-fc3c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769599545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599545, "uuid": "9ac36b5b-7941-4fca-ab0c-7cf1ee4a6bf0", "comment": "Malware payload (Mirai)", "value": "9a112bf67b3df4341d5870bb4bc3236e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599545, "uuid": "9a0c45cf-ad28-4ec1-a7a9-1ee42c77635e", "comment": "Malware payload (Mirai)", "value": "e6f45ab9ea9c6728ad5977a6c4fff85b1558d431d86b1bc26ff1ccc5e4838c6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599545, "uuid": "f4ba959d-c370-4367-982d-42230be8a187", "comment": "Malware payload (Mirai)", "value": "5dfbf0f28481aeb2eb3807df879f35cd300217e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599545, "uuid": "800ef3dd-f4db-4c54-868f-1a58a5990055", "comment": "Malware payload (Mirai)", "value": "466bdfc197a89538e7201732028eb79a1bac154cf8781101f47cc1b4ff4c2085d212fd845c553a7f5840124aeb88c328", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599545, "uuid": "b6019d6c-c54f-4b59-a8e8-ced1143cc354", "value": "T1F2B31A89BC859B11D5C526BAFF0E518D33139BB8E3FA7113CE145B2A538E85B0B3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599545, "uuid": "76736ba7-5020-4fc5-abd9-f7f11f7d4fd1", "value": "3072:MrjL5x3mk4nEwHfhXswWteXKce4o4325XYt8lgDNT8M+ofSQX:TkGpXswWteXKrJXYt8lgDV8M+MS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769599545, "uuid": "dac9d605-65ef-4f4a-8992-16baebe81a7e", "value": 117728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769599545, "uuid": "5bc3eff2-ae7b-44bf-aba0-0e1b0ca43ee2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599545, "uuid": "d95bd91a-775b-4dc8-a5e1-4747df03a7c4", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e4c4296-fc65-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769617302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617302, "uuid": "61654d55-5433-4151-9bb7-e74ed5b00cb2", "comment": "Malware payload", "value": "7a30ec222c49598a2ea80ed989916ae2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617302, "uuid": "14d2b2c7-7a77-4321-bf66-be86b15f251c", "comment": "Malware payload", "value": "e89bea46bd05946a8873181e113efe1b6aa3eb6a25705df18b956a07903a7bc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617302, "uuid": "1317b69e-2bec-4158-84bb-23497b91719b", "comment": "Malware payload", "value": "ecfc7dd5b12ec3f72904db91ad04e2a16ae4150c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617302, "uuid": "14cb06c5-6116-493a-8ac4-c4f901de1de9", "comment": "Malware payload", "value": "8a15977ffaf7484f155d83ddcc945de6afb0d1d64a9c66ea60e81b989275e20b99e99249dad144f8bb0ed3c27f62a791", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617302, "uuid": "d3dac69e-e8a7-404f-b106-779d3c1e09d9", "value": "T1E5551A44FDCB14B2E5061E3248BBA1AF27319D094F30EBC7E940BF2DE977A954932259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617302, "uuid": "3994ae0f-a458-4e80-8290-6f15425b43ba", "value": "24576:LXnl/gWt10TcNR8Zew+3B/EDGoPXvTkCVFVI9Ozj5V6CsjW:LGlGCV0OHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769617302, "uuid": "f5ad6b46-47e2-40be-8dcf-dbc1e3350f2e", "value": 1397020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769617302, "uuid": "753d4719-e26b-44c4-a50e-62b4c37e441d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617302, "uuid": "4d4d2cb8-e101-410d-965a-62ad28c4f4b6", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "191c123e-fc3c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769599549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599549, "uuid": "372364d5-e14a-4cac-b68b-9e46577911a3", "comment": "Malware payload (Mirai)", "value": "c98dd976b59e944bfb61800f48c6d58f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599549, "uuid": "61123ef2-d4d3-4cf6-8c91-b1f332c542ac", "comment": "Malware payload (Mirai)", "value": "e916e50468ab757bd4f0fd560268b9f411031d8eeb0a47906fabc83a6bf890d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599549, "uuid": "2e2a6a37-c0b0-4474-872c-a4c716cea075", "comment": "Malware payload (Mirai)", "value": "57d626894129c35cecba5211fb48e2cdcf78491e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599549, "uuid": "ce150aef-65a5-44ec-aba9-fcce3ae23298", "comment": "Malware payload (Mirai)", "value": "f6e47814ac06e4792d7aa577370881816284c2b984b158f1b068662002eddb928feeece512d7a26b75cc1f63f69a2a8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599549, "uuid": "c6fdb324-39a9-450a-b5f9-477794be0218", "value": "T129837D16CC755DA8F07B6E7060F5C9BF4723A649A80F6CB63C538364401BA88F5A7BB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599549, "uuid": "25a7b9ff-1292-46af-98f5-b52921c5eb9f", "value": "1536:av4Vxi88Ek+usG0z1j6yOeSB1aOvjHdBbPCjvvZSMX:av6xvK+usGU1jyjBgKxBbP6vhJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769599549, "uuid": "9c04724d-3b38-4324-bb11-45460715cd5b", "value": 84180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769599549, "uuid": "cce9c85c-70e7-429d-b6f4-f07bf9e39b4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599549, "uuid": "0afe5ce0-bbed-4c4f-b19d-a9867764e4da", "value": "zersh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07dd85d7-fc28-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769590930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590930, "uuid": "0c654d60-2b12-498a-afef-e879c4a41880", "comment": "Malware payload", "value": "644a976a5f81a505620641da15e9560d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590930, "uuid": "7dae8ad4-f4ed-41d1-8766-afb1977daec4", "comment": "Malware payload", "value": "e989ac6cfd530b337a3dc09f23ba9cf098a728053d4dcf5a23cabf7935ce4293", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590930, "uuid": "6f18a049-5d33-4f81-9afe-75a65b7f01a3", "comment": "Malware payload", "value": "fa2666592c23c0aeca6fc835323023bb45f05ecd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590930, "uuid": "84da39ec-334a-4f0c-847a-11091140558b", "comment": "Malware payload", "value": "012a083a896187b786c2f569604c7b24e44c853ab5b8fd9ec76ee2b0113167145d6a8844d36e7cad7de9d26dc5b874a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590930, "uuid": "1fa6431c-ba8c-4a82-acb9-0662069171ac", "value": "T14683AF40E660D462ECB6C73620765E775EB3BD2AA8B0160F0B2C35247FB36D2951F927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590930, "uuid": "dd8ff258-5694-4198-9cc8-900eedd6fa57", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590930, "uuid": "cb26b960-b92a-4922-9c85-cd28d92282b1", "value": "1536:xT4HrN+noJHCq0Zs0s0DAVeu6TpisYX61zHRpndV8a:xTIN8ogtjDAVeu6TpisG6FHRpndVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769590930, "uuid": "e5a82b45-fb57-4186-ab28-f0d85e44927a", "value": 83840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769590930, "uuid": "1382d7ab-0634-4850-b293-632a2346a93f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590930, "uuid": "4a46e24c-f303-484b-9352-2b5c6e7e21ab", "value": "e989ac6cfd530b337a3dc09f23ba9cf098a728053d4dcf5a23cabf7935ce4293", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63507ed-fc8f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769635542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769635542, "uuid": "8fa77044-eb50-4381-bfd3-401378ccc67a", "comment": "Malware payload (Mirai)", "value": "79b9e48f8645162e961fa675c0f7ab31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769635542, "uuid": "5b6c17ce-1713-4bd4-b3be-b9284806e945", "comment": "Malware payload (Mirai)", "value": "e9d391bfc8a6960e9e68f9b9aa08b379ba0cde6d548f957f5e807a00412333d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769635542, "uuid": "552eff12-9032-4b5c-a8d1-150d9f5e9785", "comment": "Malware payload (Mirai)", "value": "c97df34b0093c74d0986fa512eae58766b67c36e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769635542, "uuid": "28b405f5-68b7-401e-817f-990d24666796", "comment": "Malware payload (Mirai)", "value": "9b48883e73773bf837d8d89eb17a68093ddef1f4f99514214cb2eeb4bd5f8c3bf42e1d11bd5a7a3f6ace002e4acd83db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769635542, "uuid": "268cc7f7-8bab-44d9-b619-d842a1401fff", "value": "T1E8B3289ABCC1C612C6E1A1B6FB1F518D371643B8E3EA7107DD186B29634B8970F3B611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769635542, "uuid": "0a5dde51-e22c-4af7-9ce2-929ec5dfaf6a", "value": "3072:3iqR5m6L51mDEyXR28cgPLUV3l+WVgntMGXr:HR06LbmDnXR28cE0+WVOt9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769635542, "uuid": "8ef58690-58fb-4bf1-83d8-03eea683fc62", "value": 112008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769635542, "uuid": "f023988b-2a43-4a9a-92ce-5d943caa5554", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769635542, "uuid": "404484d3-ac6b-4e1b-950f-d272f3363d6e", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c96b64-fc9c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769640809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640809, "uuid": "2aea1449-cdf8-4279-80b8-0c178db29eff", "comment": "Malware payload", "value": "c7b5bc2ffcd2876b01f441d1dcbd3c53", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640809, "uuid": "85a4d104-6805-4f12-9545-763d015718f3", "comment": "Malware payload", "value": "ea7705dc159cd87b413dccaa6c3e14eb5fed1186a771658228eabe34e3d34b00", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640809, "uuid": "b7648b1d-c05f-4ed4-adf9-430cd29a296c", "comment": "Malware payload", "value": "40d12c8c2727565ced5a4e3cbcfa01bb0246d05f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640809, "uuid": "4ec326cd-8e87-4f23-bcb7-792dd7db20c6", "comment": "Malware payload", "value": "304843a213b152b8c8ff83290b9366e44b01d48b5cf67a12bfa0fca4877d933911128a2f4df8b7f99f690c6c8e340a58", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769640809, "uuid": "369fc8c1-771b-42da-b114-b43802196c37", "value": "T1BA336333D410FE0601A1EE55A2799B04D672D97748AD6418B60C4E4D0FCA9EA3BBFF4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769640809, "uuid": "86d80c15-bda0-470c-bbe2-ce1bd229425c", "value": "1536:gcHg5AgywZIDFSD4zNq94AbluKlAGRhl0IGflOP:gbtN/qlK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769640809, "uuid": "98c7e59e-3daa-4d16-8e34-625fba88fcc7", "value": 55015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769640809, "uuid": "63e50803-643e-4b72-9f59-e64eba590a2d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769640809, "uuid": "9d86782a-75f0-43c1-a2b7-96863126de71", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd61047-fc63-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769616687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616687, "uuid": "833715b7-53e4-4b44-8623-8b22158c828c", "comment": "Malware payload (Mirai)", "value": "85cdd74b2de1258ecfb792176e569823", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616687, "uuid": "c0a81164-1ccd-4184-886f-2774dd551f8f", "comment": "Malware payload (Mirai)", "value": "eafddfa137118a0566a588a0529796fce03159d00ab7d3c3a5c0897412a01f81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616687, "uuid": "33b163d8-f8d8-4923-8c28-7488f9ca1eaa", "comment": "Malware payload (Mirai)", "value": "69f8ca4243b933ad4333f451f0d960ec8299c7e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616687, "uuid": "dd67e33e-40c7-4cf2-ab9b-55e576137b1a", "comment": "Malware payload (Mirai)", "value": "5e875f4dacd79d62c0cc710fceaa26bd2b7238a79ea7aeef000b2ae353113aeed3efd0617eecd80a7ad89ceb1e6a65ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616687, "uuid": "5d4b20c7-b0e2-46a3-95d2-72c1e179ccaa", "value": "T152E3875A6E228FAEF67C873147F74A20976D23D623E1D684D2ACC1141F6038E545FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616687, "uuid": "eb66c8ca-bd25-428c-bcc0-ed0eff490dcc", "value": "1536:p+bTcKot8sp2MKypYz8ZOfGQ+v3eB/hub8mXRCTUGk4onuftL4VxYdbK:pklybKpzEOfGQ+vEubTt4ouftL4kdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769616687, "uuid": "0cc9158b-f5ac-46b6-a323-7b0b9a5a0a9c", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769616687, "uuid": "dea360ac-ab29-480f-bd8a-6cb61519a70c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616687, "uuid": "abab514c-ead0-4971-9544-2d8ce6bd0151", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060e6160-fc7b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769626576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626576, "uuid": "1d984507-7111-496d-ae13-e5c803c1db74", "comment": "Malware payload", "value": "e6ae93ca8eb170175fea160b0f85ea88", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626576, "uuid": "0283a388-4db3-44b5-acd8-f0b5b6bb8c13", "comment": "Malware payload", "value": "eba62624838ce914ac259081ebf6d4d9c4c41b8cb499a4fe2dade0224a44e37a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626576, "uuid": "6cfb3381-748a-4481-aa31-c7d3d3d3091d", "comment": "Malware payload", "value": "9f1c772350e9b5353505816e5f46acffaff80b3d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769626576, "uuid": "7b8b4909-098b-4690-a613-78cbc4a6422e", "comment": "Malware payload", "value": "cf2814ed7a37253da8004d3b852c92a3b9ce13c06459d8f6b763566233ef224a9c70321f289e1911e353ec7d922d03cf", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626576, "uuid": "6ce2cafb-b0b7-4cbe-ba89-8d26211fe6eb", "value": "T1FAC2297E47E405FCE96A82F5DC306413C771F0572DF1568E42B2D896DF02A92AE2CB85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626576, "uuid": "d960a9cf-934d-4b2d-9e7d-14e2d02ade69", "value": "67b2e05b342c56b6c89451a62cc934be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626576, "uuid": "d3aa07f7-1024-4113-beba-d9c582af2252", "value": "768:5sNHi8ut4odAqJktWklJxk333zJFHAPph:ovut+2Gpejv4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769626576, "uuid": "a0ba565d-222a-4b8e-ae11-731162daf054", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769626576, "uuid": "b40bb085-25a1-40d0-993b-1f74023bbf21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769626576, "uuid": "bf0b427a-721f-400a-ae18-9c0de0cdb849", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "032ce8a1-fc45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769603378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603378, "uuid": "779380d9-628d-47a7-85e9-ec336d9bb6f8", "comment": "Malware payload (Mirai)", "value": "5e033b1a52f3a6e202b9d83308f07e9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603378, "uuid": "d8daa924-c5e0-4b10-8cd2-a61e749f4084", "comment": "Malware payload (Mirai)", "value": "ecee60d2dff027d87aa5be6aacd5035ff358fa6af923cec5a53bbd26aae268ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603378, "uuid": "ad9ea4c6-a03e-46da-89d5-e157ef746444", "comment": "Malware payload (Mirai)", "value": "34479f5b439671c6f7168045a13c3e205b681d8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603378, "uuid": "5b19600e-1680-4b3a-b7a5-662744c6a384", "comment": "Malware payload (Mirai)", "value": "37992270b6ca2d94ff25d290c8bf660134c305f555635d19d355e669e65f51e876933b2c72193820be624a168febc630", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603378, "uuid": "eeca3bfe-d775-4d1d-a1fa-95c5d30891ee", "value": "T1A2933AA6B410DC7EF45BA7F780070B16B121A3E54E426F27B62BBD23DE2E1741862D47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603378, "uuid": "69f2448a-c0d7-453b-a0ff-ce72760072e2", "value": "1536:W+seWJFcSXB740u951JbYMwURkQQOblfeUWhRK8ybdy:W+seINx74J9FbYMhS4bIUWhR+bdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769603378, "uuid": "7483691f-b1e5-4f5c-8125-a3b069e2df76", "value": 93588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769603378, "uuid": "f949aa26-7246-449d-bacf-0ea9d6197e0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603378, "uuid": "1dde633a-17fe-4774-acd0-f2d79bf82445", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4342442a-fc51-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769608639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608639, "uuid": "51da1ff6-537a-43ef-8401-c20693cb3e4a", "comment": "Malware payload (Mirai)", "value": "a27dd39f540a65b3fa850af229683422", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608639, "uuid": "a0917f56-99a2-43a4-bdad-5c223c72b396", "comment": "Malware payload (Mirai)", "value": "ed812f1ea95712e8d9047e40e11b16deef7d52b78fe9a0c518d2c1cc345a29e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608639, "uuid": "a718e1a5-c3d1-46f3-bf02-5be23205871a", "comment": "Malware payload (Mirai)", "value": "fac2df599e0db5511ff2fc4a42834512380536aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608639, "uuid": "00ff3893-7c31-4551-ac6c-8e9ddc82431c", "comment": "Malware payload (Mirai)", "value": "dc64fb6ae4c7adc7dd046aa1be9d7b07c1b97c94a0b9714b77dce907f9d140306327e565cfc53fffe4e662fadf93af5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608639, "uuid": "ccf350bf-0646-4894-a634-e6bd32137666", "value": "T1DCC2E1545272CE25F6179332774E0A6F42C2A8670FEC225C9A1FEDA1A2431F05D7EE89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608639, "uuid": "5e9e3d86-1e2e-49ed-acf3-47289552bd1d", "value": "768:LTZiQKRC+UoF/UR9CtdHZNRvHxkuRH5DAmVJc:PQdPN75N/kuxVAmg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769608639, "uuid": "fe2bc73d-4daa-4be1-9e9c-cb254f29b52f", "value": 28028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769608639, "uuid": "bcc35ffb-0850-4123-a32b-be1b82ddc0ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608639, "uuid": "626c4b6a-24fa-4926-87f2-9c5a2313a4e7", "value": "astro.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b661573c-fc84-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769630737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769630737, "uuid": "2d9fbfef-3e42-4169-b8d4-6264716f346c", "comment": "Malware payload (Mirai)", "value": "68d3261be34abfe0818a3bfb7e63e233", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769630737, "uuid": "12bbc3a5-31ba-49c6-85c6-cf18ea279fee", "comment": "Malware payload (Mirai)", "value": "ee34386ccf9cc8b88e42b15851eaa91f360f1a4ac4761fc5871b3eacb9b78c21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769630737, "uuid": "cc83740c-fcef-4232-afe7-7e537ebb85dc", "comment": "Malware payload (Mirai)", "value": "488589ea5643996c4c967e3251ac385f290c4539", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769630737, "uuid": "cfdb01c8-bf49-40ac-b37a-b32457056e51", "comment": "Malware payload (Mirai)", "value": "0b0eae48516165d5ac97f0ddbf18e290c83cb76f3f995db49c75d3f181b1131aba19ea54868d3611e742c581159f64b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769630737, "uuid": "5f7cc754-46f8-4d0c-9964-f4743a1eb16e", "value": "T14D935AC19683D4F5F80501B4713AF337A635CAB80138FEE6F7685932A8359A0B69A74D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769630737, "uuid": "7d6b1156-195b-43f2-9034-c5316846ee40", "value": "1536:IBafExfEmo/N7T8vfDKEssSt5t2Rmz20qAClEnb/cCYYvN6+shXDOsJpDP6vkRP4:IsMMb17T+uOO5imzjxClKbECYYvN6+oI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769630737, "uuid": "cc8eebbe-ecfc-4794-8287-49e0b1155c3a", "value": 97088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769630737, "uuid": "84b05b60-2654-4af1-b440-64abfe23f760", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769630737, "uuid": "f1332afb-4bcf-4e32-a7d4-18ffd5e34d16", "value": "jklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a61a2951-fc91-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769636293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636293, "uuid": "d497cb59-10d9-449f-8ef5-824e04d1c552", "comment": "Malware payload", "value": "a2fc68eba31e043b51810bb4d2442f04", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636293, "uuid": "34dfd22f-e5a3-4d10-a4ee-594fe5dce883", "comment": "Malware payload", "value": "ee9b9ef4772dee8c19067f699339f0ce109fb36b653731cb99cc2552301cddcb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636293, "uuid": "e1ffdabc-98fa-49c9-a56a-ab68a9d042d2", "comment": "Malware payload", "value": "32fea06143b233fc7a48a436c587368ea3b1cb4e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769636293, "uuid": "6f8c9dec-0d55-466e-97cd-f3959c74f48b", "comment": "Malware payload", "value": "2fad8462a089289d159fa50ebcb5e2961ec823cf25fd7560cf09cf127bc8e0a883c7099df2486f0e57653d269a9bc989", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636293, "uuid": "7d77cc2d-3c9d-4237-aafd-881a78906251", "value": "T1CE336333D410FE0641A1EE55A2799B04D672D97748AC6418B60C4E4D0FCA9EA3BBFF4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636293, "uuid": "d92a4fa3-0e77-41c5-8889-ae1943eed882", "value": "1536:CcHg5Ajyw5IDFSD4zNq94AbluKlAGRhl0IGFO1kA:CytN/EOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769636293, "uuid": "a5c9dbdc-380d-4f3f-b273-e7cb1640e03c", "value": 55045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769636293, "uuid": "556824f8-8984-4199-97b9-e8c32ae0612c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769636293, "uuid": "b6488a1b-0975-476f-9465-c9f3f4331766", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "103d1c1f-fc72-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1769622727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622727, "uuid": "cdced8f1-9211-4480-8cde-87c1ad1bf10b", "comment": "Malware payload (GCleaner)", "value": "3363371af3e5f5960c924990bac5a118", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622727, "uuid": "20d1b1ec-acae-4a53-8e8a-948c887c0de0", "comment": "Malware payload (GCleaner)", "value": "ef8434880831d47bb37b066eadecd6f702eeea9ebabf05cd12df94024397dc1f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622727, "uuid": "260bc39c-bcae-41e1-a57b-ca080b63a1e1", "comment": "Malware payload (GCleaner)", "value": "0bbd1e0431be11360db29d1bd4c82cd4668dbe4e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769622727, "uuid": "b0079715-0087-4bce-bbd0-be4607dce5a4", "comment": "Malware payload (GCleaner)", "value": "ecd53d80a2c32cd2d5a21ccb58eaf1859d956ecf9c3f5de2b61b02430020bd27e402c85f26be6a3e608a31c0162b5041", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769622727, "uuid": "7385113f-f521-4d25-afd4-cea4e86c000a", "value": "T1F9058E22F171903BD2279B785C6F866F54267D152938986A37E93DCCCF367C2242728B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769622727, "uuid": "17f41787-8f06-4c48-8c26-7131550d17f3", "value": "421f57ebeade5946b16f0c3c541d2697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769622727, "uuid": "eec2b43d-e003-4916-8028-68efe2b67211", "value": "12288:a9eONBtJzhKJd6EPXNQyxbLSoGZ87ig6zIQN5uG:wnzz04EGOzs8mrIQz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769622727, "uuid": "f9a52ec0-309e-4f38-97af-3e1e55362acc", "value": 811520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769622727, "uuid": "9d1975f7-a7d6-40d7-a794-5b801fce756e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769622727, "uuid": "cf73c4f0-3e40-4401-9384-4625adeb0c48", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49905751-fc2b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769592329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769592329, "uuid": "368405a7-7ad6-4958-84d6-e5d014834874", "comment": "Malware payload", "value": "7139e6a5e90c571af3669c6fedc8d40b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769592329, "uuid": "977c49ea-8daa-4835-ab52-925e79349ee8", "comment": "Malware payload", "value": "efc979b161960358c82b92e01e133b82d40b8daace58d6b78e9193d4801165d6", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769592329, "uuid": "966767a9-d407-4787-898b-f22d2d041a6a", "comment": "Malware payload", "value": "678ecad21eb3cfdf6f670bca1c1900e1888993f4", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769592329, "uuid": "24546256-0ca0-499d-81fe-1e175503d96a", "comment": "Malware payload", "value": "9d153695ed20f2e1b3a386fe2baed626b2faf4714c372e7e56c987450e3bdb4403f1300b6415fa9ceed94be5d21133b0", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769592329, "uuid": "ef525e0e-6cfc-4707-a45d-aefcdc35af3f", "value": "T193E4B687F1208AC7F84FDABE145042106EF0E4704607F2561B6E896B2FEB9CC9E557E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769592329, "uuid": "d54d99d2-524e-41e4-964f-856ceca71f5e", "value": "6144:d1eMX5Uh/W94gpr2TkPjhMoQSgSZOeOZHe7mUWwjLBwf4PUoPHss/1ip3x1Zwp:dti3Ulzz3/1Ew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769592329, "uuid": "63c09a32-a570-4a71-bc71-103161900b83", "value": 688783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769592329, "uuid": "a527ffeb-7e20-4163-9a49-00af481444f4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769592329, "uuid": "77bbcf1e-f26d-4cf1-b9a4-454f0fdd43b6", "value": "Gamble-rig.1.21+.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4249cb09-fc6f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769621523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621523, "uuid": "b66b1c93-cc8e-4319-9b20-2ef4bcda2bc8", "comment": "Malware payload (Mirai)", "value": "f5ff72995c9e6d898748cffdbe1955ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621523, "uuid": "f165115a-7592-4daa-b4dc-c5ff460eeb72", "comment": "Malware payload (Mirai)", "value": "f0d915be65444a278563c7ae7624bb7750a3d43c354dae0736b3f2ab999f25da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621523, "uuid": "5d86a931-725c-473d-ad1e-97ce919ca005", "comment": "Malware payload (Mirai)", "value": "bb92548e528c5fcd71f42c6f12e5bfe6f68d4902", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769621523, "uuid": "58d84070-632c-494b-9a7e-8d17b5d31deb", "comment": "Malware payload (Mirai)", "value": "484c5ecf43ff6cfd5b23b9eb6b6d4d62457a3e7e0e00c1eef26fa0e8187a358e492c6a48f81a17a6b6b69b20ace476e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621523, "uuid": "2bb8c27b-53d3-42b0-8d3a-2c9513a55c58", "value": "T100034B278976AB1BC6D4737701D783A1D0FB1B842244171FBD0B4C9EFEB53406AA6786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621523, "uuid": "5a9237f0-76e6-4430-aaf0-fc2bef4b3a2c", "value": "768:fLSz11m9Ef50F1b5uHqWJe5HIQ51JG/gm:fLSjJ50F1b5uHqWI5HIQ51Jfm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769621523, "uuid": "1a20c800-bf49-4952-90ca-d587f902464f", "value": 38548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769621523, "uuid": "16a85772-1129-4ef9-8712-5e6c5b068d66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769621523, "uuid": "a1c7b203-b6e8-4351-be99-784127a8333c", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39caca90-fc96-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769638259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769638259, "uuid": "75e03d02-eb3f-4261-ae23-f48e24918011", "comment": "Malware payload (Mirai)", "value": "db6aedd7e2fc6c9057b58cf2e12fafb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769638259, "uuid": "6518c7ee-34a0-4705-a273-98260ab57cf0", "comment": "Malware payload (Mirai)", "value": "f0e0387bed32f3c9300581213c11fce811f3cc3549f6522a012ab48229b1561e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769638259, "uuid": "282aca5b-ea20-4ce8-a9bb-aa2e14848cd0", "comment": "Malware payload (Mirai)", "value": "0e2739e2f8c619c253c96d9315255d1e0f81d413", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769638259, "uuid": "0ed4e60b-7682-408d-b522-99dca492240e", "comment": "Malware payload (Mirai)", "value": "62b440d087aac0ca3902d08c31c2ccf43fb02cfa7497d62e3c739bd18743f358227fe345a2151d402ee10bcb72284838", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769638259, "uuid": "92ce11d3-e37b-4d68-b331-068f50b2319f", "value": "T178536CC5AA83D4F2FC5602B46137A7375732E93A106BFB89D7B89931FC21501E612B1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769638259, "uuid": "ca616f77-34f9-4da2-a70d-e2147a4b3744", "value": "1536:vvr8NXlU8fE6jK7jSNr1MNv3LjXSiZq5qcI:vvr8b7fKjaro/XXQqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769638259, "uuid": "3c94b5b9-eb4f-4e5d-b520-81ff421889b5", "value": 62944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769638259, "uuid": "90f3a087-92a5-4dfb-bdfb-8aa92fa1219f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769638259, "uuid": "578422f6-ef15-42b4-9902-9f60d14616c6", "value": "nabx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6929fed8-fc54-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1769609992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769609992, "uuid": "b38ad57e-627c-4427-bec2-b5987c92937d", "comment": "Malware payload (RemcosRAT)", "value": "633f25ba9a6cda75f5f95e975af0e54d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769609992, "uuid": "1f3c2014-f92b-486b-9865-acccaf56a09e", "comment": "Malware payload (RemcosRAT)", "value": "f0f409e372e6fc383f774add244e70c78664fce633b9b7e1577c9806122cb770", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769609992, "uuid": "f78d715b-ea1b-4910-9602-28f833cd9cbb", "comment": "Malware payload (RemcosRAT)", "value": "795a932e29cd0f5bfe3b47642cd66c125fdc2842", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769609992, "uuid": "5d761d6d-211d-4036-b753-b02dce47b3fc", "comment": "Malware payload (RemcosRAT)", "value": "47317b668af21fb954d3713b269d3d1c95d2d1bc28c2d54984a5374620d9554cc01f1161760d86b92f2ae29d7d97241d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769609992, "uuid": "97008e7f-758c-45c7-a820-75bcc20257a3", "value": "T1FE4522553198D823D9A25BF11972C13987F06E9EF902C3C2AED13E9FB6B97884314393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769609992, "uuid": "e35e6c47-284c-44e5-bcc9-10ab940801f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769609992, "uuid": "1e5ee1e4-0e0d-4248-8ddc-4bd7e8618c3a", "value": "24576:f4aHACzOT3GKetpLxmn34DcTsbGNcnQRrv3z1Qbleg02YBIBp12Jvr6:gag0OeBxZ1bGqU1QR0ng+JD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769609992, "uuid": "ce6abd58-6f82-468c-846e-e627764d52e6", "value": 1191944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769609992, "uuid": "0d978ffd-50b7-4706-a701-12883455f0c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769609992, "uuid": "08aceeff-d410-437b-9d0e-bce25257cd32", "value": "Siparis 1026013 1038_Cihaz Koruyucu K\u00f6p\u00fck 50 nolu kalem Xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92e9f8c6-fc78-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769625523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769625523, "uuid": "97d22195-56eb-4adf-8af7-9b119cec590b", "comment": "Malware payload (Mirai)", "value": "3587ac93008256b75a998792dd39039b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769625523, "uuid": "e4b52c46-3ce5-4607-a9a5-3e93455a7d1d", "comment": "Malware payload (Mirai)", "value": "f1fde2d37ecd97f519adc1a5ef558153c3d16ff0c6a9e8183b16652711f9120b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769625523, "uuid": "434fbb98-7849-4e2a-bc94-7edc49abfc29", "comment": "Malware payload (Mirai)", "value": "373743fefb8dfe2e01c5bf718a40310e9738e822", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769625523, "uuid": "0e6760f5-3f89-4f05-9217-6de743cea248", "comment": "Malware payload (Mirai)", "value": "13ebaaca3a347fd7bf2db68b90db3a824083452cd499eb97f447a34c0b76a4a2787cda2bd2397eeafe73abf2281d1f42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769625523, "uuid": "01faf826-9c5c-4b51-8e44-6ac755268a0b", "value": "T1DDD35B77CC266F58D525E5B1F0318F791B93A95081872FBA19A7C6B88083D8DF6063F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769625523, "uuid": "548512dc-9a17-44ce-aeaf-ac348ede9ae7", "value": "3072:T7GWR66nPB8lv7psoAzpyqpMBW/tBB3Y4G:XGWR6i857psF9MMVBy4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769625523, "uuid": "022b5aea-858c-4acf-9b2e-f0a5c0bee980", "value": 138012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769625523, "uuid": "1e91d1d6-3827-4c33-a35d-cff19e103ea4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769625523, "uuid": "daf44ccb-8c53-4661-8aa1-8c80d2f60d00", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec0188e-fc87-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769632147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632147, "uuid": "ef1e2aeb-f015-4f9f-8b53-3e0ac5aa7c9e", "comment": "Malware payload (Mirai)", "value": "545f80ed8d875d48984d86da77d4a5aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632147, "uuid": "b7d92c1d-c93d-4663-a1c7-16325f41e6a3", "comment": "Malware payload (Mirai)", "value": "f279ea27827b6cd3cfe9007fcd061f4a137d3ee07fa175a6225a7d9e156e93bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632147, "uuid": "f09131fb-ea56-4fe5-9ec3-715d4939e578", "comment": "Malware payload (Mirai)", "value": "4d3da7bf7a3acd756209867479cf51e8f3444888", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632147, "uuid": "138e9e2e-4e5d-4879-9c5e-7f12429475c8", "comment": "Malware payload (Mirai)", "value": "c9669b971ca9f9cf28fc917d5c76f08ad37c8a5102b03900bfeb104e88da0cb453d127e9601e744023c6b5cc4cfcbb72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632147, "uuid": "037f6a53-b71e-4028-a2d9-d7f1915c6c95", "value": "T100832A037942C6FFC09BD1F407EB663A8822B87E1936B1E573E0FE522A49DD16E19710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632147, "uuid": "338a79ee-1a6b-48ca-a630-ee8d5691cbdd", "value": "1536:JvvVSMA1b8od48VfIPAzeXASB+jGiFrFghQiDcjp+URvI1F11Bg13AWQUxJgP2E3:BVbyb81+aAaXT+jGi5FghQVjp+x1F11J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769632147, "uuid": "38187892-2b5e-4476-b369-05d2d0e4b4c9", "value": 83048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769632147, "uuid": "93b5cfee-f042-4114-bb11-33c32a852a3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632147, "uuid": "eeaf69a7-be62-4125-86b1-be99b2d7e98e", "value": "manji.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c163581d-fc6b-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1769620018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769620018, "uuid": "fdb5ff74-3ed3-4e3b-839d-e0e6c1e6077e", "comment": "Malware payload (GCleaner)", "value": "d2e67e454bca7683d646e20449b281f9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769620018, "uuid": "0f8a41ee-1f67-4e5f-ad60-5e3f01bbfb22", "comment": "Malware payload (GCleaner)", "value": "f2d254433fcbde36e81393d6955a8de5663ded648aba5c3d9c47deb370c0ca74", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769620018, "uuid": "9c465bb2-cdc8-4b69-8a2d-a49e54c0de06", "comment": "Malware payload (GCleaner)", "value": "7595b1e0abdc0dfeed3c070d9b67261720579200", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769620018, "uuid": "396062e8-063a-4861-b0de-a3996dcced55", "comment": "Malware payload (GCleaner)", "value": "a6394b1ec8115124cdf586f0984276f9e91fb80dee9a2b0d9515de983d10512d761660d52b42a9368a741fb9f4e9c048", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769620018, "uuid": "d99d0aab-15a5-45e9-9413-93bf2f0d753b", "value": "T129F48E22F1B68037E0231F795F7BA66CDC367E112938985A37E92DC85F7534324262A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769620018, "uuid": "f2130e38-dd79-4599-83d6-b03262ab2509", "value": "421f57ebeade5946b16f0c3c541d2697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769620018, "uuid": "711f14f0-e754-4b01-b577-471e9c923fb7", "value": "12288:f9eONBtJzhKJd6EPXNQyxbLSo0Zz9agRfd1Y4gYyG:vnzz04EGOzaz/Zd1vf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769620018, "uuid": "f2a0b09b-b8db-4f35-ad32-750352469190", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769620018, "uuid": "c0b9b5cc-b4e1-41f5-b56c-93b622740bb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769620018, "uuid": "99cb46e9-493c-43d3-94ce-5c6dcf23db06", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff9ccd7-fc76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769624472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769624472, "uuid": "b385a879-2523-462b-b768-bacb8f1d435e", "comment": "Malware payload (Mirai)", "value": "8701fc73fb3527b49dbbb391ddda46f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769624472, "uuid": "f08247b4-4dbd-4255-99f1-44eadc2a689e", "comment": "Malware payload (Mirai)", "value": "f3616b5ccb6459270ba9e7cfaec30c78b6d44e491d0f40bcc2f532ed7eb8036c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769624472, "uuid": "2bb6a7ff-7b19-4011-a47d-e68b8641a062", "comment": "Malware payload (Mirai)", "value": "eac8999e23e7ecfa731fc4a556451add1307c399", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769624472, "uuid": "47e9c478-ecf4-4168-916f-8aee56da6ec0", "comment": "Malware payload (Mirai)", "value": "07d3c18bd901c1d1ee47a7dacea5c0a57607c1b71dab73d52518a51e87b52060f784cb0dc70dae778b53eb6abfe81ac6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769624472, "uuid": "b5d6c26d-786c-4f76-886c-523b17935572", "value": "T1C872CF6527E83E32E73094734A7C48CA61DE1FFC96A931762074C958E640519B2F8BD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769624472, "uuid": "89b75d88-3f4e-476b-9793-8eee8a6a23ce", "value": "384:OMuv2LnYA6tTNCDxNNeCTkBh+hYacKkr6bBzhymdGUop5huBlD:IesA6ONnTeh1acOs3UozMBlD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769624472, "uuid": "8255821b-11e2-4538-ba3a-84c0f7c4e381", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769624472, "uuid": "9cf55a22-75e0-4794-a8e7-fd864b2510de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769624472, "uuid": "7251311f-73dc-443e-8a7e-2b5f2b2916ac", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1d4f2d-fc65-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769617189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617189, "uuid": "0faab303-499b-4511-9d14-ae8e7f4c3c05", "comment": "Malware payload (Mirai)", "value": "580389a3aa1e01426ab486539b322db1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617189, "uuid": "13f7b358-478a-4557-a175-3abf220f2feb", "comment": "Malware payload (Mirai)", "value": "f3efb7cce1a052d62d2c6b43225e7773de4b7dd4f829bb6fa928037f7c1acc84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617189, "uuid": "376cce49-f357-4957-ba49-2052124fece6", "comment": "Malware payload (Mirai)", "value": "300053cf5cfbe54cd793692d237bd323b73061ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617189, "uuid": "9c5a1242-d178-4abb-be9e-793b111ad98b", "comment": "Malware payload (Mirai)", "value": "3d7b2302c5544d115b25e6fb5d9c7c8505bb70e4e5aeae668c7f80fdde26a6e5ab6178f075468b52e89fc7db81eddf00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617189, "uuid": "864971a0-d6ef-42a9-b367-935abaf24d67", "value": "T1AC432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617189, "uuid": "f35d65fb-cb9c-49f9-ab1b-6d598f1a29e0", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwz:RqtmZPuutfbltZFBSJsBcfDSTFI+BEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769617189, "uuid": "dc046293-422e-4597-a565-84a155bcd40e", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769617189, "uuid": "3f997ec0-6b03-4e84-ab2f-8fe92adf9089", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617189, "uuid": "52f199a0-227d-4d5d-adfc-d25ce97384b0", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d12f7d25-fc9d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769641519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641519, "uuid": "9cf52da2-1744-4973-bb29-3980d39d315a", "comment": "Malware payload (Mirai)", "value": "942acbc04beb8c804b6ee94c3a95bef7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641519, "uuid": "e99b0597-65d9-48cd-938b-0e1150175f1f", "comment": "Malware payload (Mirai)", "value": "f471f2a42ec508d5d23a3516f1d22c28343a756afa44b62b7c72f72d67231586", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641519, "uuid": "5a01a98a-0f67-4fe0-a67d-0b18e2a02faa", "comment": "Malware payload (Mirai)", "value": "d96afa5efe9d78817fdb4a1efdb8d0a356bb1241", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769641519, "uuid": "063d86a5-a616-47e6-93ae-0c8bc4a95125", "comment": "Malware payload (Mirai)", "value": "f76a9f39d742bec38de4073eaafab23a6daa50b792780f30e7bceeacf764f9f5366a655e00b4a989a018678bce9f242b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769641519, "uuid": "0af867c8-d8b4-4b38-bb2e-6ef3296b511a", "value": "T11DD3190ABF711EBBE46FDD3306AA0749389C555622B93B757674D81CF21A28F09E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769641519, "uuid": "e98cf5c6-1a4e-4204-97f3-cee5cb515eca", "value": "3072:ybIQ9OhNoIrTUcEAP/onrjq7/qzNerXs:ybIQsh+CT8tru7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769641519, "uuid": "37bb162f-096d-4190-bf92-74276ec47dda", "value": 142316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769641519, "uuid": "08b31e88-bc25-4b1f-ad2b-6eb224bcf86d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769641519, "uuid": "fdec0442-da43-48df-88b9-74453f736e46", "value": "splmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb8ba47-fc65-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769617433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617433, "uuid": "7fa2a995-b708-4872-aef1-f792212d3a3b", "comment": "Malware payload (Mirai)", "value": "7fdee46e1cfebf18d765bdd9b9378935", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617433, "uuid": "fda441f1-e220-4c46-8ed8-e846e9efb63c", "comment": "Malware payload (Mirai)", "value": "f4ea096cb602713373ed5ec4ef9697252c7ab67f55b19bf5070bf188cd1e0246", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617433, "uuid": "9c9eefe5-4245-429c-8836-a953c1ddbe1d", "comment": "Malware payload (Mirai)", "value": "46fce9cac85b408808d08b67e9829209acf566a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617433, "uuid": "1d2c5afd-1331-41fc-bacd-fb647bf0462d", "comment": "Malware payload (Mirai)", "value": "8fdf746e99006aeb75106108454f5630f413b7ed83ff79532d19c82be575125a06889105414db742f927496f60ca6108", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617433, "uuid": "ce244a0f-fd33-4ec2-90b9-bbce0bd0fabf", "value": "T179F36B07B9C0D0FDC8DAC2B44BAFA126DA32F44A5134725F27C86E262F5DF216B2D650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617433, "uuid": "216d92df-1684-4e2a-ae36-4b84ea78cdff", "value": "3072:BGU3AxZaj9dEou1RNM1t1vSfYpl+Hph7KPWCPNpzoKdE:j3AQZX6/JavTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769617433, "uuid": "3549929b-1132-48d2-8a67-40e095a21c5e", "value": 159792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769617433, "uuid": "47047a33-8f9a-492d-ba5f-e5de68991729", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617433, "uuid": "c1de9bb9-5828-4eae-bfa3-6ed8c568065e", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e29722b-fc42-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769602135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602135, "uuid": "f434da3e-00ee-403d-aa58-f399515eef16", "comment": "Malware payload (Mirai)", "value": "39ebcc3f3fc1ee8d51db83fe607b3cd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602135, "uuid": "8769e0e9-3eba-4459-873b-7dcc9281b398", "comment": "Malware payload (Mirai)", "value": "f5d478f729a32196fd61e2ee6a1bf746ccdcd55d3099359ccb1c2ad10e163782", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602135, "uuid": "1ddfa1c6-def9-424e-a28c-1171d34cd315", "comment": "Malware payload (Mirai)", "value": "90ec9af17e6b66b2e7c1b6d5ca2422842c491784", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602135, "uuid": "5ae5c341-ebba-4b4f-98b6-111b9902eb48", "comment": "Malware payload (Mirai)", "value": "68634ae47bca2d144b6fe5a7eedba2e8e95539daedfb896ab2c88347e9282654de6667013ee0eeca69a1a82826df5690", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602135, "uuid": "0c807da0-4d84-4551-b921-984d49d4a66c", "value": "T1A3F31B46F8814F15C5D111BEFE1D228E37231BB8E2DE72129D205F747B8A9AB0D3BA15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602135, "uuid": "fa34754b-b472-4ca6-8fd0-9a3555268e99", "value": "3072:NhYSE+9soYfOsnjXOyQvcGGsa7Zua2YtAlvjcW:NhYSE+9rY/XCvcqa7Zua2vjc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769602135, "uuid": "ab1e36de-da1b-48c2-8cb4-37dce5b5e59f", "value": 164444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769602135, "uuid": "a19f741f-d4a6-4e39-b65f-8ea8c95021f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602135, "uuid": "a7dce78d-471c-4625-a5f7-2e5eb96648f3", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e72850-fc3c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769599547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599547, "uuid": "6febeb2d-c2ea-430a-9646-4bdb1322b429", "comment": "Malware payload (Mirai)", "value": "9b010f7e287eb89a307aa149c60a1f20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599547, "uuid": "01086f08-e57a-4c74-9e25-d105f7dd46b4", "comment": "Malware payload (Mirai)", "value": "f612866af6e3ca3fdf3ec528ff1512cd76c810c3afc2b38fd80d9169f5108b91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599547, "uuid": "a5ffd9d5-982e-484d-bd3c-f58f68ebb2b7", "comment": "Malware payload (Mirai)", "value": "3ba3420e5ac6dac31dd428eff45f00e101012a76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599547, "uuid": "6787afa4-f439-4c30-b481-d0baccfc7261", "comment": "Malware payload (Mirai)", "value": "c233ac13b7ad5b6c9245491ebf6c79144b37932ad02d0f9577c63f9808f79ee35b401a236aa1b0adf7c4d087a1ba58b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599547, "uuid": "40b70d11-adac-4447-b9b4-a532ce1d2ce0", "value": "T19BA34B21FD792D27C5C0717A51D34630F5F643A926BC9A4E7EA31D5CEE14220322FABA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599547, "uuid": "5020e91d-308c-4707-87a4-4b2d35752949", "value": "1536:Xk2ddsQ31aksoA73F7PSM1AuCzmxE9ScTZ0t6I68m0Z9cUnp:UE7lEoOF7PQmuJDtAnp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769599547, "uuid": "0c834be5-6bb9-418d-873b-b7ea5e978956", "value": 99780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769599547, "uuid": "23ebb45e-74cc-4ab8-a8d6-3c889ade1f16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599547, "uuid": "e7707ef1-67dd-4c2e-9ea5-7b85f1905687", "value": "splspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d404ae1c-fc3c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769599863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599863, "uuid": "97baad63-3659-4144-9a3d-04265c6704b5", "comment": "Malware payload (Mirai)", "value": "d3be70ecd367195ba445c7ca3691b958", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599863, "uuid": "95259428-cf19-4429-8504-514c37d95aca", "comment": "Malware payload (Mirai)", "value": "f62a5901c3882b255bcfd37c4c5c8988fd2139ca48e454a3cc90d5aa2c27e7d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599863, "uuid": "caa3e084-d9e3-48ef-89e0-d8431968b1f8", "comment": "Malware payload (Mirai)", "value": "381886abf6d19978f8b9e97ebfe395c4485a5544", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599863, "uuid": "d3cf96dd-ea42-4a8b-ae56-46cf1d437c5a", "comment": "Malware payload (Mirai)", "value": "d3ee1d45ad991ef36fa8ec9363cb54cfafd8287452c649005e871ac013db936e70670257957839c4f784bc462432b222", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599863, "uuid": "b402cbae-4b82-4245-ba3c-53b0b4f867e7", "value": "T1E283E50ABF610EBBD82FDD3746AD0A4535CC965722A83B763534D828F25A18F49E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599863, "uuid": "17452d0f-5256-46bf-9aff-6a77a5418fb4", "value": "1536:YW+HKlK7q5uA4OSWVRJCWRNtF5lLMZQd6TpTFe0ewbGdX:YWoK47euA4ULMF2wbUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769599863, "uuid": "ff22446a-770f-46b2-b639-102ca88932aa", "value": 80760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769599863, "uuid": "a393d584-eedf-4006-a1f2-a1f073dabbb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599863, "uuid": "62a998d6-c9dd-4d24-a1b0-9438abb4a08d", "value": "nabmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4802c53-fc3b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769599407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599407, "uuid": "ef5b4d42-2c40-4b11-a37e-ab3a722e9781", "comment": "Malware payload (Mirai)", "value": "636342ae672406b854072c9590ecbda7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599407, "uuid": "37c4b6e1-0661-4d06-9993-fe012a5a7d59", "comment": "Malware payload (Mirai)", "value": "f6653fb92a730fef8b3fec27625e4c0e4e06ad02715f168108862455aa95d2e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599407, "uuid": "976bf756-6246-47b5-b184-378b117625ea", "comment": "Malware payload (Mirai)", "value": "66ca59957d2864a3d68b24495ea0f718f2fb9543", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769599407, "uuid": "22122752-23f1-4e0d-9943-25d8c5a9a602", "comment": "Malware payload (Mirai)", "value": "a18a5912535b1269a1566b0d8f12e822a1021f236b8cc95d135e8f21b123aac1b7eef2f6a644d695f0eb6a5204e6f7d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599407, "uuid": "07ee1c36-ab14-4dc0-866d-a74c713a5150", "value": "T1EB336BC56793C8F1FC2501B0207BBB765F71E93E10B9FA5AD769E836EC22141A21638D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599407, "uuid": "e4f22a6e-12e2-4761-b618-ec8658d9cb17", "value": "1536:QPBPBbZEEnoEb3rCNFWsWhlbJqHD1ZzBH4:WBPNZbowbCNcsSRQj1H4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769599407, "uuid": "4d57f1e5-fbbb-45bf-967e-1e3fd11d28e2", "value": 51476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769599407, "uuid": "7c871655-d61d-494a-b617-415757139db4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769599407, "uuid": "213ba893-54ca-4e46-af91-471c208f2c07", "value": "nabx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9aeb685-fc43-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769602933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602933, "uuid": "f648225d-97a3-495d-a793-da51071e11c6", "comment": "Malware payload (Mirai)", "value": "67774681f97582222056d22120357cdd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602933, "uuid": "b3ba246e-cde9-4704-b091-be78ac17f0fc", "comment": "Malware payload (Mirai)", "value": "f6eab22b07f5ad176d203e61e883cfc90d312b7e7619b5123e671db9d4c45cca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602933, "uuid": "a39721eb-d2ad-4cde-8102-3c0d73f76995", "comment": "Malware payload (Mirai)", "value": "a620d39c8c2c6acfb93dae28f4f97b6301b75799", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602933, "uuid": "78d676d8-0cde-49c4-baeb-9c002cb8e9b0", "comment": "Malware payload (Mirai)", "value": "77d4c578cc265b7868d48403cc4f0072e92c8e74b3fd993497c8d0d5aa94a529c5c89388c727c9f2f6ad5a599105cd3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602933, "uuid": "72476c83-d152-461a-affb-3bd8e0ae0e15", "value": "T1E5935A42B3690487F2A74EB02C2F6BF1539ED5A131E0F285694FDB0F8175A321586FDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602933, "uuid": "8d6ac059-49e1-4f13-99b0-abaa5522f8eb", "value": "1536:lsE9XdH6OORiFanDekrLYIHiv2c6y3aFmbwsZUtzd85E/vLSqyLTJXPR:lsNOORa83y3/wsZUM5eQX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769602933, "uuid": "5d3e8b81-27e3-4858-83c4-f1f876d55e0c", "value": 96276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769602933, "uuid": "3d61ad9d-9227-48b1-862d-7d1ded41cbc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602933, "uuid": "51ca3d70-71ed-4178-a26e-d6903344e794", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54bf4011-fc9c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769640881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640881, "uuid": "8719a4c4-f0ab-4674-b38b-a5f96e930066", "comment": "Malware payload", "value": "2e596234ed0c529f52269cc02b761dbb", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640881, "uuid": "ebaf2862-1d1d-4931-a725-88bfa39d88e3", "comment": "Malware payload", "value": "f6fbcb3bacde3b9cdbc142f73124a034256d6a46ce186349ef8a10aacd74371a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640881, "uuid": "0e78087a-ddf4-4760-a75f-4612b6125e66", "comment": "Malware payload", "value": "4fb500509b3659df63f1a2802859c33a01f90cbf", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640881, "uuid": "697f4602-6d95-4971-87ed-02ef0ef09b63", "comment": "Malware payload", "value": "233f355966fcf45485970e123cc36d568a4f6deb1e1acc74429fc3274216f50693045fa5e4dda8a0eb9f681c2d241ddc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769640881, "uuid": "14a7bdf1-f7cb-47a1-96fc-66e3bb8de838", "value": "T1BE336333D410FE0601A1EE55A2799B04D672D97748AD6418B60C4E4D0FCA9EA3BBFF4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769640881, "uuid": "6a89a5e3-10ac-481e-81af-bd192a400314", "value": "1536:gcHg5Agyw1IDFSD4zNq94AbluKlAGRhl0IGAlOP:gPtN/plK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769640881, "uuid": "41f90ab3-8c65-49b4-856b-e957d6677744", "value": 55015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769640881, "uuid": "610f92d0-a304-4125-901e-db9d1542297c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769640881, "uuid": "c917eba4-1b39-4f30-88a2-09b60c9651e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4eb799-fbde-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769559318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769559318, "uuid": "6fae790e-1bda-44ef-8f89-81b627765ae9", "comment": "Malware payload", "value": "b165fd0258178a9bf93022263d7de05b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KERstealer", "colour": "#FA3F59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769559318, "uuid": "bc13a925-40a3-442e-9014-a795923c0fe5", "comment": "Malware payload", "value": "f77ee3bc6158cc3c8b2f7ad4256b47a0fb81406d92883179e0b86df1f447df2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KERstealer", "colour": "#FA3F59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769559318, "uuid": "ffc7ed88-6360-4dcf-8209-53697dbba969", "comment": "Malware payload", "value": "e1bd29fa095a43060404d9c82027e11e194cb64c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KERstealer", "colour": "#FA3F59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769559318, "uuid": "4cb27766-cad5-48c5-bfa1-349bff4fbcad", "comment": "Malware payload", "value": "faf5bb05e4b24982d3004c99d99c939dbbd5cafdc542069eb615d6093a33b108cc27cc2a55d8483e7828298e68789679", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KERstealer", "colour": "#FA3F59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769559318, "uuid": "9563018b-5f62-4e00-858f-e65c85f2beb3", "value": "T12AE5237BF78376DAC5D50A31851251732A226C478B410F73F4BCB22A1EE536A3D328B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769559318, "uuid": "e1e06bd8-e3a0-4ad6-9e59-c2e946a31609", "value": "b29f7bc6c3cf27ba78272829148a5262", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769559318, "uuid": "dc974a02-41b1-4889-86c5-96826b68d045", "value": "49152:cim0o8xw++Nwx1rAi3s3S5I15dVEAx7OpZDxkSfX3qD5Ye7fAaS+OVpi5sD4RWnH:cr8xw++GHnKSeRx7ID13q57fAfKuHnNV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769559318, "uuid": "b2435b07-9b3d-4148-88eb-0b4d7dbf8697", "value": 3136177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769559318, "uuid": "27fbd8f6-bcbd-41b0-aa70-157c23170eb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769559318, "uuid": "3cb6b547-5f77-425e-ac4a-9e250209ef5b", "value": "Steal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73dd905-fc44-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769603251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603251, "uuid": "82f5b6ff-d457-4c45-be0a-29429d7ba5a9", "comment": "Malware payload (Mirai)", "value": "1a10a0612a462b7579dd344596ad69b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603251, "uuid": "bc4c3b63-b3b4-438b-ba8b-b23325b47b62", "comment": "Malware payload (Mirai)", "value": "f7fc44e898243fa0d4eff24db7d2781a69be1e89d9391e4fdeda2022b5bc46af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603251, "uuid": "18cfd90f-3c6d-4dc5-b708-f217b90e9965", "comment": "Malware payload (Mirai)", "value": "45e7eb501a3c387f1fdbbe5a7c3cd6995c9bd95f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769603251, "uuid": "6112ad32-bdd4-4676-bfbc-863a29c0f7af", "comment": "Malware payload (Mirai)", "value": "fde7ebbc484f5276aa6ffed0e85e152b20cbb304c6d54291ce27d1203ebe5f636ee43dfba9631194ab8c3e3f97b060aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603251, "uuid": "4d443f08-e350-478f-ab4b-dd34d14714dd", "value": "T1EEB38CABF2475191C8A206F407CBAFDD2E2323C26F57A5E33C6925796C790CB5902F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603251, "uuid": "7cfcd361-278a-44b2-b22b-108390b3a9a3", "value": "1536:f19e7LPZscXAqvkirK36yKzm0Br7H53Pj/7SPagTq/LWg:f1iLP2cQqvjrK3JWVFPj/7SigTqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769603251, "uuid": "3acffe52-fc08-40db-8c0d-81a1125352c4", "value": 116092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769603251, "uuid": "d904f442-0b62-416a-b57f-065c4e8cb1a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769603251, "uuid": "5de19b46-94ac-4bc4-8b84-cb0f37e57433", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e34bcef-fc16-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769583318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769583318, "uuid": "117c8e91-7bd0-41e8-b4f4-4e2292f4b164", "comment": "Malware payload", "value": "9898e3a5bef82adbc42a464a7d168498", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769583318, "uuid": "ea2e4700-cb6b-4a68-b037-dd419d68a2cd", "comment": "Malware payload", "value": "f8ff497a143838c96cd59509f5c85d518ab1cf8c3814ff17c52ecd5d385fa441", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769583318, "uuid": "81a515f5-5275-418c-bd52-e79c24521422", "comment": "Malware payload", "value": "cc8a2cbda81eb28421d591823aee009ea4c9b635", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769583318, "uuid": "39a23c23-3672-4347-b580-153e07531d1a", "comment": "Malware payload", "value": "90481928419580844aab95d4ff48ef86ce650c041b4a6b0e42a1ee21b5fd1cd2b41c2e25990bc59d2746b5334aad1d8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769583318, "uuid": "15a76f2d-a09f-46b4-8693-304b4a2bd5e5", "value": "T18543A50A7F291FF7EC06CC3F05A86B1A129CA40A3159BB35B53CD908FA4B26E55D3476", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769583318, "uuid": "61fbd0d3-f6ce-45dd-ab9c-b37bdb3a4d9d", "value": "768:xBtKw2VqnJDlGgWLYXBaiC4dYwN5TZGHQ8BLKjpSzlj5hVrXITU3QBAhpLXzNAhT:3tK7v45ZG2s7V0aRzOp1axoQ0iIG+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769583318, "uuid": "dbb43388-41d0-4dda-a304-e219d80981ce", "value": 57515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769583318, "uuid": "23a705b5-9729-47b7-ab9b-c6b57853d6d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769583318, "uuid": "c3826d64-e59e-4f81-97be-389e7f6fadf1", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e3588c1-fc44-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1769602967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602967, "uuid": "fa4bf8c0-ab56-46b3-98b2-144a540841e3", "comment": "Malware payload (AsyncRAT)", "value": "3b16e565111f1cae8ed400f32af9aadd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602967, "uuid": "ceba6061-f737-4c1d-8d65-71ac7857f439", "comment": "Malware payload (AsyncRAT)", "value": "f9227476e2ee158f74472ab2496b14d9042ba4646c7aed3215fcdd1cc7ed955f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602967, "uuid": "1b73ba07-73cf-4213-b8ff-c77464fbc470", "comment": "Malware payload (AsyncRAT)", "value": "18a08f1c1968d15b407a734b922787abb09c980a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602967, "uuid": "8e7a0ff9-1918-4fe3-9c61-58e9110afb47", "comment": "Malware payload (AsyncRAT)", "value": "a3afa460cf0d4c562d4662ccf5e94f5a36e8d6d2afc8de4d54491a3ad7d7e2484658939ed5cb064434f369273e64303b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602967, "uuid": "386db38c-bdac-4edb-82c9-82dd97c19cc1", "value": "T1FDD22A04B7E48A65E1AC5BB98D7292009376E9474C67DB9E6FC440DE6623BC9CE10FF0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602967, "uuid": "03628e78-8696-4a79-a6aa-d197d15342b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602967, "uuid": "13016bf1-63fe-40fc-a4c6-f4658044daea", "value": "384:a0XStADJwvSm9+QKIcjth93buUsTQxnCJf+jJGIjJsfoF/+:aqStieSmgQK/jzRbVB/jPF/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769602967, "uuid": "ef53baf2-d1c4-413b-82e8-b0c15de62b19", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769602967, "uuid": "1efb6cb6-312e-4dea-9c48-358a246cf13a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602967, "uuid": "08d62bd9-deb5-4727-852d-f4c612fc4507", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9961768c-fc3e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769600623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600623, "uuid": "6a890459-f69c-4106-945d-356ac01e143c", "comment": "Malware payload (Mirai)", "value": "090d0ba0602fb35eaa28b2045b1e8849", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600623, "uuid": "772e28f7-6ffe-41c5-b081-43048bb8cb60", "comment": "Malware payload (Mirai)", "value": "f92645cab096b5d39f172fdb50f58f9c72a39effe80e4c57d103e7360d461357", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600623, "uuid": "a5d3a411-8644-4ebe-99a0-4573646972f6", "comment": "Malware payload (Mirai)", "value": "79ecb103f796942215c8095b7728ceb8364b0919", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600623, "uuid": "d4f45849-2f01-46a0-8356-8410614209be", "comment": "Malware payload (Mirai)", "value": "bd919b7edff7e85b9c5ed405cc0968c02adf440839762d3a897292a613634655b1bf14c7b34b725ede31382dcc11b12b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600623, "uuid": "cd9b7e39-2549-461e-9506-6b15dce76820", "value": "T1D2A34B21FD792D27C5C0717A51D34630F5F643A925BC9A4E7EA31D5CEE14220322FABA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600623, "uuid": "18c778b6-6657-4980-b592-20aa81a611da", "value": "1536:Xk2ddsQ31aksoA73F7PSM1AuCzmxE9IcTZ0t6I68m0Z9cUnp:UE7lEoOF7PQmu/DtAnp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769600623, "uuid": "4013581a-aac2-4e2e-a246-c01c85ac8eef", "value": 99780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769600623, "uuid": "aa323ae6-177d-4e30-b460-4884d55df92a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600623, "uuid": "11fb175f-20ec-45a2-b2c6-9014c9f1d911", "value": "jklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b49f22-fc48-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769605072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769605072, "uuid": "6d408144-63bb-4b6d-84f1-b006769d3573", "comment": "Malware payload (Mirai)", "value": "1e21efd00a265674f111292d47969bbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769605072, "uuid": "6ba7ff09-e846-487c-9871-1cce509acc03", "comment": "Malware payload (Mirai)", "value": "fa467e4779f753364fa0cd7d033074789b1b8887cd0c2706fd30ed1928acc9d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769605072, "uuid": "d9d23630-9b04-487b-91fe-238868178535", "comment": "Malware payload (Mirai)", "value": "b459ca2a442959a356e0dab6339d254044bbc325", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769605072, "uuid": "a9a126d2-5ec9-4c9c-ae54-2ee616167607", "comment": "Malware payload (Mirai)", "value": "49b23c1892fcc9fb9daaf85b9905b7e5943f2536e5c5f435f00f04f7d7dcdafd4715669ef767a4555899e7e16bdea0b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769605072, "uuid": "b26e3565-193f-4ec8-8109-00506e745c60", "value": "T11093298ABCC5C202C5E0A1B6BB1F959D371643B8E3E6B107CD1DAF29634F8970A37651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769605072, "uuid": "5c8bb49a-4666-497e-a63e-659fe69ee501", "value": "1536:hYC0mJWDwY31YsiAhiH4eGc51KCO1p1//x2kWSY5Ser2vBaqSJAw6X:h50mwDNjixYPcOCup13xRRY5SllSJR6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769605072, "uuid": "f2d405fd-654f-42e8-8e95-521eb1ff61ca", "value": 96560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769605072, "uuid": "c451f4c7-1952-43c6-b9cc-8c4feb33ff3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769605072, "uuid": "0a8ac508-f9fa-4622-8be9-1b148c68ff4c", "value": "splarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d51351-fc42-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769602250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602250, "uuid": "2ca73bd5-b096-46f2-aa33-db8d4483551d", "comment": "Malware payload (Mirai)", "value": "68b9e63fa4ff4f12d5ba4c3163db6216", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602250, "uuid": "2c8a7681-5d4c-44fb-a56d-e885996df747", "comment": "Malware payload (Mirai)", "value": "faade3ce06eddb0e0c1dbc67f76aa3b55f81c25623b7901c0118ea74fd8a46f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602250, "uuid": "103c6f33-2ef1-4353-8ed4-7c5a926e79bc", "comment": "Malware payload (Mirai)", "value": "8f6e658a40f282eeee36c0d21f4257865a93cd1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769602250, "uuid": "21718018-bf01-49e8-a07f-a7114e42b078", "comment": "Malware payload (Mirai)", "value": "46895da2ad9086b92eadea83ce424f67b4f57c166ea8f51d04fde577bbbd660cdeefe7f768460164d611e3ab35eec607", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602250, "uuid": "76dac364-b8f5-4af6-9285-c5d4e4ef9776", "value": "T145338CA6EC776E28E05955F07031CEBD1B13A1A0A2872EBA6C76CB64D043DCCF5483B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602250, "uuid": "03eeb26f-82e0-48fd-93bc-75bc35ca47ce", "value": "768:7dnQgut0jnlgEyaI9lrRKk9ZJX8BZP1Qa1z7p7p7uoPVujQCM0fdBBo7dX:7q7tMnI9h0k3JX8tVlp7jPaQCMku7dX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769602250, "uuid": "5ee696b3-0ced-4ab9-8fae-2a575ef74ded", "value": 54720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769602250, "uuid": "2f6d8071-4527-41f1-bdb0-d1785f0d55b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769602250, "uuid": "5a27c715-a3c0-4003-a03d-6ace197dd72b", "value": "nabsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cedd5e28-fbe6-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1769562918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769562918, "uuid": "414182ea-fdc6-4ad8-b3b0-0b66738ddfdd", "comment": "Malware payload (Joker)", "value": "9a764ee65fe78fa3e274bbef35152992", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769562918, "uuid": "7c489925-146c-4799-9ca0-d91855862033", "comment": "Malware payload (Joker)", "value": "fab5e90b92d5a453107ca5f77ceb5e7eb02e07d5ed1463e879f85fe4a0383a43", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769562918, "uuid": "61a837cd-1cd1-4862-8822-d93a727c1c30", "comment": "Malware payload (Joker)", "value": "32f95103c9fc8235cb1e3a58ac5f05ce8bb47920", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769562918, "uuid": "1454ab6f-bb38-43b8-87a1-d89b688cf25a", "comment": "Malware payload (Joker)", "value": "70982b42415135b4f57bc6c07ca0c48d85ae18fff0a3c3f6700cc0dfbe9f2d6d8b31965ef7f9b466dbbe134ba420f1ba", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769562918, "uuid": "1092409e-eb41-43b0-8e28-0db4800427b5", "value": "T153E62255FB1CA82FCAFB74B69F29C263202FE14590C297AB6C09415C9AC77484F5BF90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769562918, "uuid": "5b58e984-bf34-4d2e-a3ca-bb2e4176c0e9", "value": "393216:ydecVWYiMjzbJFTgTsxatDkmxE/Ru1NJktxc:yUyzbvT/xmUaNytxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769562918, "uuid": "43f47d27-2320-483c-b14a-9582d25fdd31", "value": 14667419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769562918, "uuid": "33b121e7-5b92-4153-af02-c99816f6238c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769562918, "uuid": "bc479d1d-d347-455b-bfb8-f88eee035a1a", "value": "Fast+Cleaner_0.56.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d187c77-fc28-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769590993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590993, "uuid": "41525651-0dd2-4628-a61a-d08cafbd67d1", "comment": "Malware payload", "value": "fee7699dbf84005012bd3f1b74a1ff91", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590993, "uuid": "20bde337-e09d-4404-b464-2e14f7ce5e00", "comment": "Malware payload", "value": "fb137fa942709da848275d751683a577656e07eb29b31e0cc229460f36fc6379", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590993, "uuid": "4ea5699f-875b-4876-a5f1-f0be17b216fc", "comment": "Malware payload", "value": "8f4fcffeafedc1e390471d20ec6c12416676ff4b", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769590993, "uuid": "c047dbc5-82d5-4a6b-aa4d-b8333767e5f7", "comment": "Malware payload", "value": "74af41a8f7c76b9d1132c1749d2c7c05abad2858b03d948c958e877b38d5cc1cb56f8a2074f16d596d14b58b38d3ecaf", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590993, "uuid": "e2a28d70-e0e4-417a-8956-4294712e6104", "value": "T1B3B25B74CEE5AC33429E6B379F3DDAB864774162CA90378752B9F9884587BA7440FC08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590993, "uuid": "f49e94e8-0bd9-46f2-80ba-06edfa648aa5", "value": "384:CSdUpJPnQ8HpRmwXpGqc93n45yhTnHZbYydVAYRJ1ESHguohM03Z5DGV5X:CZzjHjBpGqo3LTnHZcyvJ1Iuo60J5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769590993, "uuid": "09ce048b-071d-42e9-a526-68ccbe067080", "value": 23542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769590993, "uuid": "a2eb5671-acec-4cfb-b539-4dd2e723f3df", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769590993, "uuid": "267b3a09-dcf4-45bb-8908-9ad2c4e676a9", "value": "Archivos-aYYd7a3Fs2.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "209ed5f4-fc3f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769600850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600850, "uuid": "4eb3ed1a-61ae-4e97-a45a-ef418b311ad4", "comment": "Malware payload (Mirai)", "value": "f78ff0ce9400fc79480153c5dcf35efb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600850, "uuid": "d6653dda-10d8-4816-8831-160f91e294e5", "comment": "Malware payload (Mirai)", "value": "fbab362b4e1154884d17807d9420ce68a0845305b729d9a7567cd0f4d66ee7be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600850, "uuid": "b86b4e23-b633-4c99-8c82-42405e81a716", "comment": "Malware payload (Mirai)", "value": "363476714c5322af5d5ceb28b71ecb67238c0e23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769600850, "uuid": "bd09ea7e-d957-432c-8411-711c58537a1e", "comment": "Malware payload (Mirai)", "value": "a1b3aebc39cd1435d1b5640ee7ce879373d7ea3662e3409fe6d9f5ab451d4c564ce6ff5a1e3fd0ddc77598731b3289ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600850, "uuid": "95561f3d-ee8e-4f19-92d2-dd77810dd5fd", "value": "T125837CC19543E8F1E9084278223BF3377576CAB80178FDF3F769697684299A0A14774E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600850, "uuid": "46442daa-0226-4a0f-a041-a0c65297f9fb", "value": "1536:vXl5zfemDz9T4U8TfJyEEhD5vy2Rm+a6t4qwEw/cTXrQlU0RK9Fb3CNF:v1pFn54UeYn5vjm+aehwfETX0ln47QF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769600850, "uuid": "eb8a8a8e-9356-44d8-9fd6-c59a91339f5c", "value": 83956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769600850, "uuid": "4f080da9-c064-48b5-93c5-63eb5cd0625f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769600850, "uuid": "005194f1-28b9-42ed-badb-8ba52062beaa", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5b9532-fc64-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769616839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616839, "uuid": "b7695f68-7495-4b82-b317-659162f45bf6", "comment": "Malware payload", "value": "04abb3953e5890d3fd6dbde7b4d2be70", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "niggaware", "colour": "#452BD1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616839, "uuid": "537f1efc-33b9-4001-95f8-712b75305c24", "comment": "Malware payload", "value": "fbb4c502125448d2cb622eca86918c91a480c5d194051c16b838a21c5806cd3f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "niggaware", "colour": "#452BD1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616839, "uuid": "56a89db1-273b-4472-ac0f-1f6afefb77eb", "comment": "Malware payload", "value": "6be9c6d28481019882e29e584ac5255842c24f95", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "niggaware", "colour": "#452BD1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769616839, "uuid": "9ff627bb-e891-402d-bdae-484a230f1d6b", "comment": "Malware payload", "value": "764efee014974a62a2cacef8fe3607ac581ff371498ea8dfd0b1e7a7bacac3d19248a9ade54395b058032749525fe7e8", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "niggaware", "colour": "#452BD1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616839, "uuid": "459a5282-53d6-4447-a5da-5ab54830b6ea", "value": "T1CFD4023399B8146BDD3BD934B8E28D01EC5C68E0AC5E649790FE65DF3427DD282A431E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616839, "uuid": "d8d4a0d4-9f15-4255-bac6-bba1b973126a", "value": "12288:j87emQhQ5qz0k8lNo15gXVV/yh0PaRWdO672fZDYTnUpVJ2l7x8fPZnqchIcXdhY:jyOz0dNo1S/LTdxwyOfhhhIcXdhY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769616839, "uuid": "ee192ecf-9a70-42a3-97a6-3cb9ab3795fb", "value": 603404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769616839, "uuid": "d2f7673a-18d7-4446-975b-c918980d28a0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769616839, "uuid": "c7d53046-9639-4a4a-9e37-32d992711546", "value": "Zinc-1.21.4.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a127ae-fc46-11f0-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1769604182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769604182, "uuid": "416f6b90-8bbd-480e-b448-b4ec43dc3ab4", "comment": "Malware payload (VIPKeylogger)", "value": "6e5634b01b67b0dbfc8fe4a3a96e2cf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769604182, "uuid": "7281d6e6-3ae7-4275-abf3-2f2ffaa45373", "comment": "Malware payload (VIPKeylogger)", "value": "fbfa970adebde6e46f5f73d868d1568c8119bbd15e4cc77324c018cc5314cff3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769604182, "uuid": "e0b6d6b0-595c-4238-bafd-f2d57cde4e81", "comment": "Malware payload (VIPKeylogger)", "value": "fe9f9ec665aec853e03c01e6f8c7210076142794", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769604182, "uuid": "ce73d70e-67af-4a34-a6c6-9815d47a5b08", "comment": "Malware payload (VIPKeylogger)", "value": "7c51c043f0742af3750d3a6ac7902cba6a4a9d302fa8d6c9edf1cd118bc9336c04048cd7d20370382b8315bb91ebae3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769604182, "uuid": "53bf07d7-3c03-4691-9a21-c8f6fb824949", "value": "T1B5642352580F1152DC25A2B43964A0BD6CE8B6D0D0C6BB96DD38E2B73AD63B35E4827C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769604182, "uuid": "cec32865-4b53-4d82-86ae-cc622a8f9e0a", "value": "a6575984dc975b0d1678d7d86b67443c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769604182, "uuid": "05ef205c-91e0-443d-8b1d-abcacf1395e5", "value": "6144:yo2/o5sb5BCJRYLhDWQZbFYWWmoWXQAAXkR8CSI8+mTYE8BWUQHMANAj:rsHCbYLhD5yDWIXkR8CSvdH8BWUGNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769604182, "uuid": "c1ce2a7e-ba41-4129-a1b1-9f6a2fb52dfc", "value": 309760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769604182, "uuid": "815b84df-3062-4dab-b060-ee7851dfab46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769604182, "uuid": "aa2704ac-60e6-48aa-9736-85511b5db801", "value": "ORDER CONFIRMATION_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38574777-fc9c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769640833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640833, "uuid": "df10cab5-9e6e-4e59-bd1c-5ad2e20a7c6d", "comment": "Malware payload", "value": "997de7e05decfd96a9ab28864d1cb300", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640833, "uuid": "35fc4673-1bb1-4b25-b25e-c5b78c737391", "comment": "Malware payload", "value": "fc24068bbf6063efd7b84d8ec03ca13e95310e9b9c540be6c10a76f322fcb83a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640833, "uuid": "060f0f5b-a2ef-47ed-a3ee-811c56c119cc", "comment": "Malware payload", "value": "22f2716ae9271e769c8a4f6c2fe6d0e87deddd64", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769640833, "uuid": "22935ca2-65f7-41ac-85b8-36bf05997027", "comment": "Malware payload", "value": "dc60c6c6c565475aa3533dfe270a3efa23add216e302cd941952c2928948cb23dba2dc662c047aee0cd3ff6561693a53", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769640833, "uuid": "1dac4b1b-7ffa-47a3-bb57-9c0a60c9e12b", "value": "T1F1336333D410FE0601A1EE55A2799B04D672D97748AD6418B60C4E4D0FCA9EA3BBFF4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769640833, "uuid": "f1c53c5f-6195-4cbc-88a0-7042b4ed4387", "value": "1536:gcHg5Agyw6IDFSD4zNq94AbluKlAGRhl0IG2lOP:gotN/rlK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769640833, "uuid": "04e76eb0-5232-4e7e-b14f-3549f596215a", "value": 55015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769640833, "uuid": "5c893acf-03e8-4b8a-a14e-0343051742f6", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769640833, "uuid": "09db00b5-dff0-41b2-af51-d63780d06533", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a15e1c7f-fc2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769594194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769594194, "uuid": "cb01312e-8539-4a3c-941b-cb3371865040", "comment": "Malware payload (Mirai)", "value": "c4a21fd5b813e8808e8642bb47541bf2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769594194, "uuid": "e1ac5fad-9212-47a2-a60f-ab1f897acc77", "comment": "Malware payload (Mirai)", "value": "fc78c3225e4096e99aad35aa16bbcda1b445d65aab408a140a3ce2ab384b3b09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769594194, "uuid": "29c5544c-f8af-42c8-a8c2-0d31b3e5ed73", "comment": "Malware payload (Mirai)", "value": "bf3364a5008243087cd1ff3396853cbdb8c13def", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769594194, "uuid": "126e7b74-9c31-4b2a-a2a0-6a0ecd3a7f4c", "comment": "Malware payload (Mirai)", "value": "3224386a72de1a5c1d278d6e6c825c9192331fbacd865b93ef33522f42a8bcb621cc8bd016c01ad66b42ffb47dad844a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769594194, "uuid": "55bc0c75-ccfb-4908-b3cd-14976bc3e700", "value": "T12DC3F80ABFB21EBBD4AFDD3745A50749289D554622B93B353A74D81CF20A28F19E3C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769594194, "uuid": "bfc04def-b544-4920-b389-29d54e48bffd", "value": "1536:ebmgc0+vNuUg2X5/amonJOtG3qX0U5qRYChMbh881+Bu1u/nSgDuZfqFX39wu7rO:e6xR+JOCjDw3JyQuZnPcMQ6huTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769594194, "uuid": "5a8480ae-aa58-4c65-921d-f50cdd88115b", "value": 122608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769594194, "uuid": "3335abfe-ebc0-425b-ab5e-c37a46ecc69e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769594194, "uuid": "667bc6c4-8d1f-4c5e-b564-cb048c87cfdc", "value": "jklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d04c38-fc80-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1769628728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769628728, "uuid": "ada3c641-0c89-4ffb-b674-ced0421fc55b", "comment": "Malware payload (CoinMiner)", "value": "ab9ed2ef0195d5cf59dac30880090870", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769628728, "uuid": "8e7cd316-d08d-4f40-803c-c3ac85c26253", "comment": "Malware payload (CoinMiner)", "value": "fcd89fa42d24b330d8661064a5d40660b95deff7a741663ff11e8be65cf91af1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769628728, "uuid": "fc00d2ad-b7bf-496c-a77a-3de1dd2ed41c", "comment": "Malware payload (CoinMiner)", "value": "2f2f1798554f8920af3dc96a376ceb87b8056ff4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769628728, "uuid": "78efe099-f9c8-4e70-af44-298a696a57d7", "comment": "Malware payload (CoinMiner)", "value": "62011036b7d418f4b1d948a490e19205106ac42d755c3bb09664a7f9a7b2615cbb97e5acce15377ed70cbd7ec55ad0f0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769628728, "uuid": "75f29dbb-18dc-47db-8717-52c41484ff33", "value": "T1B1F533CB947514BCF49142F01A9FAF368A0EF297279606CB51967800369BFC32B753DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769628728, "uuid": "5ba87879-8f5e-4fb4-a726-54ca7aa39d2d", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769628728, "uuid": "889e84af-4bb3-4e20-8b2c-ee6f3f133714", "value": "98304:ekSPX+W+vB4jUv4KFm1GKKlXgxEnWmRsq7w:ezX+W+vBZIHKXcq7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769628728, "uuid": "f5e9d4e4-44be-44fc-a827-3f26ff0c1ef0", "value": 3443512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769628728, "uuid": "166f5e79-0341-4e7e-a99f-2534cdc002a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769628728, "uuid": "0c6bad92-c91f-47c6-b89f-46ed2f9c0ec2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc43d98-fc51-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769608657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608657, "uuid": "a11114bd-5f6d-4c09-8315-907848a2ec5f", "comment": "Malware payload (Mirai)", "value": "94dac52e0c7afaa923887cd24fc880e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608657, "uuid": "345c14c4-075f-4084-9c0a-f01e6fd5f139", "comment": "Malware payload (Mirai)", "value": "fd12c3240f6ecd994ffba934f39726adec611c03fbe01d7ae19b1a83efdc3da9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608657, "uuid": "db64081e-db0b-4ad2-87b0-e3b12a43f211", "comment": "Malware payload (Mirai)", "value": "7cb93e5fb6494a77d713a8b4a59530126c681ef7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769608657, "uuid": "83dfc354-f6f2-4705-8de3-e45a5945da9a", "comment": "Malware payload (Mirai)", "value": "b9d846e92467174368e7142fc8c52c562238de52652f8768a3898d11e26feaf5d516a711bc5ac288719eeaa5a6be6a50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608657, "uuid": "abd89287-f318-4ffd-918f-3f6519535f8e", "value": "T1EF83C6197E218FBEFB9E86384BB78E21564833C626E1D581D15CEA015E7034E741FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608657, "uuid": "4933f5ea-533d-4eda-b745-04c03c5a00d1", "value": "1536:T+/XIq5WQpTs2Qyx8lLEr0vOZM2c/7wRVfS2NZN6T:TaXocTR0Er0Wm2bRVfS2NZET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769608657, "uuid": "53473abd-c459-4d19-8d34-df095c6abaf9", "value": 85904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769608657, "uuid": "a06e4f2e-1979-4c7b-b636-5718d6c9d787", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769608657, "uuid": "82459d7d-1d33-4e8d-8bef-5c37d0d2f6b5", "value": "astro.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d66e579-fc8d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769634319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769634319, "uuid": "ba6d003a-ba90-460d-aaf4-127d5b6ec5ed", "comment": "Malware payload", "value": "e6d534ffdf1a5feec99537ff9a86b0ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769634319, "uuid": "1bf2c1b0-e7d9-4350-a5c9-4ce8e3c08a61", "comment": "Malware payload", "value": "fdfa52c109d3fb8faec1f646af0a972c30c767f3ab42b9e02fb6e028ac5d0832", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769634319, "uuid": "a90ef4b0-4813-4232-8cde-e12d15f763e1", "comment": "Malware payload", "value": "908549f91b0f32812b5d38f819c0e8e73566bd42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769634319, "uuid": "d09441c8-a334-4fe6-913b-bf5bb17d80f3", "comment": "Malware payload", "value": "fbab1ce18420a2a6b77914c64c1e917f7990631b4d946dcc66e6aa07dba31d8782ca00a3d9ee2b98c6ea94356ac30fc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769634319, "uuid": "511a0cf0-c087-434d-a8d5-4c54c39348f0", "value": "T1BD056D02BF506FEBC4AFCE30452EC75610DDE9875AC5662D71BC8B8CBADD25A0AD3448", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769634319, "uuid": "31da9ed1-9f2c-4c04-a2a6-a8d1704a0cea", "value": "12288:hT6gEgXAL/OSkBAceih7qbGKG6HZpwc4PvcLcN3lO38LLw4yIFezKt6JD42Kbxdb:KrFYKu9m/N66eVU7FeG7dppK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769634319, "uuid": "48eeba32-d99b-453b-bb76-d4e8225839a6", "value": 860884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769634319, "uuid": "b192c9c9-2ad8-4001-a45f-0647c89bd4c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769634319, "uuid": "99645e4c-5c99-42c9-a2e2-6dd9e074e1df", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1373ffa-fc66-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769617817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617817, "uuid": "0cdb3480-7b04-410e-b379-8f2e709f97c9", "comment": "Malware payload (Mirai)", "value": "3142019b3f127b98813c09d820936391", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617817, "uuid": "390e199c-ecac-4177-8f26-d62d6a61b0e2", "comment": "Malware payload (Mirai)", "value": "fefec7b2d044fee96b0d7315c1a648a64c78fd6cbb1753c7d90e027676379e7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617817, "uuid": "42b15b21-10c3-4608-9359-ec26cd9c13dd", "comment": "Malware payload (Mirai)", "value": "fa0d67842225521127d94eb2ad0c2cd0843949a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769617817, "uuid": "47b43625-6f21-4584-a55f-c89ffffbe1cd", "comment": "Malware payload (Mirai)", "value": "2a641fc04ac8a09d6c2dfbb3fef51541e806628015b4eb547a0c0309876c2cfcd8be4ddaf94ada537875be36b3720c2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617817, "uuid": "61577b83-b6de-49ad-9cb7-445782f79965", "value": "T16DA30846A9819F02D4D631FAFBAF414933136FB8E3EA7101D920AF5427C69DB0E77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617817, "uuid": "90366f9b-da4b-4c07-b385-0e2a441df99c", "value": "3072:Q53AbfymvavYdaC0ubwCWFaLJF1HS1v9mm9or:S3cfywaAdaC0ubwCWQLRSJ9mcor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769617817, "uuid": "0f9430cd-619d-48cf-9177-4fcfd90fe2f5", "value": 99800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769617817, "uuid": "90ef0226-db9c-4ea4-9403-47b7c002c4cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769617817, "uuid": "ebefa0dc-7e58-49d9-a732-f5551ca89923", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0551b19a-fc88-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769632158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632158, "uuid": "3a36ad5a-581d-488a-bf03-d80733c77e7b", "comment": "Malware payload", "value": "55e2dfb82aeeb2e546043a4913389ed2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632158, "uuid": "6316c565-d25e-45f7-9304-06c1d5b97f2d", "comment": "Malware payload", "value": "ffce43f8d771f3a62a8acf6afd0f6aafa8155e0957d05dcc6b64ae9eb3108202", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632158, "uuid": "6fed4db1-0990-4661-88f1-ea45edf82c3f", "comment": "Malware payload", "value": "63219471bc1c7c3068e41623f80480c66c4cb3f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769632158, "uuid": "42972496-8c63-44cb-9269-4f1abd6d95ee", "comment": "Malware payload", "value": "74ea00e5f96099e279a19c1c4a1ec15c96a001bfb44334be42c89bb41bb6607f6023552ca5fc3b9c7eafdff328f8e167", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632158, "uuid": "c2cc74ce-f676-4f95-b398-a100920e7bb3", "value": "T1E81449C7F800DDBAF80EE73B88074906B130A7A114926A377167757BED7A1A5047BF86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632158, "uuid": "86b63ac3-5dbb-49b4-a0df-e07a5ee50e0b", "value": "3072:3fz7bjuGQCwKHkbu5SxKX2/srFVmhvnyNxguJxWNWdEfzAuJQVV4jbi2LvHD5T0:vz3WvyNCuJxkW+5JQELvh0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769632158, "uuid": "3f425557-fb03-46b5-b550-6299d21d79b4", "value": 199776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769632158, "uuid": "bdd47fca-6a70-4b57-ab4d-9d61326dcd83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769632158, "uuid": "0c34d6c5-5adc-4c8f-9c28-f11f9d48b5fc", "value": "herios.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }