{ "Event": { "published": true, "date": "2026-06-20", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-06-20", "timestamp": 1782000181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "658fc404-7549-4a39-a5eb-58ed533454d9", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae4b02c-6ce4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781986587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986587, "uuid": "991d1dd9-d79b-469c-9b64-7c3be6e7e0dd", "comment": "Malware payload", "value": "5c06878b4c3ede63b93dc4286003f69a", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986587, "uuid": "a6a8b148-f1bd-4ef3-9512-614db1ba7d7b", "comment": "Malware payload", "value": "000575e07e3657a767778a53587fd81b492fe02ea361e98de439e6345653071e", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986587, "uuid": "d1ef51da-a56d-42f4-93e0-8593e3cee8a3", "comment": "Malware payload", "value": "d67bcf43de93f8ef31e307ffea81b0760d5a5171", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986587, "uuid": "a3c673fa-fb33-4499-b438-488e1b9d22b2", "comment": "Malware payload", "value": "21cafd24cc3477c362a057b73e8e4545191097c3093bdf1122c28bc6162355574079d5013505ee9645a9f4938457f6f0", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986587, "uuid": "4213e2a3-9320-4137-b99f-f226c02b1b14", "value": "T1188533B0FD769B692B760838F2570825F9CD9FCD347FBE813A4E610A6614D46FA1E008", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986587, "uuid": "d65fc3cc-9bb1-46de-a057-43ad92043d5d", "value": "24576:sYU+GC/q/fACb6FFeGC9l+0KW6uFMmyrn1hwQ9srxjsZuSKHksycXLTZs:snzCS/YFel+1jLrn1a2srxe4HkyLTZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781986587, "uuid": "70f17e8c-6dc5-420f-b1da-7901049d395c", "value": 1727160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781986587, "uuid": "46fdf3dd-9d6d-464b-827f-8b50cb6f9b4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986587, "uuid": "8039b12b-90b6-4427-a3e1-4ae5a291c985", "value": "rcuop_0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "044e1708-6cd5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781979758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781979758, "uuid": "701825d2-7f3b-474e-8e33-95d4c4e6f6d6", "comment": "Malware payload (Mirai)", "value": "2336e665194c9ab5b52ed5873a796fa3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781979758, "uuid": "5d5b0444-c078-4983-991b-215d84917ff6", "comment": "Malware payload (Mirai)", "value": "028885c413e231f532509521b18b95862a51b5fc8c98232c71e4e8d720457b89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781979758, "uuid": "be53676d-f5c8-4470-889a-201c57155fd0", "comment": "Malware payload (Mirai)", "value": "3e52d1dad7e8794e1c59a7f501880ac0facaf6a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781979758, "uuid": "05930ec8-7456-4231-9954-6abadc37beaf", "comment": "Malware payload (Mirai)", "value": "2180f87ed08da56e89dce797d9e50e707f179541e7e3bfad6800e5cd3ec902cccc3c35f1a7612bf19c9425650b72e0c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781979758, "uuid": "f42281dd-87a2-4654-a787-db22f8d56597", "value": "T1FC83C71E6E219FECF7A9833547B78E21A35933C637E1D681E15CD6001E6134E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781979758, "uuid": "f2c63d56-e313-426b-aca5-34583535251b", "value": "768:yJA+AKtNSeEa+DlSLhD1h5WVHY6Kzx7z7/X508UeVJ2wiyJSvpeD4v2LIDX:xKtNb+01zWV4Z1z7v71MwIe8v2LI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781979758, "uuid": "89dcbdec-9b95-4ee0-bb8f-7847ddcce3ba", "value": 80740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781979758, "uuid": "f96e8654-3a13-461b-bad9-e3e0dc9a1c4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781979758, "uuid": "ab9e984c-3749-4fde-85e1-ea62214eb113", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34dd70a-6c5a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781927250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927250, "uuid": "672386f1-6238-4d3b-a925-53ab945809b3", "comment": "Malware payload (Mirai)", "value": "4b5adfbbb2a30f3c05bf4434769a7479", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927250, "uuid": "45724781-7a32-4905-877a-8fb9cca4c996", "comment": "Malware payload (Mirai)", "value": "02a2cfc164003033b71a15674b0b5783a79648edf8d463b5eaed42a0354358e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927250, "uuid": "a22ae427-bf2d-4213-bc0d-5f1ebf19258c", "comment": "Malware payload (Mirai)", "value": "fe2ca8a9d6f608769b8157522e85b83352f54bd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927250, "uuid": "0849d93b-a8ea-4758-9edf-48082d347c27", "comment": "Malware payload (Mirai)", "value": "2c6194e7e36280fb0008dbaad9770c8b8ee05711a4b13f9b1d39624b5d278531bbf82cf8653b9038510a6f079f7f8094", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781927250, "uuid": "8bd4f7c6-82c9-48be-9171-fb43a54156dd", "value": "T1C9543B46EB414F13C4D627BABAAF024533339764D3EBB206D9246FB4378775E4E62601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781927250, "uuid": "8393dd35-059d-4c82-9fe2-e096220f2664", "value": "6144:XcZ6HJ/EKC7mhZlJsTQYaLdYzxx91OryXyBXNWHiTV/GsmU2hxas:suOKdJsTQYaLdsxx91ue0X3/PmU6xas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781927250, "uuid": "e3b3caf7-6c2f-440c-9d6c-02c579c31a76", "value": 292173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781927250, "uuid": "f7701ec3-9ca1-4471-b148-b7bd275530cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781927250, "uuid": "6bdbbc4e-01fd-41e1-b889-1a85ae1db948", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d189af0-6c5b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781927562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927562, "uuid": "08021261-a187-4d9a-9602-afca39fc62fd", "comment": "Malware payload (Mirai)", "value": "251c3d17b98f29076b304711612db9f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927562, "uuid": "677fe18b-ac46-4efd-9f35-6f89f185adb7", "comment": "Malware payload (Mirai)", "value": "02c2ff3294b5725b324b76694836a86d2971d5cbf88d93f7c04760e0056bf773", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927562, "uuid": "1f31e5d4-580c-4efe-a6ed-c3afa05e4fc7", "comment": "Malware payload (Mirai)", "value": "6292d5f9051f9f3750ccba9003b25c03895e00d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927562, "uuid": "c2724ada-603e-472a-80b2-fb1e3e456e26", "comment": "Malware payload (Mirai)", "value": "75b9717d1868ed552c2f313151ad739c13b870049657e8736f939b5ed5a3cf92e3a8ca96b4d9c1b782da310b82b95916", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781927562, "uuid": "bcaa50b4-3920-4ec8-a8a7-2816f2c012c4", "value": "T1ED54C61F6E229F7DF3A9877547B38E249B5823D627E1D680D1ACD1101E6038E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781927562, "uuid": "3ca651cc-8dd9-4b03-ac4f-068f4bf85c56", "value": "6144:bNpJTibcOF/kPFth0da2ivfyhvprKGg8I:bNppz9td2kSg8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781927562, "uuid": "9e6b4020-4789-46d3-ab56-c4a978dc6236", "value": 280484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781927562, "uuid": "85ab2b5f-98aa-471c-bbba-d08040d42d51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781927562, "uuid": "60583c58-d95a-486c-8021-5bd40b755bfb", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79750825-6c6d-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781935287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935287, "uuid": "baea48fa-3436-4cdd-874c-c12d8da62d71", "comment": "Malware payload (CoinMiner)", "value": "3421ef1f3d1a1bbb8f595f2f319700f0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935287, "uuid": "6f18c120-19fb-48e4-a472-b7bdaca33c13", "comment": "Malware payload (CoinMiner)", "value": "036283407ccf8ecff4105810b91c1faf6f17c138e77f28d0ef0f3109b22ef785", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935287, "uuid": "1ea12d5e-cce1-4d7e-9e11-6d74b3971bfb", "comment": "Malware payload (CoinMiner)", "value": "5ffeb865e557756fa1b9655833c602fecb01a423", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935287, "uuid": "6f8400a5-077d-4a38-84e7-0b7846148cc8", "comment": "Malware payload (CoinMiner)", "value": "f268a7b6947414eda767040af2ed129ac7aee69370d881efe33bfc8c2f1723a4cb743de7c596ce6de194c557f832d804", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935287, "uuid": "1a7b8f08-2bfa-4c58-9284-711beab9ce61", "value": "T159B312166CFD8B60F1988FF309A761BC3A6DEEA77D0D83241D75B981F07D421060E5A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935287, "uuid": "74bf7e2e-7e8a-411e-ab94-1be58ecc1bf7", "value": "3072:CdxevimPCbbDDcR894cfTfDw/gUSMkmKeTbtR1ChG:CdxeRPCzoF0ByKkbHUhG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781935287, "uuid": "66c529d6-625e-4e06-8609-4c51461e1afb", "value": 110360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781935287, "uuid": "67e6cf12-23da-4f53-bd28-10fd7ec3bda6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935287, "uuid": "18939801-d0fa-403c-bb43-ee9b235ad7ca", "value": "kworkerd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfccdbd8-6c84-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781945310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945310, "uuid": "97d333b5-4055-4e22-a8d9-caf9a828f828", "comment": "Malware payload", "value": "47da748ded37234f01702dae0639c4f4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945310, "uuid": "30847f79-6077-4d68-bd70-827f357278ba", "comment": "Malware payload", "value": "046a8231e8c3a93d35adf8c2a8db223231da8420ea8c550812b99c0b70c6937a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945310, "uuid": "f5536f59-a8a8-4509-9ee6-ca5912785a57", "comment": "Malware payload", "value": "5769f35333efa4f25e3a56d925844fe004ba51d1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945310, "uuid": "947c55e0-a954-45b2-b9d3-1cb29efd46ff", "comment": "Malware payload", "value": "eecfc6d0ce608c6565e2c086010f3cdf17d761ef660c526a50a15e97f67f0bcbe283510c5bb6b14b977b5fd03c667cd6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781945310, "uuid": "dc37bf88-ef38-477a-a3cd-ab5f30e18ead", "value": "T137138D6956817C24AE99883B1C7E2F0CB9A983E1310851EDBFCB3CF58C496DCD219B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781945310, "uuid": "63bbe4d7-440d-4c61-8e31-1534b0bd9b3a", "value": "768:F+M9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:F+hcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781945310, "uuid": "1cbe239f-b090-4620-89f5-5dccd400ed9c", "value": 45216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781945310, "uuid": "531ed8b8-fc08-4458-a562-d9ccdaf598e6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781945310, "uuid": "9cc92f96-d684-4852-bcd6-d9fc369ac00b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d871fd0-6c90-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781950379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950379, "uuid": "7c06af4d-5b40-4708-bb46-7211897b5311", "comment": "Malware payload", "value": "f9c6eef8daaa6d984ece345941c91b5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Lazy", "colour": "#4044D2", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950379, "uuid": "e0d2ce3f-9aa9-4cbc-8677-f56dd0223873", "comment": "Malware payload", "value": "083354329045aba6279a288b56c7d09110c08dc14b0edb0ac099d01a1c0cb0ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Lazy", "colour": "#4044D2", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950379, "uuid": "9376b73b-0edc-4fd7-b284-3b8b0a9fe25c", "comment": "Malware payload", "value": "b90042dee88263ad74f802703545e83575d87071", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Lazy", "colour": "#4044D2", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950379, "uuid": "b86780ed-8c66-4256-b25d-14fb43f30115", "comment": "Malware payload", "value": "e01c0f0b4032218c66328674ea9458aaf53cf3763e534d98efd1bd4549630ad7bfff3aa21537b71314ec10b3323e46ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Lazy", "colour": "#4044D2", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950379, "uuid": "02e232e3-9fe2-4d35-be67-1fd9654babaa", "value": "T1DAD623E999C472E4D4E30600328B43EE35C1715D81EE5D0D3AC66E426B22DBF664EDBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950379, "uuid": "69d5c85c-cebb-42a8-8595-e7b0051fd1b8", "value": "87d99b0b40cd639f7186f01615422999", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950379, "uuid": "f5a03c4e-3b38-4909-a65f-1a1e7f320fad", "value": "393216:wcLcwFXoYL1EkejeBkc5mC9F/XPDTZsJE:wcLMk1Ek5kaFDTZoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781950379, "uuid": "94185fcd-6063-46ea-9ce6-91a5fa708377", "value": 13203344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781950379, "uuid": "fd3726a5-94ea-4154-9b20-ea5db55e3a6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950379, "uuid": "4576db51-bb01-4ea4-8375-48400db8ed1e", "value": "GitSoftware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f4a2f9-6c3f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781915692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915692, "uuid": "6b0a71c1-7ba8-45f7-adbf-0416b0984276", "comment": "Malware payload (Mirai)", "value": "ca1cfe692ce3a16e0f1422c1bd115772", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915692, "uuid": "32725132-fbfd-4847-b73c-c8f3e06e365a", "comment": "Malware payload (Mirai)", "value": "083c51abdd866b5148fb29a97225155a17835739acec670b42523b467541fe07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915692, "uuid": "c194bacf-efa9-43ef-af5b-e1b3f3fde25c", "comment": "Malware payload (Mirai)", "value": "aec9a9635811999518f7ace33a666e35d22bcdcc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915692, "uuid": "c10b196d-493e-4e0a-ab02-5e2ed92d71f6", "comment": "Malware payload (Mirai)", "value": "134d36172887ed5e27cfe212501c8635069e6ce81877919ea2a8d760eca23046f00ab04ae0eff93b0a8e4e4c8e3d2bf7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915692, "uuid": "43879dc7-4823-481d-99ba-d167c938b555", "value": "T195235A63CE7E2D28D659C472B9218F795763E499C2570EAA8077C2399043EECF4093F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915692, "uuid": "1f43370f-7003-4b59-aff4-9f32a0112133", "value": "768:UIqYRAdbDMsEeWwCvBK7+Zm7BaqgoJNs/GCiVR5/fGhAKIJ:FqqAdbDMslVwK7+Zm7MqPJgGCiIKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781915692, "uuid": "ce8bc1b8-8893-472d-a9a3-b5ac77e5531f", "value": 46484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781915692, "uuid": "118a5dc1-06b3-4a8e-97e8-c56ef24538ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915692, "uuid": "a7500321-9f03-4630-953d-8e5bf8fff3a0", "value": "godisdead.11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1006f749-6cda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781981925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981925, "uuid": "52e2105e-4c3f-4f3b-ad31-7989c40ee212", "comment": "Malware payload (Mirai)", "value": "63cfcc8d1c9a15b078b7cb0c5efdd1d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981925, "uuid": "2d1029bb-4c20-42b7-96f1-693b6c60b344", "comment": "Malware payload (Mirai)", "value": "08566baf2de3d75a6161ffce3611c07b15029faa32c3225dfa8409e6b2b7828a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981925, "uuid": "33314973-27a0-449e-9ece-551ceebb4df4", "comment": "Malware payload (Mirai)", "value": "109a86facc2c826f53c6465c53f8b13478aa259a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981925, "uuid": "b127edeb-66c9-49b3-97e1-eff0241114b5", "comment": "Malware payload (Mirai)", "value": "5871510d4eed497e1fbafb436b99c9af7e4a52b54f138226e97c111cd117387f8f88361a1ac9c8ca37988125776ea7a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981925, "uuid": "4e60bb6a-b8cf-4710-aa9a-d559a832ddb5", "value": "T104043802E603C9B2C41301B112F7CB765E31F9B7AE25D452D3FCEEA0ADA56D165093AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981925, "uuid": "527835ad-2b08-4f55-a97c-3e0b2a7ecfc1", "value": "3072:6pvxSRDkCQZzYsjRV58c5aiJE7/CNDh7mU83Dlpy8X:yv5dRqc5aomu7J8Ly8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781981925, "uuid": "4101fdeb-ebdd-41a9-bed1-aaefce653f12", "value": 184484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781981925, "uuid": "4a21b575-f07f-4fc9-8e7a-49f53c2d4645", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981925, "uuid": "635bffd9-3cb5-44c8-81e9-9f1b996d921c", "value": "bin.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c06dc858-6caa-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1781961605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961605, "uuid": "a2356224-ec6c-4caf-b219-29f108d22227", "comment": "Malware payload (SalatStealer)", "value": "5017c337b5a477b716148f78735344cf", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961605, "uuid": "564895c7-cccd-40fa-a282-61088f21ae82", "comment": "Malware payload (SalatStealer)", "value": "0932c80cd89391d69281f4938676d354d5982379f52381794a31f8e20fc74f17", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961605, "uuid": "583b7fe1-c6ad-4a53-abce-eb91a5c829b1", "comment": "Malware payload (SalatStealer)", "value": "5fc628830a5096201995d90855c65e0728bdcb20", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961605, "uuid": "ea48b8ef-2e45-4c87-8746-319e51f91756", "comment": "Malware payload (SalatStealer)", "value": "9c763fdc4007019758739699c62c0a1d38c56499bacd44ba95870e7997d28f207afea883e6a4a285838a1a3ec8aa7219", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961605, "uuid": "c304cc37-760a-4d37-b511-e62738c712f8", "value": "T124849E19FAA500FDE1ABD138C9634906FB757C4A43A09BCF23A449A61F236D09E3F751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961605, "uuid": "0d2df140-c408-472b-8bfa-68508a0a8939", "value": "661f8ef0408f411bc9378595cfd5da40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961605, "uuid": "529869b8-6729-4b75-aafd-b0498a4ac7dd", "value": "6144:0CczFltU3kAJRH8ahao6nA8cVpKpbJm2FB3qy:bq0JRHbao6iVybJmy6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781961605, "uuid": "6b2fd982-dfbe-43c0-97d1-bbd6866ebbe1", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781961605, "uuid": "22adfcea-803a-43bf-a4e9-571d1c48e903", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961605, "uuid": "014e141b-fe15-44cf-862b-457e096ab64f", "value": "Zapret.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51138b8-6c92-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781951332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781951332, "uuid": "feb77f2e-6101-444a-90d2-3dfedb348aed", "comment": "Malware payload", "value": "b76a5b627421f528b41412065ef0ae71", "object_relation": "md5", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FalseSign", "colour": "#18497A", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781951332, "uuid": "d817dcd3-1630-4381-8af8-297631d8c946", "comment": "Malware payload", "value": "0a253c1dc3684d623cb391f2504a2f3a1ef49e9f055346f6e0a179740f175f6b", "object_relation": "sha256", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FalseSign", "colour": "#18497A", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781951332, "uuid": "ddbdf1e0-eee2-419c-8587-78c5810cfd14", "comment": "Malware payload", "value": "08927f3b01e57676c0896c4aee43534cc6a38764", "object_relation": "sha1", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FalseSign", "colour": "#18497A", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781951332, "uuid": "5c29cb18-89d1-4498-abc4-86a4158a9c32", "comment": "Malware payload", "value": "26eb13a7572aad27db981c973e1abfbd79a86b6677701966d05b27e8771635bb841422b7390cbbaff235a890a5a93245", "object_relation": "sha3-384", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FalseSign", "colour": "#18497A", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781951332, "uuid": "c71138f6-1bfa-4274-bbe0-b663484a6825", "value": "T1FD56E017FCA194B5C0ABA232896250817B71BE451F3253DF2B90B7782FB27D06EB5724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781951332, "uuid": "716ac28e-b98a-4d11-b592-1e404c5efbcb", "value": "f604c1c3e882e6a725b213d7fdcb6bc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781951332, "uuid": "cea96553-57da-4944-8606-498d5e1409a4", "value": "98304:MMLDf8eEH0sw0d+kxAMBaVO/XqONm2Ij82AJ/ASdDGINeHvB:MgUlHnBFAsaVVFBO/9dFkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781951332, "uuid": "ff3914f0-be1e-459b-997d-f87a4019f345", "value": 6091216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781951332, "uuid": "e69c7147-4dd8-4f8d-a904-e17d2e8865c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781951332, "uuid": "b45c6c52-38ac-474b-8bc9-9ba8ecca83aa", "value": "curl_ext.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f58c32a9-6c91-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1781950957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950957, "uuid": "d2244fc5-e200-4ae8-ac97-f4dadabb9381", "comment": "Malware payload (OffLoader)", "value": "f2a520db47f163760eef8629fc4a92e2", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INNOmod", "colour": "#E48587", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950957, "uuid": "1e930cee-817c-4093-a1f3-335cd364bd72", "comment": "Malware payload (OffLoader)", "value": "0aa7360574fed7f19d3c1b9c12e0e3e90f0b415eab4d0901559fbe7703dfe939", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INNOmod", "colour": "#E48587", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950957, "uuid": "ae005825-019e-4d65-8172-a626695f2e7b", "comment": "Malware payload (OffLoader)", "value": "f545a0384505117c03a33842384f9ea397ffc835", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INNOmod", "colour": "#E48587", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950957, "uuid": "e7fb94bc-3677-4406-b5a8-0f1847c14266", "comment": "Malware payload (OffLoader)", "value": "53298190bd552ea26c7163cfe6534afff1b34e29898cdbe99f82ec6bea46bc86bc32967d1faeca4aa6db2afa6e468c03", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INNOmod", "colour": "#E48587", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950957, "uuid": "c2b804d3-b6a4-4953-8381-f03ebe0657f5", "value": "T17DA5C03FF28B653EE06A16367AB2A110943B7A6165124C1696FCF88CCF355701E3E787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950957, "uuid": "e18c86bb-e614-4059-86f7-f8ef5f1f1e46", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950957, "uuid": "bc093178-6395-46f9-958d-832141fc4504", "value": "24576:TXVrSLScusMmOvjjhzvLSIQTjxp9u8x/37Mfs/cwHbz4pj8C1j2mk3Ua5fiJ9UWf:4uI2h3S1Hu8x/3ok9bz4pICVmkZ8669k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781950957, "uuid": "841981ae-c3f2-4604-9485-a4bdc7716acd", "value": 2100043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781950957, "uuid": "b441c13f-2b62-441e-b166-378cbadcec39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950957, "uuid": "716bd6c6-95cf-44e9-990b-88db93b9e3f5", "value": "Malwarebytes Official Download Antivirus Malware Protectio.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0397aaf8-6ce5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781986628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986628, "uuid": "e55a9c84-7220-4a12-9d29-0ac9e8ef9e7a", "comment": "Malware payload", "value": "bdec0ce02002bb8eaae5a2e590b62929", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986628, "uuid": "8d15a8cd-8790-414e-a14f-5020f0826bd8", "comment": "Malware payload", "value": "0bc4d1eff24c715260b70eaf0abe32655e99a675a6edd47532aa43f843e6a815", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986628, "uuid": "34ef03f3-1459-436d-825c-ddb1bca895d3", "comment": "Malware payload", "value": "db6425c2e9a94986f2cb6eee8b8863255c3596a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986628, "uuid": "1f63e4a0-3f11-43f1-a0ef-192ef5087b2e", "comment": "Malware payload", "value": "a223480b9c0ac76bf0825df766510b4cea21c66515084e520de288002a235d5022230c3cf14ae0f8cce08a5ec48d6544", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986628, "uuid": "48226227-849f-45e2-8c42-524d17344755", "value": "T1D8560857B9924943C4E83677B8BE81C432631EBA9B8752566D04FE3C3EBE5D90E39304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986628, "uuid": "f3e5b14c-f84d-4a8f-a84f-955b727ca3da", "value": "49152:mgC9pHUZDfoCmPzCLqKwI31tWGjE53D+ld1nLUg6y+06g5EQO:mgumfft03D+l3ZEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781986628, "uuid": "529ffb69-7fd5-4fa8-a6f9-edf1585fc95e", "value": 6160532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781986628, "uuid": "386a9a8a-b947-4e08-9111-27cb43b4c3cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986628, "uuid": "0c3344f9-cebb-431c-9bc7-11d5ae457d88", "value": "jbd2_sda1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54184980-6c92-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1781951115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781951115, "uuid": "2f6b74cc-69a9-4715-aae0-45610437580e", "comment": "Malware payload (OffLoader)", "value": "349e9cfa230a379f16ba28418a73d3bf", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "InnoLoader", "colour": "#11B482", "exportable": true, "hide_tag": false }, { "name": "INNOmod", "colour": "#E48587", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "phonzy", "colour": "#0F697A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781951115, "uuid": "84d75bef-e420-487e-bf9c-616b140927a2", "comment": "Malware payload (OffLoader)", "value": "0c620497c06028c783050d81daf378edc7c0cfba3977f0137ebc3ffdd8765a56", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "InnoLoader", "colour": "#11B482", "exportable": true, "hide_tag": false }, { "name": "INNOmod", "colour": "#E48587", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "phonzy", "colour": "#0F697A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781951115, "uuid": "9ceef0a7-a95a-4838-b4fd-ddae01e6a6f4", "comment": "Malware payload (OffLoader)", "value": "afca972d30b80f02e2a2abc4d653cb1579cb509b", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "InnoLoader", "colour": "#11B482", "exportable": true, "hide_tag": false }, { "name": "INNOmod", "colour": "#E48587", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "phonzy", "colour": "#0F697A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781951115, "uuid": "fcb552e4-db15-416e-b977-028b479094d2", "comment": "Malware payload (OffLoader)", "value": "927b08344b32b0e3b120564fc8d7de537d17f19298bb7f93945a70bdf1d429fbc344e657c05b84e48f4b0e786305e2df", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "InnoLoader", "colour": "#11B482", "exportable": true, "hide_tag": false }, { "name": "INNOmod", "colour": "#E48587", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "phonzy", "colour": "#0F697A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781951115, "uuid": "546a6a71-35c0-4eac-a3f9-1654736cfe63", "value": "T102A5C03FF28B653EE06A16367A72A110983B7A6165124C1696FCF88CCF355701E3E787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781951115, "uuid": "fa36e95c-1e69-4542-ad6d-a0d174a703fc", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781951115, "uuid": "7ea8728b-b877-49e5-8ef1-448cf0f7c812", "value": "49152:4uI2h3Xb1Hu8x/3ok9bz4pICVmkZ866YC:45Onf3bX493Z8iC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781951115, "uuid": "a506b27f-bc52-48ab-885f-a14b6f4c6363", "value": 2099518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781951115, "uuid": "8c7bf2f6-913c-4b5b-91d5-32dcdd8da019", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781951115, "uuid": "522aae21-7a35-4d2c-9016-0c7ee69fbe09", "value": "Counter Strike 2 EUCheats Cheat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e942963-6c90-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781950220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950220, "uuid": "93d31e45-ace0-4b03-b113-25f7a9cd4cf6", "comment": "Malware payload", "value": "244d029d70243759e5debdccded4d644", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950220, "uuid": "ee52d48e-ea69-4259-9e86-447527b7ef95", "comment": "Malware payload", "value": "0c63ac8ae427416e67cfaebf762405a34ee7bc89e5bbd49a6ee835a4a1c2be27", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950220, "uuid": "586acb1d-eae3-42d5-a140-b184ac052a8f", "comment": "Malware payload", "value": "e96b022c3763756c19882903cca3bbcaa7878582", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950220, "uuid": "ac13432c-29ee-40d4-b396-888f851319b4", "comment": "Malware payload", "value": "b4b0497e81dce07745783b989efdc1719f06e7ce6512c3d89547596e4ac22b0a86997b0267050db32347d40791d48090", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950220, "uuid": "c0d635ad-6193-4ae0-9799-075df2acfeb9", "value": "T13524092BA3A34D78CA57D1769296D7B2E831FC140334F95F0654CB323F2AD684BAE548", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950220, "uuid": "10ed326e-d779-46aa-97fd-19bab78b678e", "value": "14117968c52953e451d195099ac0c3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950220, "uuid": "8c7afe36-1515-4b96-a37f-249a547f9df4", "value": "3072:1z98hmkKD2n5/A85FUE9Cw3GdBtflToYNbJL4yWrpQacBMGxcw6U0OlvLy7oz4Jh:1z0XF8ToYdJcnNQac7QU0UCJP5L5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781950220, "uuid": "5b0579cd-9545-4558-bf7c-e95cb4441d3e", "value": 209920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781950220, "uuid": "f37ea3af-bd87-42ef-8f30-31fdc34c12e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950220, "uuid": "cc47657a-f284-47fd-ae50-b7f31da8c95d", "value": "cache.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ef1f3f-6ca8-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781960624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960624, "uuid": "314f8edc-83af-4a06-a611-07f6ddad72a7", "comment": "Malware payload (Vidar)", "value": "8820cc652b0c3ed6dfff7c4032f646b1", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960624, "uuid": "907f56c6-2608-4a15-ba20-a1f4d24a198b", "comment": "Malware payload (Vidar)", "value": "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960624, "uuid": "71dc2f47-4660-479a-8d60-7edc30f72b54", "comment": "Malware payload (Vidar)", "value": "bf382fab74d8255350a0058f5dbec9a0742f81a5", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960624, "uuid": "0d64d5c2-aece-4a4b-9781-5f59b386a25a", "comment": "Malware payload (Vidar)", "value": "6f7bd1d875cf3cc9e4c48e274e2031012993191cbaae23e307bf085071b47ff99b35bd83789619027b0026797cd50f0c", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960624, "uuid": "b74dcbb3-155b-4e3c-bbea-ce304b45ab03", "value": "T131F57B07FD9159E9C06A633289E686923BB5BC491B3227C32E9077782F773E05C39B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960624, "uuid": "2284ca77-5dc2-440f-9edf-c14e1222bbb8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960624, "uuid": "099bd9b7-9115-4570-bea2-1431dcac6a8c", "value": "49152:cghs+CrqE1BxWP4f5wZFyEU8YoXmjpZKRC:cZY4f5wZFycjKKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781960624, "uuid": "239c438d-0ee7-4b5b-ba57-369e238f65cd", "value": 3393360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781960624, "uuid": "6f1042b6-c40a-4712-a6db-c7da802a2fa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960624, "uuid": "2f6b7620-0dd9-4de8-9aa4-9fcf9b1c2581", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08acaf85-6cda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781981912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981912, "uuid": "8f792e1c-2ec2-4f5c-9e6b-ab280c54a717", "comment": "Malware payload (Mirai)", "value": "1fcf6d9a3d8525548f966faa413ef684", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981912, "uuid": "5c49041c-98e2-41ab-9911-55df1b34802e", "comment": "Malware payload (Mirai)", "value": "0e514b653eac2ec2ecf807cf8a6ea297bc385b0bac9156025f57ad7574601611", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981912, "uuid": "cde15453-433d-4e13-9c7f-32fb2c2e3ba9", "comment": "Malware payload (Mirai)", "value": "6a6e30eb08f29d1b9712e0e2886173c4af184ab6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981912, "uuid": "4b83a117-06a2-471a-854a-4db2b414277e", "comment": "Malware payload (Mirai)", "value": "c7790b8e53cfd73cc1d02ee1688589dc6ecf8d6a631cbd77376b4e0e0a8488193e526a285bec7ad2175d79e624d21a01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981912, "uuid": "e014e825-783e-4d57-ae56-5b4fec61af05", "value": "T1DB14E946BD518F23C5C311FBFB9E429C3B2667A9D6EB3102DD256FA437864DA093B201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981912, "uuid": "7491f37c-0492-4f38-ba3c-c2cad0c5e780", "value": "3072:e+CjkHBQMdrMUTbAj71scdHTKTVlTVrERaCAJh8wUxKKjy7nGPdL:2eB5HTcH1xFWTHTFERaCAX83KKjtdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781981912, "uuid": "9d72824c-5498-4e08-9c4f-95fa3f91b610", "value": 206172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781981912, "uuid": "e2b244ed-5900-450e-8814-74803995b6f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981912, "uuid": "0b1464cd-1071-4868-af96-411bbb1bc318", "value": "bin.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e55367-6cdd-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1781983250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983250, "uuid": "fe6d7223-aa57-41ba-9cb4-3f4b42542208", "comment": "Malware payload (RemusStealer)", "value": "71682679387d5f8e8d1540e77b1b8d61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983250, "uuid": "f9050a4c-5588-4666-acd1-f76e03501ec3", "comment": "Malware payload (RemusStealer)", "value": "0e6902640affe9ac58c39d52046a073741b8e77a6ad29137bdeb6f8cf8222964", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983250, "uuid": "94f2e486-5fe8-4af6-a713-8577e2335519", "comment": "Malware payload (RemusStealer)", "value": "55168d5f90679d56f58e5f581a064cd0045012fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983250, "uuid": "173880cb-8ee0-4264-a134-a94b52c9614a", "comment": "Malware payload (RemusStealer)", "value": "ea4429b760eb6c09443015ffb7089aa21d5a923437d1ee805702fe7fd740f2273d961dcdb3edc7600b9651f53835ee39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781983250, "uuid": "7fe6c773-79d0-4939-9773-b73564c9d119", "value": "T10D136C62E1E223D7F8EB8376E9603333E5B1F44BA154564F8324DB092F3A1716568F92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781983250, "uuid": "3a6c1563-898e-4754-9440-d3d220fd373f", "value": "47274177192650375984b2b645ebe61c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781983250, "uuid": "a9c89b96-b68f-4e72-87e6-039ae555d192", "value": "768:UA8J5nZI5t6rNlslBGFbqsx4x7ONBezr+l5lfoDZPdvenF2MwLB9tB8tA2K9V37W:UfeCNlslB0xE7+4r+rlwD1dvgDwV9gtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781983250, "uuid": "15a4a289-bc7a-410e-b76c-21e7ad53572b", "value": 43520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781983250, "uuid": "0d29f31d-d019-4779-bced-0c98b6991de6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781983250, "uuid": "344cf0b8-7da8-4a33-aa43-1f62b0d6b652", "value": "SecuriteInfo.com.Win32.Dh-A.39239491", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d358a7-6c8d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781949214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781949214, "uuid": "45853b17-5ca0-414b-9c7c-96300311e3b9", "comment": "Malware payload", "value": "7655d3efcbe75f7367155735e3443fb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781949214, "uuid": "07d43be1-cc52-42d2-b4e6-ca705235ad61", "comment": "Malware payload", "value": "0e7bf1da37bfebf6b93810de5c3fd491cd582ac3a3122222d5d37ba5b08e2171", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781949214, "uuid": "c26827bb-e555-409a-a333-3f341e843634", "comment": "Malware payload", "value": "c27f00f4a9095dcb1ba3f69789513298044c15f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781949214, "uuid": "91b4c347-73f3-4b84-a6e1-12b17f7af03d", "comment": "Malware payload", "value": "e20e5dab268754f927217515cf010a54679e910b019281d73466855b116a1d51fdc18fd213e6b4ee3aa5f7db8a563cf8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781949214, "uuid": "5a37681c-a40e-453b-a2f8-50861acfd0bb", "value": "T1FAF48D5DFE4E3C41E3DBE3789F4E87E1B22FB190D32351A23941524C94C69E98BB065A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781949214, "uuid": "8fb4db7d-27cf-47ee-bea8-0a548c831e7b", "value": "12288:NXN3N6HCvrJToeYK/1kjf3ojOA4oQZC+nGGpmNHw5W74YM:h58HEknKMf4jRQZHoxt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781949214, "uuid": "4297c736-668a-4c85-8516-f6a4df87fc58", "value": 729024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781949214, "uuid": "3c2a3433-c5fe-424a-adab-e09bd28b5bc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781949214, "uuid": "8614ad2f-4817-40fd-a31e-4c931c3a7dd1", "value": "bot_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d677789-6cbb-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1781968821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781968821, "uuid": "e47e8ba9-2b71-4f69-9334-a2892f4e9005", "comment": "Malware payload (ValleyRAT)", "value": "e76c8f8521a3c532b93466301076cccb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781968821, "uuid": "d97fcc9d-7b27-486d-860d-e2985ac0e265", "comment": "Malware payload (ValleyRAT)", "value": "0ecd4eed4e6933a51dbedfb4927b330135e0df7957e4e1eb6c6cee939a5bdec4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781968821, "uuid": "eaf95705-05d3-495b-bb74-3c8ff1fa99d7", "comment": "Malware payload (ValleyRAT)", "value": "cb1d22c31403322adabd6b6f72ab53347661450b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781968821, "uuid": "fb124048-e16e-4c18-8766-97b822e4b31a", "comment": "Malware payload (ValleyRAT)", "value": "503dcffe6f0c6b43d7b1657c7b0610794d9140d3bd53bf6f2a5ada882d2cec3d37c8a1b3054d38e8061ecb04a1b8fef3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781968821, "uuid": "399ba1e4-3c31-48cb-8a8e-0097ed51c350", "value": "T1FCF7C502B643DD9AF4664275885B0FA0A361ECB4977083A722A8761C7FFE7CC6EF1514", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781968821, "uuid": "53cbfdf6-95e2-4004-b782-b44d8939b707", "value": "380560563ebacca1589d8d38ac610187", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781968821, "uuid": "a1e9b665-d77b-4637-a798-49b5a40c95e5", "value": "98304:EuX9nmn1jJ6I/EoPZQi7kmeHh2yeH7rkfvVsJnndxMcGNUXhngr/GALvixMpfrfr:FNnmnbcoRQi7ZkfvVsZdW+RC+AzmMpKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781968821, "uuid": "a5e751ee-7261-43f7-9b00-4f2a3554c598", "value": 73518592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781968821, "uuid": "4c9fdabd-1c03-4046-9aab-f20ec1c737fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781968821, "uuid": "c3d8d5a8-6ce5-479e-9923-79325fab382d", "value": "a-software85650001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7655156d-6c6d-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781935281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935281, "uuid": "dc01723a-87ab-4bf9-9677-6414bb5d54c3", "comment": "Malware payload (CoinMiner)", "value": "43b69d60c72e0f848cfe49fc404011e7", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935281, "uuid": "2a31387d-ef73-4daf-a37e-44e7b42c252e", "comment": "Malware payload (CoinMiner)", "value": "105f9320d5ad653eec8c3a3455cf105bf75458dac89cfc173d96285dc95adc5c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935281, "uuid": "49f51bfc-11e7-4f05-a648-2a7308a4e471", "comment": "Malware payload (CoinMiner)", "value": "a0daee4748623fe1b11ed0d00708d223d47d3fcf", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935281, "uuid": "0e7410f2-7d1c-4a3b-8a63-f89794533a36", "comment": "Malware payload (CoinMiner)", "value": "3b6bd0494f19a5672d2d5892e8f1a58a37b59b6b8db0cd91a9c58a5a7be3f0352e49c9534cd62465e24afbe89e25b203", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935281, "uuid": "39c7af75-e465-4938-a5dc-b0413c29cc17", "value": "T115A3020D332BCD69CA6A3C3BE71D46D983714CF5A1C181332E3017966ACB4EA864DB67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935281, "uuid": "1dda1da0-88c4-4ff3-a680-4579b76bbc52", "value": "3072:tIL/pHncApyXP+7ErHJrRdN5aPsxIUh6lkgnQ/x6FA3:G1puP+IrZnkhDkxoA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781935281, "uuid": "b67b9012-e8b0-4add-89e0-8d664819fd66", "value": 107124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781935281, "uuid": "ad048cfb-cc6c-4d9f-b38e-764f2517c879", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935281, "uuid": "4373246b-cf5a-4300-ae02-5343a821e37d", "value": "kworkerd-irq-bal", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a84c82e-6c63-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781930966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781930966, "uuid": "270f7c0b-535c-4fc3-9612-aed276350e34", "comment": "Malware payload", "value": "0e57b48d6807141ca2f6df613c90bbdc", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781930966, "uuid": "530ca843-5464-4db0-be52-223356b7cb48", "comment": "Malware payload", "value": "12de77bef9500e41c76a2200bc6fa712e7e3fc188dfdd92a764a22c3421b7208", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781930966, "uuid": "ca64243b-0518-433c-a1fb-1950ca48572e", "comment": "Malware payload", "value": "c89a5c9fd7ab86cea935e7b6ebcaa17b77d902eb", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781930966, "uuid": "317e83bb-b335-4462-ab74-c4f9420b6fc4", "comment": "Malware payload", "value": "361abcc7b948310bd32b62d8f9a6674cc1f9e347920284378fe8d6eb9232cec5f94d3224217c0806213788186175bcf5", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781930966, "uuid": "6f6da3cb-1838-42bb-8c59-752e334775a8", "value": "T12184089B689550F4C1FEE134C62AA212BDB13494073827E76FA146F10F26FF95A7C368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781930966, "uuid": "a462fb06-823c-481f-8c6d-8a03518a95e5", "value": "6144:c94NsgaeLCfHqHc6c5EBr777mMsIRbS5OX:ciZLBtBn77RD3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781930966, "uuid": "a51659ee-72d6-44b4-aa83-99fd0bb9baa6", "value": 393216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781930966, "uuid": "e53e9938-7f69-4043-9bda-8dd663fabdee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781930966, "uuid": "bbf1a026-4566-45f9-8d07-8a791e0aef00", "value": "12de77bef9500e41c76a2200bc6fa712e7e3fc188dfdd92a764a22c3421b7208", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1be3411d-6cae-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1781963047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781963047, "uuid": "cb21b256-2ce8-4c8c-af0f-eb50c6a5f943", "comment": "Malware payload (njrat)", "value": "8c84bbc4ae0513b991821a21fac9f8d6", "object_relation": "md5", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "raton", "colour": "#68B54F", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781963047, "uuid": "881c28d8-186e-47db-815a-a60b9c5bc3f1", "comment": "Malware payload (njrat)", "value": "13dd71dc712256f0bf365439e1b814f17347f5fa797577801afd5bc334349532", "object_relation": "sha256", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "raton", "colour": "#68B54F", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781963047, "uuid": "7e982efc-2aec-46bd-9dcc-39ddefd7854e", "comment": "Malware payload (njrat)", "value": "9cc3d2d139d493012fe15e7bbb3ce4cb1563d4bc", "object_relation": "sha1", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "raton", "colour": "#68B54F", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781963047, "uuid": "a20e143a-7e18-44db-9ca9-2008e9c44343", "comment": "Malware payload (njrat)", "value": "fba8315f26de2c284510eb32e6ae4ef2f72e3456b5ee42d334fa1d182c35a7a4a78879fd4618532d8771a459e3744ba7", "object_relation": "sha3-384", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "raton", "colour": "#68B54F", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781963047, "uuid": "86613b38-fce3-45f0-9872-158a37960740", "value": "T1AFE5121C73FACB18F2AF4BB4A87189664771FD179D62C76C589039AE04B6F48B910B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781963047, "uuid": "f797e2ef-6ca7-4662-b389-48298e60c5bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781963047, "uuid": "3b0f4405-706a-462c-a176-866a58245ab1", "value": "49152:JgVUlsHjkmiGWU5FLGpMZ7iKPJ5W1tsclR0BxMzaRw486Wz:JgVUuHjkDGjzqpgmwQ1GuRxzew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781963047, "uuid": "340fe9bf-b3a3-4c01-8c6f-006f06513372", "value": 3059200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781963047, "uuid": "01e6af0e-d225-4718-9900-09848fc571d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781963047, "uuid": "2c2b4948-1c46-4bcb-b917-69028afa170f", "value": "solara01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55db5fa1-6c5f-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1781929214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781929214, "uuid": "7dadbe3f-b627-4ca6-99dd-3a1ac1c62a7a", "comment": "Malware payload (ValleyRAT)", "value": "1c0209189afed95d24febf040caa52b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781929214, "uuid": "3af8283a-6a1e-44a0-a957-15385d2519e3", "comment": "Malware payload (ValleyRAT)", "value": "1603899e2cbe71abad453b7c2735a294b93e23e4bedcb9e9f8e74b08b2564efb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781929214, "uuid": "57350d91-0f4f-49e9-afbc-f096bc8b261b", "comment": "Malware payload (ValleyRAT)", "value": "232572ab53a2cdaf7fb6c68e3f80e356e88d290a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781929214, "uuid": "5fb70bb6-f904-4e8f-a6d6-be665884a608", "comment": "Malware payload (ValleyRAT)", "value": "dbfa9adb6e9deb1885a425ccbdcbd8edb763402f6159fba584473bf976f5559919ccece3ed7c188a80c1b0aa079a4900", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781929214, "uuid": "a8256b0c-ced9-48b8-80dc-2e811426dd82", "value": "T147C5E013B3CBE13EE05E0B370572A1E495FB6662A523AD1697EC84ACCF250601E3E757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781929214, "uuid": "cf94cf60-0d15-4df3-bc87-14fe8dbd4841", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781929214, "uuid": "31af33f1-8f46-4a64-8744-4944efa7508d", "value": "49152:V+MRvHbvO7diKmhA30jh67MZ2Z9ftchfudg87dqn7iMP:VrjWEjh+MYchXqdnMP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781929214, "uuid": "80087ec3-119c-46e0-a24c-77d9fd6d461c", "value": 2623561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781929214, "uuid": "e61de740-e314-4308-9537-d28b9d0f97a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781929214, "uuid": "f989d615-bd24-4fbf-8e27-d172dd1b0e92", "value": "1c0209189afed95d24febf040caa52b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf89560-6c8e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781949493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781949493, "uuid": "00365a8c-4137-4e1c-bf1a-2c34cb3d0aa6", "comment": "Malware payload", "value": "bb49dfff2bce22581f15c1ab1cdbd7b1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781949493, "uuid": "cb89aa9f-294e-45f3-a9ec-bbd87ce5b46e", "comment": "Malware payload", "value": "162a0cbd0423f4bfc77c9034caf05292492f121c5bd9a71a739ce16dff0235ed", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781949493, "uuid": "7f2299a7-c447-4eb8-b38e-eaea640254fb", "comment": "Malware payload", "value": "b1fc67b26bae2a98b183d49b85dbd8db30a62cf8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781949493, "uuid": "3deb8bf3-1af8-4381-8c6c-d2a8fd2e8d73", "comment": "Malware payload", "value": "cf6e54a6325b28e0455704709eb5157029fe7ce492e7ef517f3b75342d681f4c1eb08badf4b0e23811704e8777110c7a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781949493, "uuid": "50aa95e6-fcca-487a-9427-27bd970b21ce", "value": "T162D097A260F3003A01624801F4C6A400B0409F7F0C83C06CB91F20383F0038AF0C03A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781949493, "uuid": "4407527c-2dc9-446a-9ce3-de89ff9fe796", "value": "6:hTlRBUsUkZFoyqERa9mYAulNXYq9DG+NjVsNXYrkJ:V+sUk7H2mYPiq9DGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781949493, "uuid": "5330020e-7b41-4757-b73e-52db9258b2ff", "value": 266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781949493, "uuid": "b58f375c-3e70-4a02-a061-d0df9e42340a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781949493, "uuid": "2756fb21-c72c-4801-a161-a30cfa9827df", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2330b5dd-6c50-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781922686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922686, "uuid": "995249c1-3e54-4422-b4c4-f4e17a204b4f", "comment": "Malware payload (Mirai)", "value": "afab12f54449d7025dab11526da7cc59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922686, "uuid": "dd131fed-fd79-4949-acee-b224e6b6cee4", "comment": "Malware payload (Mirai)", "value": "16657df011d67275b43c048a4a48e35dc0d4a6d1e2a57898e080908793192fcf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922686, "uuid": "e591bfb8-6cef-4150-9e85-435e524f367b", "comment": "Malware payload (Mirai)", "value": "8bcd695b8fe6dee00b0554abd699568a16678f9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922686, "uuid": "334edce0-03a4-426e-84c6-25422d4110fb", "comment": "Malware payload (Mirai)", "value": "42abb504909b52de0adfe2691e9c8980eab9069ec8e525c72e0b1b61cc1563a7ff20004647a3ef9a12b44a15a22ef515", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922686, "uuid": "47e344a0-495d-4404-8768-f36440c46b9d", "value": "T149540906AB710FFBE8AFCD3302E91B05258C545B22A9BF367574D918F54B68B0AD3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922686, "uuid": "e39a1f2b-c055-4cc5-a04b-7ff6e50ff8c4", "value": "3072:WTY+ZYym7mSz9gtPaGcYFy0YURaWAvR6T04ug/EspedeNxGBUxw1:cmiQKtParYFRYUUZz4uPNINA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781922686, "uuid": "07dc9c6b-66fd-49f6-8e65-e9d3347270bc", "value": 285960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781922686, "uuid": "ef9c5153-1c5e-4421-8f44-5151ab25757f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922686, "uuid": "01dc0243-fea2-4da8-a5a8-0c8ddc0cccf9", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c579ef2-6c4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781922433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922433, "uuid": "687ae9b9-b7e3-4ed8-bad9-55d4510131a1", "comment": "Malware payload (Mirai)", "value": "d15ba95f5d8df2819fb5cbc497b8c574", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922433, "uuid": "98545bbb-1e86-40ab-b02a-7b09a4057e22", "comment": "Malware payload (Mirai)", "value": "1673174d77e84ad23d04496efa5264bd429fc3c2a38259ac22949a2156534372", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922433, "uuid": "3bc1ce8a-69c9-406e-8c34-94ae94567897", "comment": "Malware payload (Mirai)", "value": "2ca29d43a9aee9f83bd93ba7824bc9c3960f4072", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922433, "uuid": "7114e588-a9e7-4b58-ab61-f83cce466d60", "comment": "Malware payload (Mirai)", "value": "0115da65d0b355e43cac97b7203fd493054ec2d1513cff26f02d27863e45f426082f532d91d83ece092420884edc651f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922433, "uuid": "894ab7c6-8dd0-469f-8942-4cb6c91b6a5e", "value": "T1CB83026537E1EB3FE477C63562C61B4A7D784D03C3C12C06D2A96A47CD8E0A075D2EA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922433, "uuid": "d52b8905-ece0-433d-955e-cf5688287416", "value": "1536:lyCCVPwWOGQyEOQiOJBfldJ1wWb4M76Qe+g4L4zZQeCdasp7er294YjWwO+OsVJ+:bCVPwZGrEOQiaf3MWb4dQe+49Doe7ouJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781922433, "uuid": "c4f1df56-0804-4007-b633-4c048a1067ac", "value": 88612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781922433, "uuid": "32e3054b-d2e3-4514-a4ae-6e6c1b0430e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922433, "uuid": "28c658a4-8982-484e-a9c2-d0bc3219f565", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a222f798-6cae-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1781963272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781963272, "uuid": "6269ab3b-7741-49ed-99c7-9a2990ffbb1d", "comment": "Malware payload (RustyStealer)", "value": "a01b56eb305f46b4c8c4a72256124510", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mikey", "colour": "#B4B08E", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781963272, "uuid": "dc8cdb94-3c83-4e3c-bda6-8cc04b4208f4", "comment": "Malware payload (RustyStealer)", "value": "16f121c04202eb4a7cc68ecafdc85e66a114801e2edbcf5f2561437993bbd278", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mikey", "colour": "#B4B08E", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781963272, "uuid": "52482718-d102-4e8c-a790-a7699f32854c", "comment": "Malware payload (RustyStealer)", "value": "5b92ef29344c1dbce51dfd4632605107cd21f1e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mikey", "colour": "#B4B08E", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781963272, "uuid": "6aa72f0a-1d56-4a37-80a2-41f6d6513898", "comment": "Malware payload (RustyStealer)", "value": "72b3d9babbe9c32af282db822bb977022b02e558c8d205a3e50eb7b2b1c3af07df1521335ff769df141b00941477aca0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mikey", "colour": "#B4B08E", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781963272, "uuid": "ce6b89f9-2e98-4521-be11-a12140ab6e03", "value": "T19976F1037BFEB05EEA6BD7B4856466418621FC770D51909E31CC109B0F9BA507EBC3AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781963272, "uuid": "4d314a7c-c6c8-490b-980c-935fbcff831e", "value": "ab64a448231222006a3e3c01298b8409", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781963272, "uuid": "2e276fa8-b8a0-4876-b4d1-0dd038a1aece", "value": "98304:BIMXW/5p/m9fcj2YyICvQ5AOLYh9NQsrlubMTz9rWY3adMMw4gG:GOI2oCvCJysbGRydMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781963272, "uuid": "7e1026c6-bbde-43d8-a684-8b800c874e0d", "value": 7222272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781963272, "uuid": "d03379c3-4ffd-4d64-ac7d-47acbe941f92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781963272, "uuid": "b8492729-b527-4ad0-9138-77d0c013eabe", "value": "Antizapret.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39501b76-6ce3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781985860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781985860, "uuid": "a86166ba-73b9-4293-87a3-b8297abaf469", "comment": "Malware payload", "value": "bc2b214604bbb67b930e86de641d50fa", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781985860, "uuid": "f18f11a7-dd2f-490c-add0-e2ed0844f7b2", "comment": "Malware payload", "value": "1a16a08151ad1e698f53d70d36c0e5dafd9c2bbc3bd2710e5904f54b91aae128", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781985860, "uuid": "70a5ebd4-1902-4b17-b3d2-4858f06e95d7", "comment": "Malware payload", "value": "43c4811b6c97191f358de49f2b639fcb547b145e", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781985860, "uuid": "9ea7028c-adb0-4122-a078-bb9eb2cdec78", "comment": "Malware payload", "value": "f434f4306b8f71dab4211320dc8964e977f5c462d2b61d1d8db09e1281622bfdcaffe08ce5c52359293378db783923e8", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781985860, "uuid": "ce6ab0bb-5d28-4726-b543-688da2489950", "value": "T1F511C0041E6A0328E3F2CD3B849BA32187327806FA328F1A01D186CC6858641FC25F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781985860, "uuid": "4c1e4f52-0d1a-4a4d-9b4b-e308fd3a4010", "value": "24:87WJd67orApx+/FqH3hWkzZpS+/WrabS8c:8OS5QqxW+pSja2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781985860, "uuid": "e80a15f4-a401-4c99-a655-07aa9c90da12", "value": 1072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781985860, "uuid": "10bbf278-d35d-4f02-b553-20b8b00d38dd", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781985860, "uuid": "92db2fd7-5afb-46c5-9dea-898a2cdf603d", "value": "grok.txt.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33869c0b-6cb9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781967811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781967811, "uuid": "1f64dae6-7525-467d-a497-4e2b6362145e", "comment": "Malware payload", "value": "268f1004e646a537d62640840c7078af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781967811, "uuid": "b841440b-ad96-498f-b1b9-28dfefed4da1", "comment": "Malware payload", "value": "1b4bc24ccd11e88516235d56556c81a7fc3626a4213c7a88368e46e2b371b373", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781967811, "uuid": "9bce374d-fb9f-4e9b-afeb-f30ef9ca6c2f", "comment": "Malware payload", "value": "5c44ba23f814d84a0f0bec7a584611305ac8ca3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781967811, "uuid": "5cff8072-1b72-46b4-80df-9c268c3395e8", "comment": "Malware payload", "value": "09c7fc5526c1074f41bc2e59446cf74c6239f34a504ff8e2be3178e7ee4be45cf5362b18b9c445d54740bb5cb0224951", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781967811, "uuid": "14ac1817-cc69-45e6-9f1b-0ef6cc33bdfc", "value": "T1BB342B42BD414F11C5D636F9FABE928933431BB8D3FA7212D9205F6063CE89B0E76646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781967811, "uuid": "9da11b82-245e-47a7-9d8f-f588d74c8058", "value": "6144:RFEpwG0zwe1hdBfv81a8q4a6UK5aXWDZBuxhda0b:RwSweNt+a8q4aBK5aXWt0vda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781967811, "uuid": "8647f82c-96bd-49e0-b8c3-595ed178605f", "value": 245976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781967811, "uuid": "04419992-06e3-49c8-a2b3-f23ae65a7519", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781967811, "uuid": "0d8b06f1-3035-4ded-aefa-c8e8e9857fb6", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5787e4d0-6c5f-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1781929217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781929217, "uuid": "edfe0e85-dc14-4461-bf2c-558a4062fe9b", "comment": "Malware payload (RatonRAT)", "value": "265e831f3f4a7f9e9f0bd340ccd48970", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781929217, "uuid": "2b15c28d-99ea-4311-9e39-e63a5fef16d5", "comment": "Malware payload (RatonRAT)", "value": "1b5b4a0561f9844f59e0b52069a5c3eb5977208a29cd25bddccff8ef8391dae5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781929217, "uuid": "ee9a7553-7001-49f7-a291-e99d75fe87ef", "comment": "Malware payload (RatonRAT)", "value": "29c5c9b33faba17463103e651d2372c8bd53b181", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781929217, "uuid": "9431de78-f44e-431a-b1f0-fb905176bc1d", "comment": "Malware payload (RatonRAT)", "value": "2879cafb7f32d78749e1f81b138741b07419de28279520c2e3d01298b33bc9a1bed75443307bd65250f291b13cae46c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781929217, "uuid": "2c9c5a35-7837-44b9-a514-fe2e77b32a28", "value": "T131D5121C33FACB18F2AF4BB4A87189664371FD179C62D76C58A5399E04B6F48BA10713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781929217, "uuid": "fd1aa103-37c2-4613-82fe-a4940c7cf0ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781929217, "uuid": "924d39e8-c030-441b-8e30-e9baf3d51493", "value": "49152:RgVUlsHjkmiGWU5FLGpMZ7iKPJ5W1tsclR0BxMzaRw4D6WZ:RgVUuHjkDGjzqpgmwQ1GuRxzew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781929217, "uuid": "e18d7aec-2a03-4ba2-81e4-1fb5ac7934a6", "value": 2945024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781929217, "uuid": "03db8b6e-1543-4d12-bae9-4669bc403cea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781929217, "uuid": "dae4b176-f36e-43c7-b13e-508409b0e3db", "value": "Madium.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2072fd7-6c64-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781931489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781931489, "uuid": "3fb62486-5dd9-4ed7-8c15-de12bd4504a2", "comment": "Malware payload (Mirai)", "value": "5527e85264e0ab0eada3377d918e439a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781931489, "uuid": "8d956385-0fac-4bdd-a18a-800172a1d83f", "comment": "Malware payload (Mirai)", "value": "1c4985d2f5cd45688712236b0746f6e756f9196b5942a729060ee1e89d962855", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781931489, "uuid": "3ca02c0a-77c4-422c-814e-7448c27516f6", "comment": "Malware payload (Mirai)", "value": "3086f7be45a5fca68bb659fdb0cc01a8786d9e4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781931489, "uuid": "a98d3dd2-af09-40ca-ab32-e94b03c3789a", "comment": "Malware payload (Mirai)", "value": "34132466471479344c2fdfaca1251fc0c246742e1fda6b2165c17fd9fc2b926f899ba1b19d386d2b74d8322cc1b2a629", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781931489, "uuid": "6b0303a4-8f4e-4376-9400-ffabd7531d06", "value": "T1A354D60A7B519FB7D46FCD3306F98B0128CCB45335652B7A3670E65CB62A58B0AD38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781931489, "uuid": "94727ef1-0a95-4f7b-92aa-4763de560dfb", "value": "3072:5r8XEqqlQzmhMfC9oS/ZmtrMyuIHZTC7gqpUoCGtKO6jRRnGcLQJJ:KXtrMMpygYjKtjnLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781931489, "uuid": "583c159a-f02d-4442-8256-49d202f7239b", "value": 305584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781931489, "uuid": "4f521468-f947-4aee-9005-fc257a58b406", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781931489, "uuid": "2a2dc4a1-639f-4220-a87b-70805239f69d", "value": "bin.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846aeb21-6cda-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1781982120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781982120, "uuid": "3daa7536-321a-4dd4-a32f-1e5ea1f6fb33", "comment": "Malware payload (RustyStealer)", "value": "1dea9bcf5ed297e9803b91e6b75fd3f3", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781982120, "uuid": "070b317b-5078-46df-b474-2c247306a7ba", "comment": "Malware payload (RustyStealer)", "value": "1ce931d621b70d14bdc90b5dcb8dc8cfce60e027f60eb2ff895c60efeb8ffbe7", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781982120, "uuid": "9446ec06-63fc-4419-bc8e-93d398957d11", "comment": "Malware payload (RustyStealer)", "value": "4c219a04109734d4a50f591c720fa15c2e951912", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781982120, "uuid": "c9ac77bf-911f-415c-9e67-5ee4fae89a9d", "comment": "Malware payload (RustyStealer)", "value": "69cf29bb9764cc59a8d36ea4e6b3a7a0cabd4b9f6c29569aa3462c88cca6e8b53894f1e6a8edf23ae14e342f6c8e1bba", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781982120, "uuid": "daab5a91-39aa-4da1-bf65-e1515a9b1886", "value": "T10E264B03E2A541E8C09DC179C30BD637AB76B88A4631B29F1BE81F612F69F506F1D749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781982120, "uuid": "56574cb6-ba9a-4b34-b951-b8789f021572", "value": "a30c78a48c548a65b4846cfd9d8c7138", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781982120, "uuid": "11ad1ec3-5d07-4bbe-8929-5cecbf91e0da", "value": "49152:LiHDazMZq/LXnxsCCGByl9Ah/uN0D8dfOBVgcjKoeW7Zi5u4KW7r+Da3dtUxnkdE:WHSGrQFpgIKscOi91Ehyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781982120, "uuid": "d12d6e93-b074-4785-b850-b428232e5ebc", "value": 4859160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781982120, "uuid": "1811b640-e6cc-431d-90ac-a420dc9ccda3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781982120, "uuid": "92474663-d237-47e4-aea1-13c95f3c38cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f0dc2d-6cda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781981926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981926, "uuid": "315def89-306b-43a0-b416-ef457e3c5ecd", "comment": "Malware payload (Mirai)", "value": "c1c92d6f641044432575ee8255ac880f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981926, "uuid": "3c5c7767-0c76-47d4-b2c5-9beddd978da6", "comment": "Malware payload (Mirai)", "value": "1d99ff30758e487264c3550c2b0c3c37646e772266882809898a2ed0c5f74c4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981926, "uuid": "6883655e-5cce-4cd7-a6ae-d95f1f2bb42d", "comment": "Malware payload (Mirai)", "value": "be4fb9ffe1bd1cb8680d0b6b5f1a3615158853f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981926, "uuid": "79f7bc6e-b973-4851-a509-b9c48ef16808", "comment": "Malware payload (Mirai)", "value": "88bd73982394136bf9f59d5eae57f8d971b4969399116b6d96eba25a51d388c5a5e5363644a8ec05587d616343664ce0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981926, "uuid": "c9c9edfa-191e-4fa4-82e3-500fb215c47d", "value": "T1FB548A1A2E22DF7FF66D867047F389305A9876D62AE1D544F16CE60C1F2028E641F7E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981926, "uuid": "05161ac1-335a-45ed-a16a-64a51b6deadf", "value": "6144:kRR/4cIFzpz7L+gjX25sCwDrSalSqZD/TZ+jukK:Npz7TT2wDrojuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781981926, "uuid": "d05ec4c8-b0ab-4b27-a0ac-11ce50368a40", "value": 304656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781981926, "uuid": "b4827d7f-cd91-4abe-b5c3-044a08af96d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981926, "uuid": "6dcfaa84-3e63-4ed0-bc2b-2c64c7820646", "value": "bin.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5016ddb-6ca6-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781959975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959975, "uuid": "194ea673-80db-4f25-b49b-ca31b840ac51", "comment": "Malware payload (Gafgyt)", "value": "baa67d1fae131dd2ef4022b695e2df64", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959975, "uuid": "acd9c88b-b6ae-4408-875a-36fc16d6699e", "comment": "Malware payload (Gafgyt)", "value": "1ddcdf43d533e234a560a9625c33d5692bd403de65537acfe554427de1ace988", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959975, "uuid": "8208e731-4118-42c6-8c8c-a8ee5e8182f9", "comment": "Malware payload (Gafgyt)", "value": "52c4cebac510b0300b28079661cb6d0a968828c5", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959975, "uuid": "4ca7a74a-3467-43b0-a6fc-1621451d9988", "comment": "Malware payload (Gafgyt)", "value": "f3adc45207b5ea9769e1fbf793e279111687f42a698a3bf7a93f700646ba013e00337d60a0776053efa4a3b8677df5b4", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959975, "uuid": "4b312507-4aec-44f2-99a3-8b4ab8d0f46f", "value": "T167B37D1B6292C6FAC08356B527DFA2A18423F67A0B36721B73D4BDA43F15CC95D2D381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959975, "uuid": "7f6ba912-08ba-4e73-9809-ef514e565765", "value": "3072:Pl2n/WelPFo8NezN3/S2VvXqpha0fZPCZVOXinYuM8R:FIy4QN3KjphaQZPCZVOXinYuM8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781959975, "uuid": "1878f354-96cc-48df-a9c3-eec93c919324", "value": 112832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781959975, "uuid": "494b1426-5a60-4e1d-8c86-e3260e55532f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959975, "uuid": "9357ca3a-53f6-4933-ad25-35f50e4e0ade", "value": "assailant.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b95792-6cac-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781962557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962557, "uuid": "a583b611-2623-4fda-963f-ebba5be859b6", "comment": "Malware payload (ConnectWise)", "value": "31a28a1e13d0f9cb638cd445f2acb559", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962557, "uuid": "3f65f236-a5d9-4c04-afc8-55c96b4b9bef", "comment": "Malware payload (ConnectWise)", "value": "1de74088c8dc5abbb6f5c8d708d0fa4c396f5474e27eb56a8c5e961464b89c3e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962557, "uuid": "61915c94-d48a-4f9b-afaf-c245f540fff9", "comment": "Malware payload (ConnectWise)", "value": "b9b32ae4989254713d181e658f1fadf6725611f6", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962557, "uuid": "5bde2219-4211-43d7-adf6-9fe466d38203", "comment": "Malware payload (ConnectWise)", "value": "84053fa9e3be9ce0b56c6e2e1a3ba268784b1710c84282792a17d0b9f1c425750ced4ca13a71df4275c72ae4337ffdf4", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781962557, "uuid": "be0603d6-38b2-4827-807f-103254b23f8b", "value": "T111646D11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781962557, "uuid": "2ecd5ea1-88df-436d-858d-5a57afe27dcf", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781962557, "uuid": "5484ea1d-991b-450c-a405-f9c9bc67c531", "value": "6144:amlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9+:p1iw7gryNkSV1hy1Z1u2JLu9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781962557, "uuid": "f98fcb2d-393b-4cbd-abe3-3a38bf26d9a1", "value": 312536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781962557, "uuid": "0e881c79-deb0-4d25-9dd5-406704f2f290", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781962557, "uuid": "36184a63-cb52-4676-b892-410d9598d4a5", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbee2dea-6c97-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781953437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953437, "uuid": "d860686f-4304-4a0e-8545-5e37cbce7ca6", "comment": "Malware payload", "value": "849be7b7b4d5f4d1be3bb351aa04c532", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953437, "uuid": "1d61aaf2-e5d0-46ef-bb7a-8f51c2eeb41a", "comment": "Malware payload", "value": "1e40fcb973b648b3e599d00167ff8408db011ad30bbd1d3117b107dae10eb660", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953437, "uuid": "7d75793f-c3bd-437c-9a81-e8ca8a283075", "comment": "Malware payload", "value": "da4f33459ddc73e8e376ca486f495d993b4709a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953437, "uuid": "88232c0d-0a3b-46ee-acfe-cb796fd09592", "comment": "Malware payload", "value": "3dc297b93dd396e7ba5d4bc5e0c75ed3a66610efb47e2da29976bb4f5264449e395ac312d5186068e33a76d5814fddb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953437, "uuid": "399f2ef2-6b97-4d40-9b30-688b79c20ebb", "value": "T18C51DF677677493ECA6C923D8F971B30F663A50D1284A270FEB164DC68101813B332EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953437, "uuid": "06214bc6-d965-433a-965f-10e391b0b084", "value": "48:tZ1j3XWktYALj0oRy6wT7p9xq6HySzRUUUiNS4J:tZ1j3XWszLj0oRy6gpPq6Sac4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781953437, "uuid": "6e714a3b-f6b4-4784-9913-4e985b1048fc", "value": 2440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781953437, "uuid": "ec69f372-0b9a-492b-91cb-991f1d707002", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953437, "uuid": "d7666f19-503b-4a87-924a-8d8ca77bf592", "value": "dlr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e765ac8e-6c98-11f1-a769-42010a9c0008", "comment": "Malware payload (Meterpreter)", "timestamp": 1781953939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953939, "uuid": "874bd6d1-0e9b-4fd7-862a-e3c3cf96d38d", "comment": "Malware payload (Meterpreter)", "value": "c2005d83afa2f81ddeb3c4513734d3b7", "object_relation": "md5", "Tag": [ { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953939, "uuid": "863114e8-0977-47b3-a6aa-cbaf7db804cc", "comment": "Malware payload (Meterpreter)", "value": "1e6d5898bea2ebf6b249707ea4235e17e009eda510f2476ce885b97fcd8c26a2", "object_relation": "sha256", "Tag": [ { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953939, "uuid": "05c705c2-abd6-498f-ae3b-f4458a94eaf3", "comment": "Malware payload (Meterpreter)", "value": "cad40d347c87fc9bc1a2f1038e4e8761a6cc080c", "object_relation": "sha1", "Tag": [ { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953939, "uuid": "5afc6df5-e0e2-4ac9-a6ca-e78f164d5fc6", "comment": "Malware payload (Meterpreter)", "value": "12ada14e8903a663b9967a42fbf0c705c53fb3523ffa45963e2554c1f6de8447df79849423d43a81d76ddb8ba7d54d39", "object_relation": "sha3-384", "Tag": [ { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953939, "uuid": "db8df757-6b73-45b9-a0d2-741efbec24f1", "value": "T1B4F14583A3165C77F6390AFFC643DBA592FDBB341367075E051C102A314091A7975A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953939, "uuid": "e2c7d7f0-dd4e-4717-9ced-2e3111745506", "value": "c2d02fc98f1d75d7b9457468ec75da0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953939, "uuid": "a8af8fc5-1a85-4678-8426-eb8aa3e12139", "value": "24:ev1GSkiiljEz0ApFNknehtht6dp57RLFW3KLq41sudqRKtp:qkfjW0AanehthEd3W3Y1suM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781953939, "uuid": "1cfe8e15-1b37-4b4e-947a-c43edd60633d", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781953939, "uuid": "63c187f5-234b-4c1d-953a-bacfb334d3f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953939, "uuid": "6ca78ce2-6eb3-49e9-8055-8eedac3a184d", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7105fe7f-6c90-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1781950305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950305, "uuid": "b5f38f61-2e60-4114-ad1e-01de9cfe6c2a", "comment": "Malware payload (OffLoader)", "value": "4adc725ae202f23ad01591296b319b35", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "InnoLoader", "colour": "#11B482", "exportable": true, "hide_tag": false }, { "name": "INNOmod", "colour": "#E48587", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950305, "uuid": "764033c4-1ee4-4479-b59f-368d23c8c848", "comment": "Malware payload (OffLoader)", "value": "2090ac8bf02730c9985699b9c4a0324402a8c354a69e051da82c7a56655631de", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "InnoLoader", "colour": "#11B482", "exportable": true, "hide_tag": false }, { "name": "INNOmod", "colour": "#E48587", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950305, "uuid": "145d7d02-7c61-4d07-a29d-8e2792bb471c", "comment": "Malware payload (OffLoader)", "value": "2889af8ff5cee275e337579fba89a6bf45394a78", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "InnoLoader", "colour": "#11B482", "exportable": true, "hide_tag": false }, { "name": "INNOmod", "colour": "#E48587", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950305, "uuid": "c03f7f23-d37c-478c-9e77-57b8949a1488", "comment": "Malware payload (OffLoader)", "value": "e0220d52968ea9795fd869847ebd6c50425fd8791fec3d19e2ed7bd9c128f2b8bf6cb65b110a9bdb5d64cc6cba0f472b", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "InnoLoader", "colour": "#11B482", "exportable": true, "hide_tag": false }, { "name": "INNOmod", "colour": "#E48587", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950305, "uuid": "b36cb2dd-c0a8-490e-859a-b900572a421d", "value": "T136A5C03FF28B653EE06A16367A72A110983B7A6165124C1696FCF88CCF355701E3E787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950305, "uuid": "c0bc6a2d-200d-42fa-b15a-5680605b895e", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950305, "uuid": "ba9c6c40-ea49-44fa-b7c6-75638fb5d8d0", "value": "24576:TXVrSLScusMmOvjjhzvLSIAwVFjxp9u8x/37Mfs/cwHbz4pj8C1j2mk3Ua5fiJ9q:4uI2h3b1Hu8x/3ok9bz4pICVmkZ866l9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781950305, "uuid": "341d69db-f154-472b-a88c-6f52ba329433", "value": 2099979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781950305, "uuid": "1005628a-a3fb-48f4-8e97-2f8276d17393", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950305, "uuid": "404041ce-0a12-4107-b502-3e8fe4d5c356", "value": "XForce Mod Menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97bf5be6-6ce7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781987736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781987736, "uuid": "1040bebb-cfdf-4a9f-83ed-57dfeae06ca8", "comment": "Malware payload", "value": "ff9bc56dc6dee34844e2d123d1b438a5", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781987736, "uuid": "8ffd461a-c28c-411c-9b40-f81014c471ad", "comment": "Malware payload", "value": "23c8252953a84b9735a79946efcb1f2b46d565905e2f032380d7c0a5940667d0", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781987736, "uuid": "1d54a352-d71a-4cae-ac1b-f915f4343888", "comment": "Malware payload", "value": "db172edb113c479a8d383341994b7baecd710bb5", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781987736, "uuid": "5014ff8d-b534-4395-a133-8fc5a2d7ef4c", "comment": "Malware payload", "value": "fd89f93ffba495ff5677fb4dc15e809aa9cfb08d4739a9ab2affba99aaa8616c67d69eb77f33d7c3b65375d73831fdb2", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781987736, "uuid": "2f7770e5-5df7-454e-8fd1-520f066a4150", "value": "T1131833206F948CD6F59231399A916244E3E3BB6417718F9E0BC06B252E275FFEC39361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781987736, "uuid": "545165a0-c611-4e08-9233-4f8e26f555f5", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781987736, "uuid": "5e014b7f-4125-4f8e-8509-b048dbb1729b", "value": "1572864:7AYyyxBU7rUFpYrHK8o8iLxMtQ6ZMo/STJ6ppJ2FNwW5wF:7fxgkTUc4R/U6pXoQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781987736, "uuid": "a2bf9ca2-efd4-41f9-b93a-a5f1314f4df4", "value": 85019201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781987736, "uuid": "9bda2947-5eaf-440e-84db-e7b977182edc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781987736, "uuid": "9c6a00e7-093d-4dbc-b71e-0b5c58005a51", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f594f2b9-6cab-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781962124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962124, "uuid": "7714f4df-0183-4635-88bd-635003ff9deb", "comment": "Malware payload (Mirai)", "value": "4edda2e032883898e68bc55d5a5ebd2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962124, "uuid": "f020a6f2-1f46-47bb-9cc2-3b7dc61bde67", "comment": "Malware payload (Mirai)", "value": "23e64211c74dd1d1a8d0de4d47231a1344cd8f42938ad0a6fc1456d357a5d38d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962124, "uuid": "5c04f6e0-d253-447a-ba88-3427c41f1c7f", "comment": "Malware payload (Mirai)", "value": "3f78b12b1390e65bc8b5641ece4edfd0e33576a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962124, "uuid": "dcff8446-eaf0-401c-ba7b-7afa005a2f5b", "comment": "Malware payload (Mirai)", "value": "7e5796cdc3773b2d9916ec7f0ebc3c148ce69fb104cbd90f7a292f61fe8cf4dcb3be09e02910257fcf42ec8b85a1133e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781962124, "uuid": "80691699-e8d9-45cf-865c-b3b31e967d35", "value": "T15EF64B47F9A614E8C1AEC470866BD552BA717C88072177E72B94F6302F37FE05A79B20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781962124, "uuid": "385fe525-edd7-43a7-80a8-6aa1b116d3da", "value": "196608:YFIpr98r9l4lcmDi1WIPFCBNcJ7oEkLsQXI:YYp8vOqUqFCIkLsQXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781962124, "uuid": "d3b1f5bd-87ca-49b2-b1b0-5bf55b91dac0", "value": 16748706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781962124, "uuid": "5e6d6983-df15-4ada-86cb-47a4577ece48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781962124, "uuid": "58ef2603-abe2-46bf-990e-e4edec31c00e", "value": "SecuriteInfo.com.ELF.BitCoinMiner-HF.61811766", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97927a5c-6c3f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781915580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915580, "uuid": "6f33594c-a3f7-4fcf-a101-e0b770283766", "comment": "Malware payload (Mirai)", "value": "6aa2e3b2298b6a3e71e5281eeebadb6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915580, "uuid": "f6788af7-df3f-4183-a793-c6945f5562c9", "comment": "Malware payload (Mirai)", "value": "2492aa85adf7498df561453557e95672b1abaa00a668d7a36d2df57af939d8be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915580, "uuid": "31971f92-b741-4230-b490-2e4df9446e01", "comment": "Malware payload (Mirai)", "value": "eb0744c5f64c5f89b0983a37a7c7432fa5781306", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915580, "uuid": "ff26c498-403c-4d50-b38e-5b4313408104", "comment": "Malware payload (Mirai)", "value": "a58a8e61176c58ff64d8851e52bb9cf8739de504eb8f584bfc710598b97bf0730ac7214afdb895e90f68a979405a1ef4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915580, "uuid": "f674fff3-b0f0-4544-bd22-d9f2c8883c63", "value": "T10563085ABC819B15D5C1127AFE0E128E73131B6CE3DE73139E24AB20778B6670A7B416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915580, "uuid": "bdd3ebb2-1528-45bd-a000-dab7e6a21666", "value": "1536:hMngt6b4R2v0bxsbfMakeR+6MWis/7xsK3a5kYqj:5gvfbUa7/7xsK3aq9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781915580, "uuid": "2bcf5507-6a2a-4940-82af-fccb8ec92326", "value": 66912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781915580, "uuid": "f7f4a1ae-2206-4492-a171-c1c8ffbd71f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915580, "uuid": "50746d5b-fbd2-41fd-95f3-da34ff65e9ae", "value": "godisdead.6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2644b3c0-6c8f-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1781949750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781949750, "uuid": "8db6d7fb-ebe5-4d64-a6a0-5721fcc573b4", "comment": "Malware payload (RemusStealer)", "value": "d59f411bfc7ba601bb65d54c1c45c97b", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Gsb", "colour": "#B947D4", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781949750, "uuid": "b27df866-cc35-473e-b068-bb10f502f616", "comment": "Malware payload (RemusStealer)", "value": "25a0bddff7a3254104b66d4e84010c59ef192924cae703655f7fb592640d8d5d", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Gsb", "colour": "#B947D4", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781949750, "uuid": "85c04160-6c4b-4b7a-af42-5ba4559de685", "comment": "Malware payload (RemusStealer)", "value": "0e46f24369ecda82275112c48c025287ed117e00", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Gsb", "colour": "#B947D4", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781949750, "uuid": "5aaf813b-4921-4108-915f-59f1d270167e", "comment": "Malware payload (RemusStealer)", "value": "acb32d61fcbc7ba4320da7101b7444935c9eaf91eebcf779821e3b7f0fb30b0e571349106510c5e87fc053b31f508259", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Gsb", "colour": "#B947D4", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781949750, "uuid": "d2df0cc3-4d08-4b6a-94e5-6511510df5ac", "value": "T1D6A56B46BC9009B6D4AA933588E61251773CBC9C1F3627D32F50B2BA2F767E45E39318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781949750, "uuid": "3e4198de-3885-4fdc-a354-0b4ec20b574f", "value": "7ecc3b9e18c31c23f5275a91f6c533d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781949750, "uuid": "c1bcc870-30f7-4a4d-8a81-bba1e3b4fb9b", "value": "49152:Nj6DnW22mtRIoWD1g5IZ5sEvZgRmbiJaSRw:0zRIU5IeoSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781949750, "uuid": "f4447f42-ee5a-438d-bcd3-6a88b0ab2abd", "value": 2133568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781949750, "uuid": "324aa05b-ad56-43fe-9551-059acb4db442", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781949750, "uuid": "73896d3a-a292-42ac-8e69-a6e64067e9e7", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72600dc0-6c7b-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1781941288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781941288, "uuid": "85fc378b-d6ec-4aed-9f67-12d9a4dc4085", "comment": "Malware payload (MassLogger)", "value": "85688769656f714fc64a392e13736b48", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781941288, "uuid": "5be81f7c-a680-4e24-818b-bd56b91a152c", "comment": "Malware payload (MassLogger)", "value": "2606ae6c08a0928daea40db4f28c32e1056465bf31457c5bc3a106f5c445b18b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781941288, "uuid": "a8c45b63-467d-486a-bc68-053cb057b284", "comment": "Malware payload (MassLogger)", "value": "4c30b292ca9f627d0d0faeb31d64f349af2a7d4d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781941288, "uuid": "b26d2493-64b4-4ff7-a6c0-e3ba2e07919c", "comment": "Malware payload (MassLogger)", "value": "23e058680809091fa429f767417bf120b164715e10ed653bb011ce401d731a59c78808df38ff7a4cd746fe0f08eb21b6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781941288, "uuid": "c26b3fda-18e1-4586-ad3f-26ac3a067728", "value": "T19316F93CCD68412ED2B6C628858A044FE8973E4B563DE84B65CB234F5FA39427BD532D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781941288, "uuid": "37459f55-ccf6-448f-bd0f-199c2c8ebbae", "value": "3072:eNKMiws6mqkFPuzDCUR3ngic1C4ZeFQQFp54G7fJXBbLhx7/Qoppe0vM8PB8VK8n:Hws6y96A/8r54QNLSsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781941288, "uuid": "21b33509-b0e9-4f2c-8957-70083ce5250d", "value": 4043178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781941288, "uuid": "5fc3cf45-0ca9-41a3-8891-b3828f54e5ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781941288, "uuid": "c27b6a60-9a3a-4f45-bb07-40619bc0a852", "value": "RFQ-ALBA-0001468.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ba2435-6c6d-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781935389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935389, "uuid": "d06aadc6-9193-429a-ab9f-5c6c12b993e1", "comment": "Malware payload (CoinMiner)", "value": "706f361ca2ba275d8a9f5f863d8d8ca4", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935389, "uuid": "13ea08de-a209-4be6-9f0a-90d7da9f3681", "comment": "Malware payload (CoinMiner)", "value": "26986a0e1191438a458efbb6907a19b7ca44ee88ddb37c1938b2b7d9b697379d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935389, "uuid": "9a57716c-4ec8-4672-b9e6-16a085fb0269", "comment": "Malware payload (CoinMiner)", "value": "9001998272676accfeaadb17721a7afdd4aa7db7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935389, "uuid": "1b04ccd2-9cb9-4660-ad1a-eca35a296107", "comment": "Malware payload (CoinMiner)", "value": "80bf09cc336a0cf013ccbd8c4b360d7a5c274d4a01fcc6e02fad2c51b3b81313f73dc0540197751878e2a6499ef3d7ce", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935389, "uuid": "59594f8b-3a64-486d-994c-6be906d281e1", "value": "T108645B02FF441E43C5411FB15D7B07B6A3AD48916CA8E13D9E0BBF2506B38B9A5DB389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935389, "uuid": "5e773b87-d18a-4d23-b140-005ee0d4ac06", "value": "6144:q0vNlk/00Lckn0UpDXAFB6cB5GaQMGMiXMJYLgCIRR0BrjsVGJOMwkIp:lGAwrdaicZiskAMwkIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781935389, "uuid": "bc133f89-77ec-4c0d-8709-78845ea82a15", "value": 329176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781935389, "uuid": "7db54b89-7f43-4ccb-9f5a-1d68918883d0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935389, "uuid": "d3700374-98f2-4360-bfd3-9bb5e52e7a39", "value": "kworkerd-writeback", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7012a3-6cda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781981917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981917, "uuid": "ac452220-dc3b-44b6-b76e-02801997f4bf", "comment": "Malware payload (Mirai)", "value": "4c70743f45855b0a98b113e8cc65fa52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981917, "uuid": "5a732c0f-1010-4bd5-b4d0-4338383f3c95", "comment": "Malware payload (Mirai)", "value": "27176ee65139931eb8f230b1a681bfaf74bf4685e468bfbf5487ff03d1a80b15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981917, "uuid": "a5a32c67-7182-4186-849f-53f144d5c676", "comment": "Malware payload (Mirai)", "value": "74683b8fbb03ac404a0ebe5e861d57adb02ae26f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981917, "uuid": "30ec6bb7-8a69-4c08-a91f-5b922d773615", "comment": "Malware payload (Mirai)", "value": "f5c229c4854f05c3813c2cbe5c78e6c31aab8d1660bb7d7754e86fbbe1fd0ddfb2604de25fe3465685fa7649d2918205", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981917, "uuid": "75303c22-dc08-4549-90f4-6dea13ed7655", "value": "T1E374F8113B47EC7FFD6A03744AF78E7477D865A225A1858AE26ABF4D0F250D10E0CAC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981917, "uuid": "8a4596b4-cb09-4a3c-857c-d000a1ed97c8", "value": "3072:y9QXEIfoljT6IhEu3tXk0ph7CJDVPRTfdX5zF/Bnjfq/JM4Yn8dDDbIVz3VpFHym:eioljT6IhXrPm7TKJcoOVpLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781981917, "uuid": "bd4fa93c-1f02-43f1-b338-9cb0e0d176c4", "value": 342296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781981917, "uuid": "7b4935de-7398-4c2e-af68-78deae734e31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981917, "uuid": "d5b6df5e-2e66-42fb-8e7a-52e00064a24b", "value": "bin.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b0e187-6c8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781948571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781948571, "uuid": "3006c8f6-ef50-42f8-b7e9-adfcf3243491", "comment": "Malware payload (Mirai)", "value": "7781b6c5acee8f17b306513ff6b7e174", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781948571, "uuid": "00316f6f-7f58-4d6a-8bcf-b61227cb08cf", "comment": "Malware payload (Mirai)", "value": "2737fda2f5613f31ea14cc075d3390bfa9a4285c2376a41a89592a8e10b98f80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781948571, "uuid": "485f0246-5fac-4b66-8dbc-9680039511f2", "comment": "Malware payload (Mirai)", "value": "124604993d215a5921ff795317cfa44f39804d0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781948571, "uuid": "4afa4254-f9d2-4cd9-8702-53b0ee5ed59f", "comment": "Malware payload (Mirai)", "value": "3d015bb5a9257e39760d5ee759a915e0898f73dd81a12bec7693c031bed2459c3940bf99b30e113a4d7654481716a356", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781948571, "uuid": "9551a2df-b856-4c54-aaf6-9f07a7cc348a", "value": "T1A5258D2EB2B3F5BCD00BC03447DBCAA25535B47526212DBB36C4DA353D66CE12369B62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781948571, "uuid": "09f7e60a-1b43-46f1-a563-5a9bbc140411", "value": "12288:xXnipeE1kp2NgTcBbwcpVFWe5d0HADBmrS9I/wH9r9TGKJ8++jalb3zayqtuigHB:xXnip1K2NgUwgV7JFZiKSZalbGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781948571, "uuid": "446d5956-61d4-4dee-a636-f8c595acc06f", "value": 969256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781948571, "uuid": "26901534-cdf9-4cc6-aeb4-4e6aa10db9e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781948571, "uuid": "c3697dcc-6600-4ca4-9b57-1e1c2bf246d2", "value": "bot_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39ddaca-6ca6-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781959973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959973, "uuid": "6d644a6e-beb4-4cb6-b115-44758fc9bbe3", "comment": "Malware payload (Gafgyt)", "value": "2bd88e6dedf4f0356a95a72649098f1a", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959973, "uuid": "9d1bad73-8b05-466c-8b2d-19c2f35e59b0", "comment": "Malware payload (Gafgyt)", "value": "28a8fd63053552448f5571b1c08065e8acd21985610a3135e71a524a3e68d0c0", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959973, "uuid": "88fb531e-99f2-4345-95b2-0d0708c7f29e", "comment": "Malware payload (Gafgyt)", "value": "859d8bc5eeb2d527956873ba99b1a210669fbea7", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959973, "uuid": "347a46cf-67cf-4319-ab13-744dd2260ef9", "comment": "Malware payload (Gafgyt)", "value": "1fec7e27cb4b7f456960d600b397bc78dc7e57d83265bfea8aa94958561464725b30cd695a4e417097bae6e278955051", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959973, "uuid": "0b81cb90-ae53-47f3-a04e-c6723cd00c34", "value": "T16CE3656E7E21AFBEE268C63107F75F708395219326A19382E26CDB185F7128D1C5F790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959973, "uuid": "e5a895af-490b-43b1-9976-64e32348ac7d", "value": "3072:3C0dBwQf7g8+t+25hKGx8YlxRxulq+1uPNd5R:yCvUM25hKGxblxRxulq+1uPNd5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781959973, "uuid": "4dd18596-f260-4c18-bc53-6db711d512b3", "value": 154580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781959973, "uuid": "11cc8c13-abde-4666-9f52-ee6f7a1ae83c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959973, "uuid": "b9bc9f4e-3c4e-4c7a-ac1a-b4345d41a21c", "value": "assailant.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "859118c5-6ca0-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1781957211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781957211, "uuid": "0345a883-ce23-4f43-bd56-b3ae3e88b75a", "comment": "Malware payload (Amadey)", "value": "9be1777c6150a1a50e4961902a487ef5", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781957211, "uuid": "8f8667ed-9c5f-482f-8157-35069bcce2e1", "comment": "Malware payload (Amadey)", "value": "29352f59456553b5f5484561ad72727866119f00dfa50626b152ec47d68369a9", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781957211, "uuid": "9a1d2469-85b3-4dc3-adf2-c371e371909b", "comment": "Malware payload (Amadey)", "value": "f5afd7c8ebd868bde7287829ad63d07e0681cfe2", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781957211, "uuid": "d99a894d-96b5-4c6f-b63b-9ac4392986b8", "comment": "Malware payload (Amadey)", "value": "c959f287261f63db6ee3c4a25852666d353610e5f3489e03f0d3add12604e124919e062d182732744b91876f6f692d13", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781957211, "uuid": "bb84c916-4034-4f2e-862e-f9a7f90b8f8a", "value": "T108046B10B1E2C4B2E673053114F89B75597DBD310B224EFB67D80B7E4F342D1AA35AAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781957211, "uuid": "04f68d69-3f93-4b06-94b8-b9692183883c", "value": "44fecc80f9b0222c9a3ac23b1cc2d9f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781957211, "uuid": "f3b495bf-b9a6-445d-b1f2-8770d58b4b98", "value": "3072:vVDs33PgRODbw/h7jmlArERSek01tGrrP/lOAg0FuD0kLqMef5:vV/Rys/dfw8eV1tUMAOJLpeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781957211, "uuid": "f3947e90-d853-4c03-be17-758f6cc2dfd0", "value": 174592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781957211, "uuid": "a4ff3913-01da-4f75-8be2-e4c14d3ded9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781957211, "uuid": "e50b3e42-a217-4065-bc3b-2ec303729794", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c1cf2b5-6c53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781924017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924017, "uuid": "f5f80282-5111-42d4-bb3a-47f56e4b269a", "comment": "Malware payload (Mirai)", "value": "71b4511769251b2f112086955356ae76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924017, "uuid": "41ac405f-30f8-40be-b5db-d0e8cf6f4e31", "comment": "Malware payload (Mirai)", "value": "29447a6bb6c7328041398d0591dd0998302ea2116b1462b9a2c99d14366113d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924017, "uuid": "a5394a3a-5bbe-4b51-9a57-2949c2d5e60a", "comment": "Malware payload (Mirai)", "value": "6a011f1c34dc68c627c4a101f72402973259c002", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924017, "uuid": "61742504-dc9e-4ea8-9f24-fcb7cc198b04", "comment": "Malware payload (Mirai)", "value": "0f48d7dc97198dc7f8858c330ba34e83ed7625401851c5fd64a80ffb68aed0913e64ff2e9033326fb97f10756b0be3f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781924017, "uuid": "d6d3930f-190f-4ce1-9c8e-b90cf737dba3", "value": "T146540906AB710FFBE8AFCD3302E91B05258C549B22A9BF367574D918F54B64B0AD3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781924017, "uuid": "219ad73c-9f6f-410c-87d9-06f3f10c47be", "value": "3072:GKYuZo6m7mSzEgJvaGboFrkLUBaWAwRK80I+sfp8ZutG2tUVEDoi:zmaQVJvaMoFALUkqQI+e9FkED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781924017, "uuid": "a188e74f-608a-48e1-abd1-a1e04b3f39cd", "value": 285960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781924017, "uuid": "5d924732-6507-46b2-8009-51e410ad5cfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781924017, "uuid": "599d0d3e-e0c2-47e7-8f90-e853035458ab", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aea65bca-6c50-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781922920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922920, "uuid": "9b5637fc-3d4a-4eab-9df0-b90a5d69c1a9", "comment": "Malware payload", "value": "ffcf8e4110a528a911617f245e5c4ff4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922920, "uuid": "d89e9784-2e27-4e0f-80ba-322bba336a16", "comment": "Malware payload", "value": "29aacb868b67fcfbdd32d19cec7ea0ed1cd395600b650ef4cc1893c5e24b027d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922920, "uuid": "c764b875-c4a0-4be3-9848-6fc501c2bfcc", "comment": "Malware payload", "value": "262b1712765eeb64ba012fe0b26df5c4567470c3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922920, "uuid": "e4d0f00c-e72f-411f-8c50-493a60465a53", "comment": "Malware payload", "value": "d3ffe4c7ac6084a698abfde427a33b0268a27f0ec3077c891ba22a6a5b05108243cce25bf71a0bf30ca2329d304617ea", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922920, "uuid": "fb809414-9d2d-46f1-9a9a-2458e32ff1a6", "value": "T12E31939B10041A395742DDCE77B3358DA50C81FB289FD754AC980EEA8A8C1DCB562FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922920, "uuid": "5720c621-56a5-4e8d-afd7-d174c35665d0", "value": "12:UNmo6Nm0ptLvlz6jbZ6t2WNg6N4Xj5Fn6Fp91VNX6N3zH1Ai61A8AW0d1C463Qpf:htLf2ng9AmQ8AWHYyArKyoK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781922920, "uuid": "98620254-f26a-432e-b71a-7d024a62f4c3", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781922920, "uuid": "242dc4bd-f602-4ab4-8410-862b51f703a8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922920, "uuid": "94e4e95e-ba10-4b2c-ab4f-27be34f263b5", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb31cba-6c9b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781955108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781955108, "uuid": "9053b9b5-08cb-4d55-a5bd-fb266b65d616", "comment": "Malware payload (Mirai)", "value": "4fd8114d7790cfc170983e2314388742", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781955108, "uuid": "3cf89a85-682f-42c9-85bb-bb6353b6dbd9", "comment": "Malware payload (Mirai)", "value": "2a2eb69905028867c3d46cde6d0771b6354e4ac01c2a44c72da8e49e51d7f953", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781955108, "uuid": "cb2eaae0-438f-4ea2-90f4-ac1ed76c4e27", "comment": "Malware payload (Mirai)", "value": "43281bafb90715d015701ffe91da05d2e688520f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781955108, "uuid": "53bac85f-adfe-4af3-ab10-bb3114313061", "comment": "Malware payload (Mirai)", "value": "f31a0cf5e72af288fa563b3843a83c286d20c35b12c1ab54f77200015f0c10d892b3f8a8e885fda26527b7f0bfd5b012", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781955108, "uuid": "f0ae029c-e4ac-41a0-a1e3-ce22a565d64f", "value": "T1D3F65B07F9A618E9C1AEC434866B9653BA717C48072177F72B50B6302F77FE05A79B20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781955108, "uuid": "4d9addf9-4b42-4142-a26e-46bfa7ff4237", "value": "196608:g8MNs7fX8l4lcmDi1WIPFCBNcJ7oEkLsQXA:gfs7fEOqUqFCIkLsQXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781955108, "uuid": "655ecf81-e896-4610-a0ab-b83344e19f14", "value": 16740514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781955108, "uuid": "7a3dac3d-eee6-40d4-9a77-a3e746cf9dab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781955108, "uuid": "6b58f3a9-2c2f-4f00-9d67-d885700fa5d0", "value": "b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1629011-6ca6-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781959969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959969, "uuid": "5a57a39a-febf-4568-86e6-cff49128f14e", "comment": "Malware payload (Gafgyt)", "value": "d4ebf5fc162a94c418841d8bbda4d12f", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959969, "uuid": "e493bfde-b0ed-4139-8cb8-2f75245e7683", "comment": "Malware payload (Gafgyt)", "value": "2a863ef95e8bbf606a7b65635ee72b48b7364e65f27c328a5615b3e630e5fb9f", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959969, "uuid": "d2380bdb-e599-4513-98b8-9ca0795d4c1d", "comment": "Malware payload (Gafgyt)", "value": "3fa75ca77c53d02dde24061b069531a28951ed10", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959969, "uuid": "dd4b618a-0a85-4497-99cc-4948f2585494", "comment": "Malware payload (Gafgyt)", "value": "fd4eee28cb23aa185852347b6ef2a5a1751c343ef64f24a51959732900e3a4131b15cf8786623974c69be5eb134fb889", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959969, "uuid": "5ceaff9c-0b4f-40f8-a964-d0c890d9f3fc", "value": "T1A6044A09DA409B17C6E237BAF79B438E3323975467D733058928ABB03FC2B995E36015", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959969, "uuid": "976f4bba-4cb9-447a-a34f-94711404d2e2", "value": "3072:PJ/o2ydspceQQ2yrwbEuakKPPKRcgTmkIDPREz45hLDyOraTM/9Ij/1PEsmww3B5:zwQuakKPPCcgoDPRZ5hLDyOrSM/9Ijtq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781959969, "uuid": "970f9296-3b23-4b34-bb28-854ab62c8594", "value": 180832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781959969, "uuid": "afa4988b-d264-41cc-aa79-e9020f07eff0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959969, "uuid": "7ba9f1f1-d036-4601-a369-083377eb8004", "value": "assailant.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c5a4338-6cda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781981919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981919, "uuid": "c325a858-cb2a-4fa0-848f-873772c10db9", "comment": "Malware payload (Mirai)", "value": "5e426d97a89f62452655d00be8e0aa2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981919, "uuid": "5b60a8ee-4c75-458b-a62a-2eeb5a906c2b", "comment": "Malware payload (Mirai)", "value": "2ae7795781a76b073d3aa3533a6bfc647114cc1462e701bfff289f6d7ce55d4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981919, "uuid": "d2bbd97e-33fb-43fa-932e-06cb9f11c946", "comment": "Malware payload (Mirai)", "value": "36dbf95b73d1964a372c35db425fe3ab01828c3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981919, "uuid": "8901ec10-be09-4a00-af7f-9610f0c5bccf", "comment": "Malware payload (Mirai)", "value": "02c0b33f149be31b11b7cd4a02d79b995911bcc23b7f8504dfa4a2c494e6a698aab85e0ce9bcb85ca0a8042326b0b1a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981919, "uuid": "d494ec49-37aa-408a-a4dd-bb53892a3077", "value": "T10414E946BD518F23C6C311FAFB9F429C37266BA8D6EB3102DD157FA437864DA093A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981919, "uuid": "d3a11b5a-a221-4ab6-879a-047eb82d41b4", "value": "6144:FNx7P6kO+mQpTKl375GL2fnLjMq4j4LL:FNxT6kOypTKl39vfLjMq4j4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781981919, "uuid": "015c5b71-f2aa-4662-a1ad-8e717b825f0f", "value": 205404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781981919, "uuid": "c60091c4-0cfe-4c25-9adc-e958cbbe4eb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981919, "uuid": "c18221cd-5e90-442a-8889-256b3095cbc2", "value": "bin.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a67b33c-6c92-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781951045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781951045, "uuid": "0084f173-2b5e-4dc9-94e6-daf25a69bef3", "comment": "Malware payload (Vidar)", "value": "4a9c90e7662bc3876f4ef627816c6eff", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Gsb", "colour": "#B947D4", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781951045, "uuid": "a828f992-9f70-4f5a-b6de-da2bcdfd2a7b", "comment": "Malware payload (Vidar)", "value": "2af09010211b22731abbc733c648be84f75ac947f919ac895374dd28719c32f6", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Gsb", "colour": "#B947D4", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781951045, "uuid": "6a2e6f16-8454-42c8-940e-49ee9b723f37", "comment": "Malware payload (Vidar)", "value": "85af6e8ac64a65f9f163199e6cc85ee5409dd74f", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Gsb", "colour": "#B947D4", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781951045, "uuid": "3a3a80b7-55a8-4119-a8f5-461fbc7cf5ea", "comment": "Malware payload (Vidar)", "value": "8db9e0c8bcd5ee42812ebc2b32bd28cc040b9443062e8386a710e25fdd14b6d29d7917ccb6db7c5a53ef20e4303e4ed0", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Gsb", "colour": "#B947D4", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781951045, "uuid": "9797cb2b-f948-44be-a91e-7c9ec30d0035", "value": "T1F3F57B07FC9119E9C0AAA3328AB35651B775BC152F3263DB6E54B3382E727C09D39718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781951045, "uuid": "46527bb7-8e69-4e00-a23a-98eaed566e06", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781951045, "uuid": "570a2501-aeb0-47ea-8237-4aa9d6b41b6c", "value": "49152:BNjZmT9n9FMuroQ6DR2D/24eR3O4Tg8JZSo:BS7PvD/24aTgGSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781951045, "uuid": "df3b195d-6ad7-42c3-949d-15217226cccf", "value": 3375480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781951045, "uuid": "0980f7c8-3adb-44dd-9ceb-d2c4d5db6278", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781951045, "uuid": "c33a64f4-1f13-4b26-8154-4a3ed83ac8ee", "value": "7612929707_v 4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee3e7273-6d03-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1781999907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781999907, "uuid": "7fae4276-5da4-4f55-854d-22499c827ff2", "comment": "Malware payload", "value": "486063249f6b355cf0a50e7c2eb76445", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781999907, "uuid": "7124e2cf-5673-4acd-98b4-6b6d3ced5b69", "comment": "Malware payload", "value": "2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781999907, "uuid": "df18ba0d-f10f-43d8-9260-848770ba922c", "comment": "Malware payload", "value": "6d89256296cac304750e190e5650942449929b38", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781999907, "uuid": "0d31f920-d4cb-4716-a106-d0bcf69c2fc0", "comment": "Malware payload", "value": "a0d5e7492b6a1256f8767203b3a2b0410153952aaa27761e117182f67f301e4b36c3740ab79636251f040b5913da4d46", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781999907, "uuid": "3c545a8e-c6f0-4ab7-b00e-bc28803eba62", "value": "T13463C7D8367B8831D17F6DFAE6C7624F5EB05133A801D6860CD226E26901A86DD4FCF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781999907, "uuid": "481ca870-747d-42f5-90cd-cff9cb09ef04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781999907, "uuid": "d8c3349e-6d1c-4f88-a801-cbd0631f3058", "value": "768:4YlbdXo81wwk+EgORzDZ3M5C0/M1c9GtCw/k5z+JicP27wzdvOfs39bS6rQlld52:HrYS8xinM1WGU+IcP2iYg9bS6Unc8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781999907, "uuid": "41706920-66d0-42fe-8fd6-3175e4c68ae3", "value": 70656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781999907, "uuid": "55f5a14f-0fc9-4381-b318-9fb8f356044c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781999907, "uuid": "bd930f8e-3220-4678-abcb-4ebd00bf04b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec1a4ffd-6ce4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781986589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986589, "uuid": "fc1c26c9-fceb-4e14-b06b-681617d5a4f8", "comment": "Malware payload", "value": "657955600cce799d537fd71ee94840fe", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986589, "uuid": "692fd24e-c396-4e08-acf4-60869459aeff", "comment": "Malware payload", "value": "2c380252e543a88730da5e5473b0234e0aa7ff2e99f1b0698141a980d08a73b9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986589, "uuid": "13fdbea5-073c-4f75-b39b-daf9923e0c27", "comment": "Malware payload", "value": "8b554c85635a18e7a94174f73dab8bb565ea2a71", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986589, "uuid": "8f7a19ee-6b7e-4499-925a-b4b81c0ae10e", "comment": "Malware payload", "value": "b075eb5cb9ed2076bbfc7917a1abde2400e50d11cea3efc177717d89f28b06c74495aefa49d9671474d088517cea25db", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986589, "uuid": "f3d9af5b-becf-4631-844a-06031f8562d0", "value": "T18D66F6C1E991D24AC63D6D31EFE6EFD8E26B2F315C885A4AC9C8F73E18B314580B5560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986589, "uuid": "34d4ff74-c02b-43a9-9e7d-f355c8efffa9", "value": "49152:SM4wa8PbfpHZ7hTbpkQtn1xBXG57H/xEYApbkakW3bE+8ddgIc4wNRRcRLp6RmHh:SM4wa8PbfD51PzYIMRtamnDjEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781986589, "uuid": "93b03467-cb54-467d-8eab-8e175f77cb1f", "value": 6553748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781986589, "uuid": "c158f971-eea8-4a38-b3dc-08ab5cda448d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986589, "uuid": "c63709e2-699e-42d0-b0d5-13ea61b90cab", "value": "edac_polld", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6c0725-6ce1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781985170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781985170, "uuid": "01713f01-13ae-4a11-86f1-bd080d625eb2", "comment": "Malware payload", "value": "fde565a60909c6ae667ab6301c8893ff", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781985170, "uuid": "80f73c98-f176-40e8-b003-ed9be7924f1d", "comment": "Malware payload", "value": "2e1369bc8343db24f34e4a309ba1a0efbd181150f0e2d7ddb153e179e2659773", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781985170, "uuid": "62b9a38b-dbae-4ad4-b3ec-d03579476503", "comment": "Malware payload", "value": "fbcbcdecc8eb86ce4f9a0242e6deb52e8f252475", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781985170, "uuid": "5cb61fbf-d980-48f5-aad1-eae864f58a53", "comment": "Malware payload", "value": "e3b63f8ac8308e7fa6c12bcf3692f2f466c93b4022ef293a81b18ec0944fc46ed495280c480080bc459d12b32fb9ad5d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781985170, "uuid": "94a8294b-cca2-4d83-82eb-2f1de2af71c5", "value": "T15F41D90054FB2B42C27FE237B90EA4CEF1464D41612B74927E18857E6ED84D16599F0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781985170, "uuid": "be64473b-fbec-4469-93ad-899775b93743", "value": "48:9EYfItwdYU+nwZ0rDbJqZN7bQMEAzcrnmNASmREV5cnk6:SOIRjw6z0XbQMEAIrmNAHEVenk6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781985170, "uuid": "3fc527f4-7a44-4615-9b06-bf7364cea537", "value": 2265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781985170, "uuid": "5ac58b66-e2aa-42a6-9b5c-48337f299d55", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781985170, "uuid": "bd4b3a36-ffff-4c96-a08a-fa43d1734733", "value": "ProfitInvext_CRM_API_Documentation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc57c64f-6c41-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1781916608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781916608, "uuid": "568908ae-328c-48c4-9bef-39cc70ed5849", "comment": "Malware payload (NanoCore)", "value": "2470c9c99f13ded1f5b86a2fabde0780", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781916608, "uuid": "1cee022e-4572-43f7-a5c4-72abeccab6a8", "comment": "Malware payload (NanoCore)", "value": "2e16f46c063ff79af0b312364375706e98674b5869a4c9bb9f96a14b77277c5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781916608, "uuid": "4e352e54-c4cc-4e81-aeae-5f441db61978", "comment": "Malware payload (NanoCore)", "value": "5801812345faf457a9be2ede940097ad1e88a626", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781916608, "uuid": "74921391-dd08-4a0c-8990-70d686cbb6fa", "comment": "Malware payload (NanoCore)", "value": "352ef3edd77df27373aebb4cff9fe01c9e423c4874af33da17512898b4fd686701ee5e13b7337ff658b9f7a7be32e34c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781916608, "uuid": "91bf20ed-e494-420a-b414-24324a6f95c9", "value": "T18014CF553BE94A3FD2DE86797112025383B8C2E398C3F3DE28D894B64B667E50A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781916608, "uuid": "6bc01e47-c20c-4e52-aac5-774d06f13269", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781916608, "uuid": "5ca658a1-65ec-4958-a168-b977e34b3597", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIJhqzrhvGiKzJ0VCgw9iBwl:MLV6Bta6dtJmakIM5dVs90V9Bwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781916608, "uuid": "a4a9033b-9cb2-4556-bbb8-639fa71488d9", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781916608, "uuid": "76d41e1f-db3e-481d-b419-f95ab579f3ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781916608, "uuid": "27e0cee8-a208-4e8a-9bfe-8af1559ecff8", "value": "w2c.io.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfed6bf7-6c6d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781935458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935458, "uuid": "47e207ec-981c-4382-94fe-9eb71d0939a8", "comment": "Malware payload", "value": "b244e05e2f605691ee2a87c6d3e2dc51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935458, "uuid": "289a2f54-1dab-4b74-8e13-d4757f836eee", "comment": "Malware payload", "value": "2e63ec1c98619eb59d4575b601dfd1467292271cbc7aeb273f1d39902deffb53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935458, "uuid": "ca1a97b5-d488-44ec-92fa-be39c5177cf0", "comment": "Malware payload", "value": "97d58b720408c13021cfde2cd5c5f7f2a980a495", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935458, "uuid": "a99511ed-a993-4604-8f47-53697edaed23", "comment": "Malware payload", "value": "9b04d7c016ae97b1017c6a628ef3f634f12890465d423ab1449a4d7691f17187cb606ca1d19d2f522f17478fd90495dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935458, "uuid": "010da26e-2d22-4092-9d43-7dc5c808f800", "value": "T1D0055A06EF901FEBC4AFCD30892E834B15ED999703D1A67561FC898CBA9D2594FD3488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935458, "uuid": "e7719b89-8960-41ce-b03e-7c2b36273dd7", "value": "12288:xSU7TDxhjrm93fsXowLzx0seC1tmjyJGEXEVQXX3G6P2V87vd9NBX7h4dDTt5wbe:Lcv50BIEXtfKVzuQfQxqxQ9ROI6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781935458, "uuid": "7c1eeead-41ec-404b-a31d-606160ae6581", "value": 795292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781935458, "uuid": "22388ff3-a1d2-4835-9b2c-9785076765a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935458, "uuid": "c2ac94dd-53da-408c-a1fd-39d456d11a30", "value": "bot_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e8a533b-6ca7-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781960152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960152, "uuid": "45625ae5-02bc-4f34-a610-ae320daf67e6", "comment": "Malware payload (ConnectWise)", "value": "b4e61dcfcf46bbd01ee140b355d738c8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960152, "uuid": "8f61c50f-42c6-46d4-bc19-fabacc8c560c", "comment": "Malware payload (ConnectWise)", "value": "2ee10a4e204a3adbf2102913c95c3cad56199bd75e1c6e194f239a7cf4837e36", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960152, "uuid": "93d94cd8-3fd9-460e-a649-33a0acc53499", "comment": "Malware payload (ConnectWise)", "value": "864b9623279497e028ba193b2f52233b1cb6be53", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960152, "uuid": "1321309c-eb0d-4c99-ac53-19af2e8a5a78", "comment": "Malware payload (ConnectWise)", "value": "fa0166876d0dbd33d32bf1326d75e2a71e4527dbfc78808d77fb5fba044b7d5fa393b64f1adfdd2ac6a89d81a1194654", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960152, "uuid": "4e38afc3-8885-4608-bbff-8b4fea56a1c0", "value": "T18246E101B3D695B6D1BF1638D87A56A96734BC048316CBBF5394BD392E32BC04E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960152, "uuid": "5dac3827-c0e0-44fc-a260-d16a4582e7f1", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960152, "uuid": "edc196db-ca4f-479d-b766-2babf92514df", "value": "98304:kzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zln:khfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781960152, "uuid": "365f4768-ad5e-401b-bb0d-ca1ee0049559", "value": 5751176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781960152, "uuid": "657ff4b4-3bc0-41d3-9aa7-a16df43cff36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960152, "uuid": "66437ebb-99b6-426a-9823-e8c429ae8309", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd4964e-6c98-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781953626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953626, "uuid": "dd19ba7a-a051-4780-b94f-b22d2263c7ec", "comment": "Malware payload (ConnectWise)", "value": "2ce7e3f516c80084cda7b9a35809e90b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953626, "uuid": "0c072e26-1083-428a-aefc-b734949a08d9", "comment": "Malware payload (ConnectWise)", "value": "2f14862545773c034e41f1ece62bc0618cb1396eacfd2bbe2aec9c958689e002", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953626, "uuid": "0eed4aba-285e-4726-b18c-2245d40628b6", "comment": "Malware payload (ConnectWise)", "value": "d48ec01d6c8143a571fae4bbcabb9969fbfa1c84", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953626, "uuid": "cc32d122-c3c0-4afa-a4f6-65fbd582914f", "comment": "Malware payload (ConnectWise)", "value": "007512afcf3d81603bc0569c3f6a58fa548835217e2c8d9b1cfea6a16fda58cb287b883842234c63f8b41c7f7aa03c2e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953626, "uuid": "351ec90e-94dc-4cbc-8e50-7a5dd0e6e7d6", "value": "T1BC646C11B9C48432C673383107B4E2B28DBDB8302D655B9F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953626, "uuid": "b4511343-3b6b-4c89-b6cd-8c92d53dbf37", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953626, "uuid": "eab729f0-b78b-4fa5-bb9b-b1f2ca362679", "value": "6144:dmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9N:Y1iw7gryNkSV1hy1Z1u2JLI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781953626, "uuid": "9f12c75c-a980-4165-892e-af6bb43a6487", "value": 312536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781953626, "uuid": "e1527b26-db1c-4a26-800d-aca663918e19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953626, "uuid": "69a1be36-784f-4d01-ba03-19e4b5953f0e", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b26b797c-6c9f-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackShades)", "timestamp": 1781956857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781956857, "uuid": "6fde8376-9ed4-46c0-bf59-a107a45e9d4e", "comment": "Malware payload (BlackShades)", "value": "72e11e578b0195306835b11387846662", "object_relation": "md5", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781956857, "uuid": "1f5adce4-3b15-445c-a16a-5c5eee85f9be", "comment": "Malware payload (BlackShades)", "value": "2f8b6ff170d5c231fc25d0ecc9b907448a5cdea6513bef52a10856fd1b814479", "object_relation": "sha256", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781956857, "uuid": "0483830b-a61a-44c2-9506-2830a9c96feb", "comment": "Malware payload (BlackShades)", "value": "399921c6d715c4166b7641cf64fdc41ad06dde65", "object_relation": "sha1", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781956857, "uuid": "2e0cac76-ed02-4745-ae14-1083ab810a40", "comment": "Malware payload (BlackShades)", "value": "70287fe11d13f285885064f60157d19494645087bfdbf5a2508c6672b56d79cad392200716639e71f784548407784567", "object_relation": "sha3-384", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781956857, "uuid": "25b4202c-dde4-4a77-8f36-cba80632f2a4", "value": "T16D74232188DE171BC8AB99F8440979CC8C6B095F40CD97A5CBD17EF7704BEF1A5A05E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781956857, "uuid": "bd8a6e26-b1c0-415c-b50d-b2b44f4ca41a", "value": "18aee7cc80e48017bb06b13550617d1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781956857, "uuid": "c511aa84-7dc3-4800-8f01-ca626262b042", "value": "6144:7L1ncfWwN0oc35jeRh8Xqfy/Ka1OHAH0tMrKCTEABG+Z9d3cQTUoKVY4qf87iJw8:7LdcfxaeM6fy/KaVUtgKkTZ73coU5C/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781956857, "uuid": "acf86b3a-2873-4bbc-b256-bd1de3246d8a", "value": 365568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781956857, "uuid": "b4c56ca5-80e9-4e2d-9623-837d0b305402", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781956857, "uuid": "20d63c24-4ef7-4c4d-aa6a-78b6d8fe1de3", "value": "Moka.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d1b036a-6c98-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781953627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953627, "uuid": "77f56fc9-36dc-44cb-907b-ca297feef50b", "comment": "Malware payload (ConnectWise)", "value": "30a9ecc59bc94186d32978e4a9f5bb0d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953627, "uuid": "8b2c33bd-4134-4c06-802a-b03d51214c82", "comment": "Malware payload (ConnectWise)", "value": "2fe27cfc680a6fb118a023caa55bfa39a55d4aecf9e540f65b531874066fec16", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953627, "uuid": "f0848abf-da01-4d39-93d4-4d0f6e0e94e9", "comment": "Malware payload (ConnectWise)", "value": "dcb74d6c2fe8a0cf6906bab57e48b2cd18b2cecc", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953627, "uuid": "0079579d-0c92-4586-8179-b5655e52c85f", "comment": "Malware payload (ConnectWise)", "value": "7f7da279b00ccf90fb5b361f8446ebfd9bf9e61e003236a2a88e89ed5f80647a757b2edbe3a41875a0096b609cf5420b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953627, "uuid": "70c6d935-4fc3-4f6c-9269-c402714f34f9", "value": "T1EB46F141B3D695B5D0BF0638D87A42A65634BC108712CBFF57A4BD296D32BC08E7237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953627, "uuid": "317891d0-7ca8-4b7f-a9d4-5a112cae980c", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953627, "uuid": "634f84c1-2c53-45de-ae7d-15a01e5d08d8", "value": "49152:OfRBDtJkGYYpT0+TFiH7efP3nrGLq7FVsLBe+1GVxrKlsuwGenGwfZVkVjOi8if0:qqs6efP3rn/TYGVxz3GBwRVkGuyXOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781953627, "uuid": "2b731dfc-7039-41c4-8b41-4abd50edb3a0", "value": 5646824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781953627, "uuid": "73ff79ac-d2dd-464d-a34b-181c9c3c34ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953627, "uuid": "366f086a-33cb-47e4-9fbb-2640ea593902", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "247c733c-6c50-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781922689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922689, "uuid": "77545f23-9a20-4b2b-8d6a-5ec383367093", "comment": "Malware payload (Mirai)", "value": "8c6b4dbb1b07eb5e572224c81937a764", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922689, "uuid": "d76fe4f9-0b76-4d6e-96e1-e404cf4947f1", "comment": "Malware payload (Mirai)", "value": "303ee57bb88575509a3f3d7f4e8a4ee6c1feccf2f15dd0e26e8fd32c4211351f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922689, "uuid": "016c01d2-0116-424a-a79a-6c913db2ea4b", "comment": "Malware payload (Mirai)", "value": "70d77ec6d06c388df78774161f9090c8e2d98624", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922689, "uuid": "cfbf1fa8-a4e8-48a7-881d-2e9a13eb1d62", "comment": "Malware payload (Mirai)", "value": "b97137f17ecab072aa1c916df621bfa8caea182a9b17e9af9670a7a78019d0a3dd0b5852f8049aa695735de54cddb7ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922689, "uuid": "680cc0d1-4863-4f73-b960-d0d66805f756", "value": "T1E9245B02731C0947D1672DF02A3F27E093EFAAA125F4F645755FAB8A9272D321485ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922689, "uuid": "c0765724-fbbd-43ed-953b-726721b1d911", "value": "3072:tW+xoX6tRoy0f5djWwKPY16BQmf2cm2xpa4rCW9HRpfEDd:/Wt1/hP2xpa4rC2HXwd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781922689, "uuid": "87705d79-b2ee-45c7-96bc-9b110dfe5bfb", "value": 214704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781922689, "uuid": "26280755-8ce8-42af-9a3f-715085e07ca8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922689, "uuid": "a80d133a-87b0-45a7-9a78-db3aef0904c9", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6054558a-6cd4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781979483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781979483, "uuid": "3554d328-aac4-41b8-8663-b171c37bd377", "comment": "Malware payload (Mirai)", "value": "070710c23693941575daa01e3444e7fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781979483, "uuid": "cdfc826e-61a2-44de-94cd-da2185c9a0db", "comment": "Malware payload (Mirai)", "value": "33117ae588e6a02d1e51ef03a96c35b3d12c1486d5217804e3d6c87a818430c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781979483, "uuid": "418e7aa9-65e9-40e1-b75a-073a85c4c31f", "comment": "Malware payload (Mirai)", "value": "abe1a4d653e60bf22375efa3a67fa7660620e6cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781979483, "uuid": "28b7f3a5-7236-479e-91b0-c1d208b825a6", "comment": "Malware payload (Mirai)", "value": "9239b2a0156c088cf1695f95a6f9480dca0c30f75705d1d9099ba142b2a588cca51998d4a5b731880671f5974945d3f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781979483, "uuid": "fda9776d-8436-453e-849b-a3ad8acb2b03", "value": "T197633B32BA760D1BC4D5A87A61F34765F2F6474A25E8CA1E3DB20E4DBF60A4026437F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781979483, "uuid": "64318c41-8f3d-4635-a75f-26ed8f78ee46", "value": "1536:c6q+GFb3qRPSuV+wQfb1tp9AEok5dMYtDoR:raDH1z9JoUKCoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781979483, "uuid": "a0b5d0c6-5710-41b5-a8ba-d2142d2a69d0", "value": 67008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781979483, "uuid": "d80c4d82-0020-4fcf-acff-491e339871cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781979483, "uuid": "5aab0ce0-386c-45e8-b620-96d78b45ffe2", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e79fe7b-6cae-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1781963185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781963185, "uuid": "57ce4877-a486-4210-ad57-1c6f738a2f59", "comment": "Malware payload (LummaStealer)", "value": "c83776891f0407e6401a7d7004691f86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781963185, "uuid": "2e3c176f-7cbe-4f10-9c2c-478ad34a1aff", "comment": "Malware payload (LummaStealer)", "value": "3368d54f30631c9e305f6df3464e08b6b4f24eebdb605240c44b144deed717fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781963185, "uuid": "6b239047-54ce-4ce7-a51a-8b6c50dcc8ac", "comment": "Malware payload (LummaStealer)", "value": "50cdc90b8ac39e4167409fedb3d25e4de8229578", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781963185, "uuid": "7481c438-b6e9-4284-ba55-15a9f5423a33", "comment": "Malware payload (LummaStealer)", "value": "9156328b5a210b5c42807a327d9faf17d8cad771df02621a1497d458faab078305f51a0fc16dc22e1c416f9ad2a8f010", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781963185, "uuid": "1c4d241f-16ca-431c-855f-a818bfa2c3fb", "value": "T133C66B11FADB95F1E9035831406BB37F23315D048B28DB9BEB547B2AF87B6A11C6A305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781963185, "uuid": "ec949f91-1bec-433d-ade2-2cea3e2f46ac", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781963185, "uuid": "568a9dd9-629d-4f49-9106-b374332d1022", "value": "98304:NzSdg4VDi5C/q+r2AlQGCvtTC4SG2Z1+Ea:YgN8qmHQGCV+/Ja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781963185, "uuid": "f1693659-d668-43e0-81cf-e0fe249e24c2", "value": 12573184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781963185, "uuid": "160fa35e-0591-4058-b91b-c71ef1aba20f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781963185, "uuid": "8201a7d9-8af0-452d-8cab-fd712b7d0ebb", "value": "ZapretInstaller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e182c1c2-6c6d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781935461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935461, "uuid": "21b5e612-2b87-4021-b8de-867fe5824c29", "comment": "Malware payload (Mirai)", "value": "cdf25d65a96d92b80d8c5ee888603309", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935461, "uuid": "db3e267e-0d0d-47e3-b78c-6223f07be8b9", "comment": "Malware payload (Mirai)", "value": "33a3885e6f29a2450f01c5d7390f7c30e0acf09f7bb03f318edf28109a59fa8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935461, "uuid": "460c9f4c-7353-42f2-ade8-573d0f8293bd", "comment": "Malware payload (Mirai)", "value": "4da476ae13d380e16c7ef3b57fec15bb750db17d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935461, "uuid": "1764093b-8825-49f0-80b9-153bd8a9f1a5", "comment": "Malware payload (Mirai)", "value": "bb6b09a14213cebc9fc701dcf42b17e504ca0fc3e4bb2c8c6a4f8e277f33e3d575d970a363281cdb25adab6c467b2f01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935461, "uuid": "594d4f74-d2ca-4c2c-9531-a76b7ca89d3c", "value": "T114158E89E7C7D4F1F66300F1068FD7F61634A2265013F6F6EB881A977072B526E1622E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935461, "uuid": "624021fd-c69d-4075-96d8-622b9f7271b5", "value": "24576:xMLwdNinLhPQhqfxqf1c8HgVo0EwaUZk4ldiH4M1NARmGbBucIo:xMLUiLhPQhBdlgzEwHlduxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781935461, "uuid": "b6615366-8888-45ec-8ceb-f0bbeab7891a", "value": 922500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781935461, "uuid": "3dc9282f-fec5-4c7b-ae17-32a5faba25f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935461, "uuid": "4d3d82d5-f8dd-432e-b999-f55e616e75aa", "value": "bot_i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe49e8e9-6ce4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781986619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986619, "uuid": "4424837f-f279-4c14-9aab-4ab17fd8cc6e", "comment": "Malware payload", "value": "a475439e67975995dbd493b3683aaeb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986619, "uuid": "840a62ed-3e22-4121-94d8-1ef4fba4d2c0", "comment": "Malware payload", "value": "33dcdaafec603a3b65796c06235130d6141cdfd45752235bf66b8b17f2f2ecee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986619, "uuid": "566bf0ba-b786-45a9-b149-32b8831098b5", "comment": "Malware payload", "value": "db506c6f7b4ddcea3ee3afb76c8a910535eebb27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986619, "uuid": "c365c98e-4c90-455a-ad5a-497647137f40", "comment": "Malware payload", "value": "2aa6e0744a9a19745378f1b85b9dc50f915ff2691160e32053395ab820fab7adc23c0e597456cf92b342e1cfc01b0b3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986619, "uuid": "e305c956-6f6f-4a36-bbc8-290e946bec74", "value": "T16C66F809AD843BFAC02C4B7454EACA5622B05D144AF1467626A5FFEDFC762787F0788C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986619, "uuid": "1688b808-d87f-4287-9e70-933d656d4067", "value": "49152:HrT4rs502bEe2Tl34J6FTs8vsW/ALIqtG7MdHg5Er:H2TlIJ6NUa48Er", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781986619, "uuid": "43270d30-e1a9-4e48-a584-d7c639471da4", "value": 6946995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781986619, "uuid": "18731315-f455-4d12-ae4a-4838cf45c851", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986619, "uuid": "96a5a92d-b6be-4a05-bb74-233cf7ed5aec", "value": "ecryptfsd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b9223c-6ce9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781988645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988645, "uuid": "44d7065b-3577-4049-8df3-4ea775f0dfdb", "comment": "Malware payload (Mirai)", "value": "04ffcb988fb2ba14f4dcbf15299291d6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988645, "uuid": "f824b518-82b6-431b-b801-a3327c91ff43", "comment": "Malware payload (Mirai)", "value": "33e1522d870d0d929ac0a1733f746c58ba7abc8dcb1e9efc28d4393d4eb5d749", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988645, "uuid": "771a0fa9-9b7e-476e-b5f7-3fb5c7b6573c", "comment": "Malware payload (Mirai)", "value": "008fcf9fc9bc86f916a727a6649afb3662c516c0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988645, "uuid": "5dbf1aae-6cc0-4685-a893-cfaa69ffbfc1", "comment": "Malware payload (Mirai)", "value": "580852ea9138040e7fb3ca9368867e6ae044435c02aeb35c8277ac66b9d4a7c675728993037dd0410f6576273fb752a3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988645, "uuid": "65e92318-e687-4e58-a556-a4d71273d039", "value": "T103337BB3CC366E68D04886B0B4209EB46763F144C2571FBF296ACA799093DACF9453F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988645, "uuid": "1e7c8cf3-c6a9-4ff2-b8a4-fde5c361c30c", "value": "768:waVIjRneC4q0hL9w1ECFHZKiTtFlaFoMWpyzChffVBfsGEVyI:waOjQC4dhO1EQKiTtGKMDzChwGqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781988645, "uuid": "536ee9fa-50ab-40e1-9e04-642564f36fde", "value": 54708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781988645, "uuid": "e9b917f0-5923-44f5-a6e5-55e2ee2044bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988645, "uuid": "604aed25-fa16-43d8-923f-4b57d378c397", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3103fe86-6cb9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781967807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781967807, "uuid": "752acc36-5fa5-4255-94d7-fe73fc35da82", "comment": "Malware payload", "value": "4e1841eb193f4ff8f2ca4645760a2ad5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781967807, "uuid": "eb9bbdd6-33e9-4750-9621-f4da6ce9dd7e", "comment": "Malware payload", "value": "34775cb1e6a242e54c881449c5029bf8d65b67e4bf852c4da82e7ab667bc5bd0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781967807, "uuid": "75cbc499-4bda-413c-a3d5-03110226f67d", "comment": "Malware payload", "value": "3ba234a83193e4630f7f1d28fccf96778d512ff2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781967807, "uuid": "4d3b9d31-7f87-415e-95a6-fbcb6a210e1c", "comment": "Malware payload", "value": "b22c95375a6288a7cf2955277a855ee4b1bb29ff143dba5fd5b57f9f7cf27755debea40d2c1b2492b97ad3e1ab86b351", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781967807, "uuid": "549a6c84-7a4f-41d9-9b17-f05aa18b3bc3", "value": "T1BB444A42FC419F12C6D5267BFBBD828C731617B8D2EA310389255F34778E89A0E37686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781967807, "uuid": "4c5ba9be-8044-4a38-b579-09fa61e80ac5", "value": "6144:PTJcL8mevwtKhcmw9EeCs2DkRsBtRVAbuS2rqnZSe07QpBdF:PVCVkcoeCsA3RVAkZeGQpBdF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781967807, "uuid": "bc6414a1-a942-4169-8cef-0e68a1eb445c", "value": 260832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781967807, "uuid": "0565f5d7-319b-4c1a-b8f5-43ed5e9dc08b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781967807, "uuid": "fc4ddd40-4a9a-4824-aae7-1af2b7027ae0", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7586ff02-6c6d-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781935280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935280, "uuid": "d724f77e-c4f0-4f5c-91fe-44e47b89c7c8", "comment": "Malware payload (CoinMiner)", "value": "6fb801b998801cb2c5ed6bca8f6efe2f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935280, "uuid": "423c0e40-1114-4112-bad5-943fc2bd3ae0", "comment": "Malware payload (CoinMiner)", "value": "3559470d1dc6eb5c171bb6041c69b9916c702a7a8c9646fad0762045c4169d5b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935280, "uuid": "f1b67093-5553-41ed-a4d6-49a8e214f033", "comment": "Malware payload (CoinMiner)", "value": "2678dcccf5dde447291ed630c3c7057237a3d804", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935280, "uuid": "b463556d-4314-416c-a48c-1b668c1a6550", "comment": "Malware payload (CoinMiner)", "value": "626001b1bdf7c3f170e45cba6a513cae2b1a48b97b0698ff620fec8c0771e02200bbcd7e40831fe0d5fe38bbc1a30490", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935280, "uuid": "3646f396-0ae5-4f43-9d59-6ddbcd09724b", "value": "T162A3020D332BCD69CA6A2C3BE71D46D983714CF5A1C581332E3017966ACB4EE864DB67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935280, "uuid": "d5be5443-4293-4041-9617-199f2c01e233", "value": "3072:tIL/pHncApyXP+7ErHJrRdN5aPsxIUh6lkgnQ/x6FAl:G1puP+IrZnkhDkxoAl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781935280, "uuid": "95200f56-eb46-4ab7-8f39-dde7e6a7761a", "value": 107124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781935280, "uuid": "0ef9deaa-94a0-46ce-851b-f3507517eb50", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935280, "uuid": "37124856-d8c1-4999-9368-1ae7df98c4e0", "value": "kworkerd-irq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4313f81c-6cf0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781991459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781991459, "uuid": "fa88d0a9-474a-4572-8429-20e6d4cd8953", "comment": "Malware payload", "value": "2b6ae32d6a837b5f80e9f9ba47f70a07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781991459, "uuid": "bcfe0698-ffaf-4d94-9ccf-90a83e44c7d0", "comment": "Malware payload", "value": "3660074f4a92b21ddababd36837c86db20ccd883866bc1dbeed11ed081a1df3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781991459, "uuid": "a8084a72-5f6c-46c7-9e84-55f1d039478a", "comment": "Malware payload", "value": "6474d5ae5228fd10f2b3073f8e53ddb5d72a0407", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781991459, "uuid": "9e2b3c4b-88ba-44ed-ba0b-a33d3f2c1004", "comment": "Malware payload", "value": "693dc8be63a2cce4f5b3eaa00fcd041fe0d90336bff1b696b5bc54fa1ddcc0ee7bbfca1e7cd17ad888f678e832952bc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781991459, "uuid": "533b6e96-5005-4b7f-b285-c3b99867e9f1", "value": "T1E2D313DEF8169DABFB71D0FD858C0AA47B35863CCBC58B0A56C003E76912297746C5E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781991459, "uuid": "b91ae7db-f28f-489f-88d7-17a51ca7f0d9", "value": "3072:6zk6D7aABiA4C02UmmV2cOn8aizwImaV1PB28+F0uvxQT976GgXV1:6zkouABiA0R5OnNusD0uvy76ll1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781991459, "uuid": "567324a3-2853-4408-9782-8fa097dcefac", "value": 138428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781991459, "uuid": "187a4b5d-29bb-4a73-95a0-8d0003bda389", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781991459, "uuid": "87d5af33-b705-4819-9a73-0c8aa4246c87", "value": "kworkerd-netns", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a89d0e-6c8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781950091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950091, "uuid": "36533322-6c66-495d-a0e3-6f17a519899d", "comment": "Malware payload (Vidar)", "value": "e8593f056826f87724ffc3a754d7796d", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Gsb", "colour": "#B947D4", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "sabsik", "colour": "#6B6779", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950091, "uuid": "aaa30e90-44c6-42a0-ad52-c4dc5c79fc96", "comment": "Malware payload (Vidar)", "value": "36b3e0a6f376f9a43ed9af7f27c51ce58bd9ac793f6e41c7d153b45fdb77b37c", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Gsb", "colour": "#B947D4", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "sabsik", "colour": "#6B6779", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950091, "uuid": "6f6711a9-cbc7-48f8-bfb0-87c6718bf49f", "comment": "Malware payload (Vidar)", "value": "c2dc7b19587128b82969532c24d6611ac381ba72", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Gsb", "colour": "#B947D4", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "sabsik", "colour": "#6B6779", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950091, "uuid": "05dd59c8-a92b-4fa9-bd9d-ba86ca5d620f", "comment": "Malware payload (Vidar)", "value": "544d45647c3bb7e0246bce8a3d0992e95f2c0d6ada65c4f5aa4d510fe4f07f14ae45f7fa7143c598cfc1cc887b3b5c84", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Gsb", "colour": "#B947D4", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "sabsik", "colour": "#6B6779", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950091, "uuid": "ccecd1af-1d79-4ab1-b819-a14f9325fea4", "value": "T157E5AF47B4A04676D0AED236C8E75261B3397C884B3637C32B71B6B61E323E49D36359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950091, "uuid": "426d2c3f-6b9f-4581-823b-47566a389445", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950091, "uuid": "e0465a25-2c8d-4e66-8201-6b490fe24352", "value": "49152:0Wfn3H1rb/TjvO90dL3BmAFd4A64nsfJKX0NpD19VqrAYSUL2ElwWpStgLMVFIRe:l3Hk5wmULbwICVrLoK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781950091, "uuid": "82fa2c41-14bf-4788-a705-148bb2621ee7", "value": 3086056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781950091, "uuid": "019ce0aa-669f-492f-9537-52b35e718c81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950091, "uuid": "1bb007d8-1045-4f24-aebd-2e0fbc08bd08", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec94574-6c5b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781927538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927538, "uuid": "3052a9f4-014d-4d82-b71d-2c0fe3b77f31", "comment": "Malware payload (Mirai)", "value": "1fe5ad321a1e6f18b618bcb5a2c2edf1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927538, "uuid": "9c655856-d282-408b-bd8a-97ffbe77e0a3", "comment": "Malware payload (Mirai)", "value": "37733e5966cf4129c79c419725fbc2f7bcdac446683d966107bb3065d959422f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927538, "uuid": "3cee960b-4db9-45c9-99e5-3a33ece259d6", "comment": "Malware payload (Mirai)", "value": "33e75e2fb2aabe15a4cb564a952e499cb9483ff2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927538, "uuid": "0955fcbc-7ab8-4502-bdd8-509c167bc67d", "comment": "Malware payload (Mirai)", "value": "1e0a9a08adb03e60c90e69e5329865b5f783cf8363dd168d6379f05749e8f777e46c58aa67627aabfcca193f620c3aee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781927538, "uuid": "4c4291ca-4be1-4255-9337-59f8ee4fa037", "value": "T1D08302BA6E0190E1CD7AC9B90C7803875F3A8F925309DC81E20DED4D9D4E5855DE86F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781927538, "uuid": "68d08079-d633-4ac2-9def-c7898cd5c5d5", "value": "1536:T5MVURHdsQwKIVpERvz1+TIeIKSYImjsHCZc9vru+VJuR:FMVUR6QuVSRL1Lf+IHiZKru+VQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781927538, "uuid": "e196f2dc-2f97-4437-87e7-ad9a1afe2f33", "value": 88676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781927538, "uuid": "070cc754-5248-4d1e-90c9-dddba0053820", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781927538, "uuid": "a860f0bd-9df7-4d33-b998-eea6f7da5a15", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7fbc441-6ce4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781986582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986582, "uuid": "7be86494-d63e-46e6-a515-b51132d3fd32", "comment": "Malware payload", "value": "51a919ca6bffcff7c963b3e020fcd728", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986582, "uuid": "523e0e49-f70f-4730-8c49-5108cf6e8cd7", "comment": "Malware payload", "value": "39f268023db21296dfa4a259791d3d5bd559e29dfa588469ff5fa170b7c05f19", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986582, "uuid": "7128cc95-1544-49b4-95be-a4cdd577f52c", "comment": "Malware payload", "value": "a56d202bf241639adc20c1e2d26955476f5c980d", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986582, "uuid": "616bf650-5cd1-48d0-a5ae-41eae044bcb8", "comment": "Malware payload", "value": "2a8411b06ed84241d0ccdbfd54b51f4d1e6f3f82bce5cf078b280c9987e57080aba8872005e3adbf16982cae8dc5d7f2", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986582, "uuid": "1ac46c30-5368-4371-9211-721f5983db81", "value": "T1B38533CDE77A22BADD76DF3EA756EEC003CE2190D220254A1C5B5BCA49573F2361192C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986582, "uuid": "7b847fe0-f161-47f8-aa22-1d7312734c9e", "value": "49152:YqbaBYWj/LFWqFZMGYctibhcRINleOs+Dwj:YqyAHGYcc0INUP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781986582, "uuid": "b981a306-c16f-4a2d-b6e8-ad73791ab6c9", "value": 1717224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781986582, "uuid": "fc8c65c4-0a83-40a7-a565-f433a92927e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986582, "uuid": "bc2d72d0-97bd-44de-b6fd-16544bf933c9", "value": "ecryptfsd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ed3379-6c53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781924000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924000, "uuid": "b0272ccb-0c8e-477d-b072-c6916d758e8b", "comment": "Malware payload (Mirai)", "value": "e013c5e3116dd41fbe3794d4b54dea38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924000, "uuid": "5ecf6286-d127-44a3-8ad9-278c38d7404d", "comment": "Malware payload (Mirai)", "value": "3af414ef65da7494da9604e1a1dcf1a2a92234a4c8fd2fa11bb292970ea4282e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924000, "uuid": "d44acc3a-a0c7-4157-b886-e4dac24c632a", "comment": "Malware payload (Mirai)", "value": "ee96d62deab4b91f3371f9678011601d8a501baf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924000, "uuid": "f8c2cac7-a920-4247-8d11-bca7a3528924", "comment": "Malware payload (Mirai)", "value": "1001c10d689390eb3bcd2572219f13c11f27a90760bff78b1d8f226c8a88c1263af928d6140bc4d306523b7b01239e0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781924000, "uuid": "44d2f132-579a-4dcf-963b-4160101625ba", "value": "T19593029EF103A1BBCC7B4DBD9B46776A49D930C53958008DD76868C4FBB2D29A0AD4E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781924000, "uuid": "92e5641b-9570-4024-ac1f-a758672ec1d3", "value": "1536:JPKWaVTYa8+l96vEV85XMnjYw0ns6TRilBzxdv+FJ69kxtpslP/B8MnzYV/nK1M:JVwW+lEyZjgNtilEFo94rs9/B8+cV/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781924000, "uuid": "77e3f545-6964-49d8-979f-b6fbcdb8f5c7", "value": 91512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781924000, "uuid": "f685d982-d5a0-46b0-9213-e238fa26febc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781924000, "uuid": "67428510-bb65-4a48-ab20-64e1513692f6", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f22fdee1-6ca6-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781959970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959970, "uuid": "c8101576-d8ba-408f-af0f-5f0e6ff4d65c", "comment": "Malware payload (Gafgyt)", "value": "1c5bccd7eaf8263905a9add034d7b597", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959970, "uuid": "9a483206-c4ca-456c-8276-246e8b89cc16", "comment": "Malware payload (Gafgyt)", "value": "3b2895cd26f652e0a651c401abee748eef51ec7f1f1b3b1cecdede37abed6812", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959970, "uuid": "990f00ab-8287-47df-a29b-4e7c0798c332", "comment": "Malware payload (Gafgyt)", "value": "aa1bb1971744d33dda655522c63facad74a255b0", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959970, "uuid": "8e53a073-901c-4d86-becb-56a22ac0e9e6", "comment": "Malware payload (Gafgyt)", "value": "01121a76c391db988e5ce01370f4941b19b5b68b40a3df775ecbcc453db7bd412f1db211338bf895663ddd5a11c80449", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959970, "uuid": "3f3e0b07-ac0c-4aa2-977d-272ef40a2e6b", "value": "T1C9E3A65A77618FB3D81ECE3306AA4601108CE55A02ED6F6FB2B4C56CE78B84F45E3D94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959970, "uuid": "f5c03763-6661-4028-af41-c068ed34c854", "value": "3072:tW2OM7PE046LUN65hdy/PumzxRxulq+1uPNd5R:tW2OMw046YN65hdy/2mzxRxulq+1uPNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781959970, "uuid": "16548d77-7c89-48f8-8a1e-a9defa2c2b09", "value": 154580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781959970, "uuid": "9999d89e-0092-4ba8-b3a7-09054025dda0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959970, "uuid": "ff993e80-ad0a-46d9-9980-b7080a5b42b2", "value": "assailant.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a93630-6c97-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781953472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953472, "uuid": "5c35344e-029c-486d-bad3-fb469b3aca99", "comment": "Malware payload (ConnectWise)", "value": "dc993e02dd8b72b4c1d2d31e13811746", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953472, "uuid": "588ab3bf-08d0-4f31-bfd4-73d7ad8177aa", "comment": "Malware payload (ConnectWise)", "value": "3c4e06fe06b26cb70c0dabc743b728db50c87151606c421cb809e19b29876fbe", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953472, "uuid": "2344cdf1-106e-4a1e-934b-d4a70c91a5dc", "comment": "Malware payload (ConnectWise)", "value": "fcea5aa80c9154c30a2ecf73de6d93c1d3a2436c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953472, "uuid": "dd04d0d6-9c80-415c-8388-f715b89333d6", "comment": "Malware payload (ConnectWise)", "value": "453be391b7d916152604539f19c5f0f863a12967dd11e6acc4de014ecfc4ea1c3c0473b0f968100a6d2d8b90518e94f4", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953472, "uuid": "8ef1bdd7-5015-4aee-a776-53c96d63c92f", "value": "T12046E111B3D995B9D4BF063CD87A82A99A74BC044712C7EF53D4BD2D2D32BC05A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953472, "uuid": "a411e2f1-2937-4197-bbb9-254caa78dbc5", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953472, "uuid": "0cd3006a-78fd-4560-81ed-eaf29a0ed196", "value": "49152:MEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:lEs6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781953472, "uuid": "8a99bb63-bf2a-4f04-b6f6-851cab831e45", "value": 5622088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781953472, "uuid": "842b47e8-5b00-40ab-a136-15459805137f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953472, "uuid": "82c0bdcc-4564-4f19-a774-b53d83919add", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8868043f-6c51-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781923286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781923286, "uuid": "9b9bc288-f502-4e1c-bf59-9ece57ad2b94", "comment": "Malware payload (Mirai)", "value": "5fa8b5db7a8458a706bb132de8bc5ed4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781923286, "uuid": "23c4f62c-c3b8-461d-8666-605bb1474b61", "comment": "Malware payload (Mirai)", "value": "3eb929ae6cd423522102c8f7b291ee0621e9463a425b01088315a34db3eabb47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781923286, "uuid": "1b40b84e-aa56-4ec1-8b1a-b4a4c4055671", "comment": "Malware payload (Mirai)", "value": "df8e2881055e729b47a9cd1cae2d52cb00d17c81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781923286, "uuid": "e18afe4a-875c-43f5-bab1-37422c32aed2", "comment": "Malware payload (Mirai)", "value": "a533ebfb04a37149ff4e914d24f6490720d161832bc4e3396af4b3a080b8b2c0a6e22b75f045f9cf1dfde8318dd10faf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781923286, "uuid": "13700142-b21e-4fe8-894a-664c6ee4c9fa", "value": "T1FE242A46B8819F15D5D016BEFE1E128D332717B8E2DE7212DD205F657B8A86F0E3BA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781923286, "uuid": "8326137e-b254-4ea2-b6a7-a01ff9009753", "value": "3072:FuVnRxBqoi0Bq+9UiH+NP29qY2IPjvoR/kUloD8sXlPTqFaL5Ai3b3il9Dmq2Rl6:a1BI+FHyP4GSyVsX5TCaCu3i3mq2Rl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781923286, "uuid": "afc849cb-021f-48a8-9c98-21053201487b", "value": 226876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781923286, "uuid": "7b2ceb64-2b3a-4b27-9768-b065e79444cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781923286, "uuid": "5acab613-b065-4488-b704-827c42c078df", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef11944-6cf1-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781991909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781991909, "uuid": "6848098f-428a-42b5-8fce-824aa62735e7", "comment": "Malware payload (CoinMiner)", "value": "7408473f668d0e3563d8755b17fdf638", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781991909, "uuid": "5a9f5a57-1d99-4986-8820-0fab17a51aef", "comment": "Malware payload (CoinMiner)", "value": "40345a358400cb771088c33a9cf194946da95c2bb2d979e7be5e1c8c37facf33", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781991909, "uuid": "b020328d-ace1-4cd0-979f-0bb55f1a0e93", "comment": "Malware payload (CoinMiner)", "value": "d6c5f173cea005c5081c4f189477c1ade350cec3", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781991909, "uuid": "a74bb39c-47ef-4752-be9f-ce080014ce7a", "comment": "Malware payload (CoinMiner)", "value": "57adbe8b80ba6df1434ab886eadd7c6297103e260d32a839efafdffad061979708200558c411a62a8eb5f7f64df69a03", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781991909, "uuid": "21920329-9ba4-4f49-b50a-b995568c4a3c", "value": "T1CBF5330B44A936FECC96C630AB329E22452B79264BC616FF4B87513039B8CE55F794C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781991909, "uuid": "66057bdb-d91e-40e0-b8d2-dd700737beec", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781991909, "uuid": "d04f9e26-5acf-4a9e-b239-f4aad636a302", "value": "49152:zNUWVyxrlkHAmqy4x3994O/ujGT7wEFGdg0T/idBx8cHUQAIGzDoIwa4d8e8U:aWVyxrlkHLqxx8GT7oqx8cHHA9/nNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781991909, "uuid": "6a4c43dc-d35e-4259-a878-8cd6fd2c9bbb", "value": 3446248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781991909, "uuid": "991d0b35-9dac-4ced-8275-b3e8e29c019c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781991909, "uuid": "a396dadb-a681-4289-936b-57009d3c6689", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c1ce2a7-6ce4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781986240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986240, "uuid": "8285449b-9bf6-4175-b48c-1a93d60947c2", "comment": "Malware payload", "value": "2df13bae0b18d7701b686d4ed6be3d93", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986240, "uuid": "7751f480-d46e-45e7-a076-528b2d239e57", "comment": "Malware payload", "value": "41541d2b0efad921142ff74dae952e803c0cca19e8cc1df0b673b1ffb92162e6", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986240, "uuid": "82e779cb-0eb3-4c55-87d3-8b6cbac147a2", "comment": "Malware payload", "value": "1ec1db742f3fcee4bec4b8540342ea35c4e6e7d2", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986240, "uuid": "c9836df1-54ef-48ce-b01f-11784859a0cf", "comment": "Malware payload", "value": "1e2f2ed6c400c9c365ca3fe2bee68a849d7541fe030440c5520d691609b3bc168ec8c129ec4a311211015c310d802e2b", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986240, "uuid": "affde9e6-9b7c-44bd-8c92-69169ce1246f", "value": "T16B8533A342B7CAA86A5770373945ED853EBBC045DD990738C7F8222588E381F6B7174B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986240, "uuid": "a9a612e6-b909-4779-aaaf-045ddc625d3a", "value": "24576:mrVJhAb1GBBqGVyOndoN5gWniUktR/73dH+0qZexILfh4lsyOxcrAm9HnVTwcwwM:mhYb1GxV1ndwFktRT3dejkxvhVRuUDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781986240, "uuid": "22b72d3e-8cdb-4075-aa29-fc32fc0e770b", "value": 1741432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781986240, "uuid": "c5ec5db2-b0bd-4c5e-92fa-12b606d85ba3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986240, "uuid": "37ec51c0-1faa-4981-b619-ed92c4c111f4", "value": "bioset0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec2b5f2-6c55-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781924907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924907, "uuid": "9391000d-387b-4f73-ae5e-ae1e828b6fbb", "comment": "Malware payload (Mirai)", "value": "42fe6bf6bb1a269a8247aff9400a7d93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924907, "uuid": "5019a40e-be88-4d9e-9688-7b6a3105c42e", "comment": "Malware payload (Mirai)", "value": "41c7efdbb651b767e907b30220ebe5f8b9d7a029eaca782a05d70875d69fa4d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924907, "uuid": "ff029c8e-c809-41d1-b79f-5c26a0efe843", "comment": "Malware payload (Mirai)", "value": "5bd979bb90dd59beeaf3ef27cced6253b27ecc9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924907, "uuid": "2668ac25-3c0c-4c46-9564-cda03650237d", "comment": "Malware payload (Mirai)", "value": "e9400520641a394b503e40a084dbe130f953e17c4db3d73923ccf7d915c3e6a48f4656e5750b11c5bd0261b8bd3a0dbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781924907, "uuid": "2a2f0a8f-d477-4a1c-a608-2850ab68eeb7", "value": "T19A630259FDFF2348CE2A2439A8BD700A7500DF0999129CE1E54DA1286C51FEA1759ECB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781924907, "uuid": "827e0c2d-274b-4806-a4c1-114fa4086bab", "value": "1536:OyjSPQYByia2aFDyI70YxwrsOjVIwlBSnouy8ryG:OkSRQP2aFFaawPKoutJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781924907, "uuid": "0efe59bf-30d4-4bdd-9104-bac16480a8e0", "value": 69020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781924907, "uuid": "6495d98e-3a06-497b-99b7-40659d09e131", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781924907, "uuid": "237e810c-6ed3-43cb-9833-4afea0b833d7", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c84377d6-6cd4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781979657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781979657, "uuid": "e2f11869-b5bf-4e34-8e19-4aaad6114f01", "comment": "Malware payload (Mirai)", "value": "192fd213fe70db6e0d18dd4b47acbf3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781979657, "uuid": "6c5c0c9e-fea3-420e-acc0-59a8e40a5025", "comment": "Malware payload (Mirai)", "value": "41fc080441780fa352088d740e96d30f538138a63d29fc780520d56bfde7b428", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781979657, "uuid": "f2259284-18c4-446b-8ba3-84b1d6d6028f", "comment": "Malware payload (Mirai)", "value": "6b59dc216e49b652c947768cf6c4e258be418789", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781979657, "uuid": "55fde3fb-98bc-437f-9b0c-5284a87cf73e", "comment": "Malware payload (Mirai)", "value": "f298acdfbe6408102b4852603ddc8d456520b93fefae08710d8ebbd27cd075cf27cb64dfbf1427ee893f75de27d34b03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781979657, "uuid": "87b947cc-a62b-492f-a12c-b6f8086fd765", "value": "T1FB335BC5EA83D8F9EC1B09715033E73786B2F4791028DA87E794D936AC52B00E65B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781979657, "uuid": "7546de76-07e6-4bd2-a2d8-4662fd6ef3b4", "value": "1536:JHUcHzqjk5f9cJatHG3YdvLTTrn3s9N2lZf1x2l7E6L:JHfTqjkV9/HIYZfrn3svWZtoN7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781979657, "uuid": "5fcd4d31-ba6a-41fe-b04d-a4b2412e9476", "value": 54540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781979657, "uuid": "00f7914f-3522-492d-8af6-1a1037ddca95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781979657, "uuid": "42c6c226-a9b5-46d6-b2e5-8939d3445626", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "373aa7c4-6cb8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781967388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781967388, "uuid": "0e586ff3-71f0-4147-b1e6-615fd2c0c871", "comment": "Malware payload (Mirai)", "value": "2f4a654ac9f03592d8f1f9c6ad817f70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781967388, "uuid": "1f66f306-f40a-4d23-bc12-cb4fb7bc79cb", "comment": "Malware payload (Mirai)", "value": "435ffb7a539582331ddbed65a19a9bb86d838d418336a11416712bed3583016e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781967388, "uuid": "af3164f2-8dc4-4094-93cf-e37de9f14000", "comment": "Malware payload (Mirai)", "value": "6dea153dbc61d4d41f0a0278f6480e4ffdb99854", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781967388, "uuid": "57093109-558e-4227-8fa9-160e3be29596", "comment": "Malware payload (Mirai)", "value": "56796e255847a350ecdda6a8d2e44c47cc1af07d76ecee5b7b26bf9035eb727186155da0f6da3f782e39c5ced7724259", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781967388, "uuid": "68081be6-9f4b-4a89-921c-21520d27acce", "value": "T1A374181B6A22CF6DF268873147F34920976923D623E1D685E1ACD1119E20B9E941FFFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781967388, "uuid": "69658a8d-402e-4033-adec-d5648aae8e5d", "value": "6144:xSu3nSDem9/qzhauExiLEkRaEjtG5Iim758jzYbesl4Go:xfXy9y4uoo158jTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781967388, "uuid": "308d52b0-4577-42db-903e-70169d672626", "value": 350412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781967388, "uuid": "8adfa10c-6a13-4f91-b64c-379c2dac3a11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781967388, "uuid": "1e75e1f5-02c4-42e1-b702-24809cb9d4bf", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39a9d7d3-6c6d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781935179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935179, "uuid": "62d5b668-3ac7-4637-bec3-ec634e63206b", "comment": "Malware payload (Mirai)", "value": "bfcf12e7a00cddf43296a01681f8aab5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935179, "uuid": "16fa3da2-7df5-4e36-a1bc-90020709eca3", "comment": "Malware payload (Mirai)", "value": "442061ef65343c0ca56ffb4269285ae4f76dc513b245a23bc0f0666f13330601", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935179, "uuid": "383aa2e3-6cea-4860-a857-43037b12aab9", "comment": "Malware payload (Mirai)", "value": "0ebe8868397e5987312b601a009112dc15a83e5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935179, "uuid": "428029e3-44b6-43d9-841d-1848935f55b6", "comment": "Malware payload (Mirai)", "value": "311bd381d886900e2ee8fbfadb5fe2f0a9353ebd504cf28f03791a8a0498b57cf5479794bab2e8004ef58a237b6a2e86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935179, "uuid": "3ebd2473-fdd4-43c4-91b8-402f143ab0a7", "value": "T1E7A67B5BB5F358ECC09EC430475FD5536A31B8A402317A7B3A84AA342EB7E60576EF21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935179, "uuid": "e25d0e65-5975-4e05-979e-0c4e97d9cb6b", "value": "98304:hjP+JUXlrnu9ukdzX08wV80Rs+szmeTclPEruPVO73fjZuiKJRsBUYiCjDk7gfNK:2GSDuPQLwWlNG+cY98BC4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781935179, "uuid": "a2f1cf36-18b8-4550-80fb-09af96d973f0", "value": 9503920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781935179, "uuid": "ac11d1c6-5595-49db-a3b7-38b870667341", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935179, "uuid": "1ceb4082-4ea6-42c0-9d8c-e49be99f56cd", "value": "xmrig", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c30dcb0-6c85-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781945465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945465, "uuid": "6466563c-6cf3-4ea0-af27-2c769840386c", "comment": "Malware payload (Mirai)", "value": "6c1204f1585b47e0954eab5663b8afe3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945465, "uuid": "0ccda99d-6041-4d5b-b330-f4dc26fcab78", "comment": "Malware payload (Mirai)", "value": "453b9c8b20e60cb0d1645c3c6e971e408bf7f59240d44edb59d98fb58a4f3a23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945465, "uuid": "e7562ba0-fc78-43b6-a124-4f2db9eec7aa", "comment": "Malware payload (Mirai)", "value": "dc1292bae7ef095681406a1a4059d3d3034843d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945465, "uuid": "482f556f-3e58-496d-970e-af1b1502a7a7", "comment": "Malware payload (Mirai)", "value": "afe62cccc49546ada03578b6afb069ad9794e610f8097ee2be65b1ed28310dad65131735a08fd4185db46d8047da6869", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781945465, "uuid": "57b0b0ca-6477-4d42-ad27-7cddff6e52ce", "value": "T1C5F3D60AAF610FF7E86BDD7706E90B0528CCB85716B53F797534E814B50B18B89E3868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781945465, "uuid": "d1654a9a-749c-48e2-85c2-19d0a09f0c57", "value": "1536:wQHeRCbT+RDSmhraEyl2uwX7IjNv0jOSBYAy/OR0Ev1DjzgbDcazHd+yBQnB0iQj:wF0czaEcwMiHqbaW4yBQTQy+Ntil3Qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781945465, "uuid": "501ce02b-f548-469a-af13-b460231e69ae", "value": 170456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781945465, "uuid": "0fe5a476-9efc-4568-a42b-cb9b0b863c10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781945465, "uuid": "63430ce3-9f1f-410a-a9ae-144986a7ff36", "value": "data_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "575efdc5-6c55-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781924921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924921, "uuid": "af8553b6-4629-4344-867c-b8315318f74c", "comment": "Malware payload (Mirai)", "value": "0f9e38df87d96c499ad771a4aa3ba9ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924921, "uuid": "6bca1f61-53d3-486e-a094-5e5af7a089b6", "comment": "Malware payload (Mirai)", "value": "4625976bd66bfdfc5b197282f7acfa42a2a6ab635c9559919d6fcb12b747d28d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924921, "uuid": "75f0a6ae-bad8-4052-8272-c1ebcc0526e3", "comment": "Malware payload (Mirai)", "value": "7df1333313fb054ab49628aa6a03b0e778fe5a8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924921, "uuid": "7cb95b5d-2d4f-4c60-a115-b92f12f9506a", "comment": "Malware payload (Mirai)", "value": "f948c995264d6ce08ac2126a9766e64a55b612f97d2abf5deb6cb0c79743db271ceb56955c1170eeb843e8e2b3776f69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781924921, "uuid": "a9d1029d-4978-427c-aa15-7f5410279b89", "value": "T1EEB32941BCC2565AC2D6637AB66E568C336613F8C3DB3117CD528B253B8A92F0E77B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781924921, "uuid": "0d2c3b2a-0540-4092-abb5-6ea19cfcc57d", "value": "3072:cJL9kd/Sbwl+ebqGmLnvKdKMijrIOVH6Pha9zR/:cJLOaUx5mJjrIyHd9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781924921, "uuid": "3cd0426f-1e91-4b65-97d6-ed2cc3763851", "value": 112912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781924921, "uuid": "c867cb3f-1746-40e8-8300-1e8696c8e004", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781924921, "uuid": "f3ee84be-b50e-4734-905c-c9b7d8b75f6b", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37247eee-6cab-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781961804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961804, "uuid": "bdce06ba-56c1-4ce8-b8c0-83dace76d1c2", "comment": "Malware payload (CoinMiner)", "value": "8234ba4a21540a58a60ca07853c4279e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961804, "uuid": "35439f61-5eca-4888-95ba-377945dd5c6a", "comment": "Malware payload (CoinMiner)", "value": "47167ee6a2eedbb6a361b502516be53365b4399ca8c05a51c21b0dea8980e33f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961804, "uuid": "6b84b534-a491-479e-948c-5fa92d7abdc8", "comment": "Malware payload (CoinMiner)", "value": "47c68148c07d104bacdf77757e977f40d2fdf54f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961804, "uuid": "bae38df0-4111-484f-9be7-742e9ff1d931", "comment": "Malware payload (CoinMiner)", "value": "4c2c9e3980f49e43c60895df7e4aeeedd602c4f3ad7783641fe0e97b61bf9b122a17bdf5f60e7789a98eb69f562e6bee", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961804, "uuid": "27b6d2ba-257f-48ce-a8f4-e3507fa9d887", "value": "T1A4F533D358C2B17DC9D7083583AAF32A9A63711117025AD391E797547F2BAC23F32E4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961804, "uuid": "f339aba5-ed1b-408a-b496-af44c4e6b932", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961804, "uuid": "9bc0544c-d718-41c1-92cf-6318a2884b46", "value": "98304:m33zIJr4jzcXzM6Np55HtklhtN/0th4NI8fLM84zX:w38Z4PKfnklhtx7PfLM84T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781961804, "uuid": "0e0017a4-b2a0-4765-acc4-201c89dcfde5", "value": 3446248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781961804, "uuid": "38ae2f7e-8f78-421b-b4dc-b1c28b479370", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961804, "uuid": "c75da7df-babd-4b0c-bc66-e6bb80ee02c8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "525271b7-6c5f-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1781929208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781929208, "uuid": "01156015-4a05-4040-89bf-17aff0efb927", "comment": "Malware payload (ValleyRAT)", "value": "ab057933c39d56daa8811177ff36e625", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781929208, "uuid": "8238bf8d-d620-4cca-877a-30bed271e375", "comment": "Malware payload (ValleyRAT)", "value": "4779855cc4b61d1a576f0a74f85098d6387c0bf0f1a48eebea229f975bee10a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781929208, "uuid": "6d704f9e-fe0b-40a0-861a-dbd3493ca169", "comment": "Malware payload (ValleyRAT)", "value": "e387e53e7440520cac9a1b9ae434969e41813495", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781929208, "uuid": "dcc48185-ed99-43e4-a771-972acb9b5841", "comment": "Malware payload (ValleyRAT)", "value": "6347bc2278ff2379234076ecb8a7e044a4a390f9badf283e80bce7bec838b33e52056ce9aaecc8fd28a662091ddeb778", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781929208, "uuid": "de931a62-b6fc-4cc8-ac2b-891e3e29ab88", "value": "T14395CF13F2CBE03EE05E1B3745B2A15894FBAA616427AD5786ECB4ACCF350501E3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781929208, "uuid": "8343692e-aebc-4c45-b23d-414aef821dd2", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781929208, "uuid": "ab393178-9752-4037-bd95-e71063319a71", "value": "24576:waE+hTNrCHtLfTfuM7Djr5QpYrao2rupZdH1tQ5G28pgBUIsMmOSguOQY12t1J3+:0+MRvHCGUUPOSh1nrZEjjy3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781929208, "uuid": "08c839e4-c0cd-447b-841d-f06a80166874", "value": 1939714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781929208, "uuid": "ff668a31-5d8e-4a97-9c19-3b333ff6a4bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781929208, "uuid": "e3c1e4db-d63b-4bf7-a792-bd69b161e3fd", "value": "AB057933C39D56DAA8811177FF36E625.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed4aa908-6c3c-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781914436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781914436, "uuid": "e21e349e-3b38-4019-bdaf-99c6e7f408a6", "comment": "Malware payload (AgentTesla)", "value": "ec83b6003cb6fb9a31a342938e54446f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781914436, "uuid": "5f9da0b7-2eb5-4847-9aea-310c90f49fe7", "comment": "Malware payload (AgentTesla)", "value": "49457f4873d15debba87933ff93d9709c820d2e3ca35658af3cff7c26b62dda4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781914436, "uuid": "eadf61ec-4fb5-4f59-9b97-0cfe8571ca65", "comment": "Malware payload (AgentTesla)", "value": "e84bf44685998bf3b722fc33c536e3cf245501d7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781914436, "uuid": "3bf90a25-d11a-4172-8987-aa224d33e1c8", "comment": "Malware payload (AgentTesla)", "value": "1c0e3bed987cc8a6fcf7d106d84e0f86cd03bf5bc5285a5a49c681f7a3a5eb20a186222f58d8bda983da70f0ab0ea436", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781914436, "uuid": "cb036463-d73c-4499-af47-88dbb9ff991e", "value": "T143A3D086E1D3307CE277917092766531FD32B85A45266FBE92C0DB391EB0E40DA67F22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781914436, "uuid": "1b7c45d5-b988-45cd-a9a7-325f88270049", "value": "2df38eecc876e0e71c0fa85ae90a47f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781914436, "uuid": "7482bd74-b04f-451e-885b-f8d711518edc", "value": "1536:ICKA9vjqisDXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX2:77/sjnywuePfTvdKZH5nh5QC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781914436, "uuid": "26cc2409-b670-4a68-9bf3-5625db718291", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781914436, "uuid": "3cbc8d3d-8c62-4bad-8748-c3d65dd2a322", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781914436, "uuid": "c257eb84-007b-4eb5-9063-f43674febd48", "value": "Cs2Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f47845-6c6d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781935153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935153, "uuid": "41cb15f0-7f03-4db9-9427-63068c1d107e", "comment": "Malware payload (Mirai)", "value": "f80a57440c570c22784e74767f072ebd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935153, "uuid": "ba2bdeac-c559-4aff-9c46-661cc008bafe", "comment": "Malware payload (Mirai)", "value": "49676b0e8a1ef4e522b79a6fd52da2972a640da39eacd4adabffd35294333d9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935153, "uuid": "f1e0b765-4457-490b-ab58-3cbacbdbecd0", "comment": "Malware payload (Mirai)", "value": "50ecc12762bb00bb4cd559e8b72646c1d417b7ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935153, "uuid": "655a4da0-f3c2-49eb-9f54-5828a655ba0a", "comment": "Malware payload (Mirai)", "value": "5d1b410a5b9852b3385ee096b771b467b2637187c0beb04c18a97398309492f374ca4b387069306b9379ef26ca05bf58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935153, "uuid": "99072e0a-92bc-4777-969e-18fe4e279dd5", "value": "T1AA0633DB142E9513AE90FEBD31574FD1A290CA3F11CB2B91C6E5B1127B2F67805AB6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935153, "uuid": "3ae9514c-8a4f-45b5-b34c-2586a0845fad", "value": "98304:PJh6PmxLnBz2qIk+hdvScYx/Y3Q3Qwf5i3+rSTta:hg2Ln8cYdv6xAAbsPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781935153, "uuid": "2c9820f6-7c5c-43cf-9d46-3cdf950b9ee2", "value": 3783480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781935153, "uuid": "b3c0e3a4-e2b9-4c7e-83a6-128ffa29854f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935153, "uuid": "b77959a5-98fe-43eb-8c89-3e36fca826cb", "value": "xmrig", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d083b8cf-6c84-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781945311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945311, "uuid": "f49d9532-853d-4b41-a491-27388bc62f4f", "comment": "Malware payload (Mirai)", "value": "5544f4b21ade84bf90b04fbb33437a2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945311, "uuid": "02e9f0c2-737a-41b9-b631-5893e80e414f", "comment": "Malware payload (Mirai)", "value": "4a8de808ec46dc98c64e2b1bac4a9628b66696343202677d508c565f2429e21b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945311, "uuid": "2e339019-b692-4636-b242-b56582f5a0ac", "comment": "Malware payload (Mirai)", "value": "20180989183967f6c552b49205e1a112420d1026", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945311, "uuid": "d1a97c61-e780-431a-bdce-a6041dc66402", "comment": "Malware payload (Mirai)", "value": "c8896c5263aa6ddde2ec41f035702d7dfcf88e4c763c082f353b43165ce93193f44bed734e6509eba6fc5c4bddd4dde2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781945311, "uuid": "0fe4366a-c658-4763-81c8-6b7e0f8d1b2f", "value": "T1BBA3F849BC45AB16CAC25777FF4E4389332727A8E3EE7203DA156B21378B91B0E36541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781945311, "uuid": "c5c74f75-1aa7-4bd7-bbb2-070a35a5e7d1", "value": "3072:d0ZieOmitR5ni4Ty7DunHA719t+iZS6fBLmtF:dYutR5ni4gDung73t+wS6fBin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781945311, "uuid": "52bbd2ad-48ad-470a-a403-cd00d94b876e", "value": 99564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781945311, "uuid": "1b4733cd-7d19-4b17-9afe-be03adb81e6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781945311, "uuid": "57e1ea64-d7eb-4daf-95e6-4c82b18f3b15", "value": "rep.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac654dec-6c5a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781927212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927212, "uuid": "75f0e895-8b67-4f59-98fc-6934172d7c00", "comment": "Malware payload (Mirai)", "value": "58855dd8bb8780459748c73c935d1df1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927212, "uuid": "be941080-dacb-48b6-bc65-9072c93ab3d6", "comment": "Malware payload (Mirai)", "value": "4b1975ada28b892fd1b2ea2b4527e1764c29b342070afaa49fac6d68a0dafa76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927212, "uuid": "d0b0b23b-66c7-4198-8448-aa3ba1eebeb4", "comment": "Malware payload (Mirai)", "value": "a69a4ea4db5682189037b0ad5f900149d1e0fcdd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927212, "uuid": "256ef818-b9eb-4131-8c88-b5b2ba5f8a6a", "comment": "Malware payload (Mirai)", "value": "1fcb8e55d6f60729f4cf4ed6a0d7be0833d02b21381503484588032a0063e422083296f72351f4d9b048ca5f44b0fc33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781927212, "uuid": "a757b88b-c8e8-4ce6-b4bc-fff072f51f48", "value": "T1DD83024209839DAAC35046F9D74644F3BFAA11F8F9287052987FC7E8AC57650EFF8906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781927212, "uuid": "65140bdb-6e8a-4f1f-b1f9-cd7a0039bc33", "value": "1536:UUIt/nYFhRC83CkSKe0bf+TlJ9B27skUvf/e7KSRiFvbWPT6G++BLcWMBrzb:IlnYJjS4Vf+h1Bkh4vbWPm+BLcdBrv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781927212, "uuid": "9e805434-e3aa-4368-861b-98d95e825455", "value": 80960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781927212, "uuid": "07ca89f1-3e0b-44c3-b57f-e51e6ad4ffc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781927212, "uuid": "dda85af3-e067-4911-a7df-819f39405a96", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb384fa-6ce8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781988336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988336, "uuid": "da8d0624-86e6-466a-8897-096a338988b2", "comment": "Malware payload (Mirai)", "value": "4f03f5474424a38f56c3a0d7cfdd6586", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988336, "uuid": "be037257-9580-4882-b858-b882caea057e", "comment": "Malware payload (Mirai)", "value": "4b45fc7bd3f81203fb9ff383f45b39dc9bc291437a141610b76cd9f3620ec308", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988336, "uuid": "fd02909c-47bb-4cb1-82f7-1119768e954e", "comment": "Malware payload (Mirai)", "value": "469ce56afa879c7163c52ae09d89d9cc6a339395", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988336, "uuid": "1998dd23-0979-4b35-aeb0-28eae50aa364", "comment": "Malware payload (Mirai)", "value": "7c0c08068a48e88076c2c6e81a4a46890a3800c29990fc20546d17d4e3093ff086ec930f09f8d22c121c2f5ed1f8be96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988336, "uuid": "82591c5f-6b90-433f-8ed6-22a6cbb2191f", "value": "T14CB32849FC809B01D5E42A7AFA5D51CD33270BF8E3EE7116DC255F2567CA91B0E3AA02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988336, "uuid": "fa3da816-c41e-47ad-a7f1-db88f1eee19d", "value": "3072:0n/W4ocXgOJrklCCQwN3OpiRTLCRn1KtPKzsgcQL6y:07heQs3OpQTLe1wPKzsg5L6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781988336, "uuid": "a539d67f-69b2-49cf-893a-9b7b8a0615f2", "value": 118080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781988336, "uuid": "49378cfd-def6-48e2-aa19-19b95b18072e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988336, "uuid": "3150532e-ad72-47e9-9fb4-9f33a0d72453", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a607cdc-6ce6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781987257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781987257, "uuid": "09050f24-ba1d-4a71-ac6d-a69a0cb5ce1f", "comment": "Malware payload", "value": "df05c04910a565e6f158d8c430d096fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781987257, "uuid": "fd2631fa-56e7-4f39-86ba-866e9cee6cfd", "comment": "Malware payload", "value": "4bb095a58fff5ed716654429a5d3e85659f5e88fdb3d70991fe74ea5d86572cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781987257, "uuid": "35f9d5fa-0e98-4edc-bbf9-83233f773a68", "comment": "Malware payload", "value": "14d3c6ae2040d6c7ab5d498ecf59008fb1f20eed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781987257, "uuid": "0d931444-e391-4715-b0b9-85d2bd4fb39c", "comment": "Malware payload", "value": "a87b1a986c76649c629d74112c97d3f1658f7906547caeda1be6f506b5ede348a1a231d0042ab0e64b0d25466999fc37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781987257, "uuid": "740303ed-bd44-4ee2-bf1f-06a5caf63e8a", "value": "T181B31228E1D70837FDFACDE6A464DD6EB342205FB3D22C611124FBEEB580D9A564070A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781987257, "uuid": "b8345fd3-738e-41d1-bfb8-ea249b40e948", "value": "3072:W5Vg0dAAH8/NasNzeCw+TFH5WuyXHPCia3SxD4hCuqmcNos4u+qgwp4D:WY0dr8/NxzVTWVHPCxSfHmcNoo2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781987257, "uuid": "ffba118e-f5a8-4475-89eb-5258a08e0df0", "value": 116080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781987257, "uuid": "525181af-3c1d-4813-9c2c-48ac07f5fed2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781987257, "uuid": "6b005760-52c7-43dc-aad5-c736513a140b", "value": "kworkerd-writeback", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79dd1da0-6ce8-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781988115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988115, "uuid": "2371152e-e844-499b-82d6-d14164168ca6", "comment": "Malware payload (ConnectWise)", "value": "671a415b70981898a6a51d0fd2f9322b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988115, "uuid": "b80f58d5-20ff-4b19-83a9-a3a7c015150f", "comment": "Malware payload (ConnectWise)", "value": "4c6c3fb40ded613933d00a87000b065649322eec736018493bc607ce72c76017", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988115, "uuid": "482eae28-9ecd-4728-9b86-b840b7a603a9", "comment": "Malware payload (ConnectWise)", "value": "9ebe2e5fab3e8c4670f32873572b14ff9fc5927c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988115, "uuid": "e2ada554-15c9-47ff-888a-753d206b608b", "comment": "Malware payload (ConnectWise)", "value": "16be9e4d57119b5d17a0e946c2d703899bf564995c20f88e4e829f41efa007d83509863602c095021d177506cd678610", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988115, "uuid": "c5f4b5f1-9548-4125-8f27-18e7f3757979", "value": "T14234436E3283D90A6F768E4C429D8BC826F5E64DC5DF69C4C38094B5E7D84D720983BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988115, "uuid": "73691fac-c7b3-463b-8ec3-c3bf45e8be9e", "value": "6144:hDSQ/iWRROPtw3D+dDQtNHPTVMBvQ/8m4bCpgkLhzpw:MQ/RwPtwK1aNHPTVYvQkPOyMTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781988115, "uuid": "d60b782d-e002-45d2-8a24-232affa7250a", "value": 236028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781988115, "uuid": "3c0375fc-d29e-404a-9e35-54198707535d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988115, "uuid": "7fd30201-ef1a-4863-b1e9-5bfec80c9ad8", "value": "Adobe_Acrobat_Reader_DC_Updater_Windows_installer_Win11_x86_x64_Win10-Win11_x64.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13dec2bf-6cda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781981931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981931, "uuid": "6bbe6a2c-81b7-45f8-aba7-2285f64b368c", "comment": "Malware payload (Mirai)", "value": "3143b75465461f8d41b299fc5fb6ac31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981931, "uuid": "4c596764-dbda-415d-8409-5821b8bed0e7", "comment": "Malware payload (Mirai)", "value": "4d4e52f75a6ed80e486a147d377c308ac5cd111cae7b775d7a4f33bd38248c1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981931, "uuid": "b7f99f13-f89d-4922-abe0-3590cbfc6e11", "comment": "Malware payload (Mirai)", "value": "08fb322909c4491b8f57666396d5a4748a4be9c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981931, "uuid": "bd825419-064f-4a2f-9ea1-a3b252d3f6fc", "comment": "Malware payload (Mirai)", "value": "f7df7f9aed7d57ec4f2b8b64990ca65fbb5a148f106e52bedf72c9fd5552ab46c8fc6ade954132c969935e77fc8404ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981931, "uuid": "75f32abd-21ad-4d63-a69c-37624f20ce5b", "value": "T193241990BA59EC32C05E1D3667FBDB593B0369D14EA39104C460EBCCBB875C0AB6857B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981931, "uuid": "458dbd00-ba02-42db-96b2-492e54c9876b", "value": "3072:fDbXY3kGL71D5oItsE4meiPuBzdWdIAV547OtEmj77nGGL72+:fX1G3HoISE5PuNkV54svjpL72+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781981931, "uuid": "201bb8c8-4c9f-4a23-b189-97c675c85e1e", "value": 213080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781981931, "uuid": "d7df8100-f4dc-4e64-891a-35c15c6fe184", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981931, "uuid": "0ec4bc41-4ab9-4718-8072-22ef4034e3ff", "value": "bin.armv4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e0264b5-6c55-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781924906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924906, "uuid": "adec0c62-2b2c-4c27-980d-5aeb41c756b8", "comment": "Malware payload (Mirai)", "value": "beb3c0e871009bcb21497411fbc1aa2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924906, "uuid": "f0dd1fd4-7021-492c-a2d8-afea723ff647", "comment": "Malware payload (Mirai)", "value": "4d8e51b9e14202926d2ab417a1957f4a46d0009502be35942c47c69e41329729", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924906, "uuid": "22e0dc6c-e622-4248-81d6-294adac2a271", "comment": "Malware payload (Mirai)", "value": "cbc5955aab09af30ae64323fc7b477e074166c89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924906, "uuid": "962a26f7-4999-4505-9ba2-379c780fbd03", "comment": "Malware payload (Mirai)", "value": "d8404b9a251c64188a2896efadc35613e78e6995ee883cb60fb69b46bb47a1118d9f8b0327d3894ce967f2296b384995", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781924906, "uuid": "024830b2-0f3f-4854-98c7-80a1e3ad402d", "value": "T1F623E1716385C992E7A2903B349DC0B876D30CE5C4D8E626066463BD2F4A097F7F94B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781924906, "uuid": "559bf6df-cac7-442a-b639-2170b82f711a", "value": "768:wAnG9711n1wweNS5RLqkkBr79TUmShHYSXxvEBos8RtYZLsz+DSuTXDvjdUncXhO:wz9h1n6pJ79TUm+HYSBvrqjOydUWhqB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781924906, "uuid": "415bebc8-f8f5-4379-b09c-a50024a78de4", "value": 46980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781924906, "uuid": "bb14a66a-9ba8-4a6f-bd8f-422c6b8ab8a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781924906, "uuid": "3eda2380-851e-4a12-882c-90695fa06651", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b28e57-6ca6-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781959981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959981, "uuid": "10c12601-9343-4801-a117-c624cb6b3e78", "comment": "Malware payload (Gafgyt)", "value": "cc7ec9d2bd0c2bc6a632f2dbab0f0142", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959981, "uuid": "fcd840e2-82ee-4323-9d9a-d6584ffd0e78", "comment": "Malware payload (Gafgyt)", "value": "4fed5e6f83c9e22d6053b230892919ad32773528673739c5c453ebba094fea2a", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959981, "uuid": "3b19a990-9e7f-4fcd-8ba4-57ffdfaafac7", "comment": "Malware payload (Gafgyt)", "value": "433a393b2edb9fb3b5813c620eac07a0e33a6512", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959981, "uuid": "e053a7b5-e4b2-4f78-99f0-e76747f21abb", "comment": "Malware payload (Gafgyt)", "value": "ef23e135a2f129687fc84c7d9e29b0366397dfd00fcbd6c743280c6b92692bed5f8eff082edf6ab263c68dfedc7819a9", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959981, "uuid": "eb7f4011-2329-4993-83bf-5b6d8c62229b", "value": "T19941A089606149B06E60A9EF32698CC032C0D4A67CC56FF55DFCF8E40AADE947830BC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959981, "uuid": "774f565f-9174-4a05-89e2-f9c8c30432a0", "value": "48:v5b0hE5oJdelKk9P/LJVbZHd5UNuVCMJNlLi2uH0oX:vx9KkddxZ9NCWNlLi2uH06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781959981, "uuid": "f33828a0-cdc4-4f28-a70f-83aa278bff9c", "value": 2302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781959981, "uuid": "f5e3589a-3bc1-4191-86b6-370f60b37f16", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959981, "uuid": "d3dbaa8e-1b79-4259-b6eb-a6bee718f531", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f309ddb-6c4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781922331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922331, "uuid": "938e04b8-5232-43fb-bc31-fcb3333cbbd8", "comment": "Malware payload (Mirai)", "value": "28ab528543b0329af14a3c5218566669", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922331, "uuid": "fcd0ec1c-bcb2-41af-b63f-1eab68a5e823", "comment": "Malware payload (Mirai)", "value": "4ffefdefae8edda5329c6c397a46c5f9b3a247e9b103ca3abb9f289ab558d209", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922331, "uuid": "354ce4b1-0d44-45f6-90d2-b6269bde0f41", "comment": "Malware payload (Mirai)", "value": "95ec2c23f54ddb2d4b116357d6653cbd5dd5765c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922331, "uuid": "99c4c434-05de-484c-af5a-7ed49f9bd7a0", "comment": "Malware payload (Mirai)", "value": "d691e2dad15a195a69daf2e3a78a4f1b19ebc1ffdae2c8ce03a97700f272ad5528c30291f410126c215b55327718a339", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922331, "uuid": "514ffc9e-30c1-4388-b333-060339b5d5da", "value": "T107242A46B8819F15D5D016BEFA1D128D332717B8E2DE7212DD206F757B8A86F0E3BA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922331, "uuid": "14309fb3-926e-4f2f-a9be-5599eaffaaae", "value": "3072:luVntxxKgi0Jqy9Ui4+RjR4JIc2ATwvohw/UdXMd8X1gjqhaIdQu3LHNltMWqFRr:a9BgyF4mj0NQim8Xqj+aLiHNgWqFR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781922331, "uuid": "6bf7b850-937a-4f96-bd60-0f8d41841293", "value": 226908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781922331, "uuid": "cb7e6c6e-37ac-4070-9ada-6b3d6fd07888", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922331, "uuid": "48c36a6e-90b8-44fa-bd9c-45fd9c7eaebe", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a3c878-6c55-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781924925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924925, "uuid": "15b1ac76-c2bc-4552-823b-aaeee133f864", "comment": "Malware payload (Mirai)", "value": "232fa0bf4c7c490e1adf12ddb3dd3c36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924925, "uuid": "4bfe6cd7-1988-45c2-9c45-d3e99e169d9f", "comment": "Malware payload (Mirai)", "value": "50b9991b0b53ae56a20ed007ce3195be232aa3af4ee225c0eddcf6e2b4635db3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924925, "uuid": "4b33b2c1-9e6d-4f5f-a0db-2ee3311eae1c", "comment": "Malware payload (Mirai)", "value": "c00890551895f1daaf0a4f5fe7bb022d5b7ef7c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924925, "uuid": "fb5b3999-282e-4122-b611-e4d594305f61", "comment": "Malware payload (Mirai)", "value": "c686964052b6ad0c6d07cb6488db9a0f0a3df28f72a3e6e679b32879dde33d15f28bed39bcddd11155bb6dc296d81831", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781924925, "uuid": "94a1e6e8-155c-4515-bb62-0191879362a7", "value": "T17EF38DC1F743D4F5E91B42B020A7F7368B72A439102FFE46D769AD36AC52A01951B3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781924925, "uuid": "50d1d53a-6862-419e-81b7-7e2d3c7ccb1e", "value": "3072:ShXlyRIC6GUUt3GnzvD4iaG+e0rvYlPh4zPL7fk3yBHdvMQ0GYzv8n:UXlyRIPGUUtWDD48+ewvYZh4h5lMQGUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781924925, "uuid": "b023deac-b709-4cf1-80cb-e7e97854355c", "value": 164456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781924925, "uuid": "819f5145-5ef0-4f94-904c-178897cc3106", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781924925, "uuid": "8f03b47f-766a-4721-b62a-73df6aacaf8d", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd32982-6c6d-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781935290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935290, "uuid": "83656e97-0bf7-4e24-88b0-4b3cf2ca7cb3", "comment": "Malware payload (CoinMiner)", "value": "3a5d7a39bae10b9171315bab6cf99cbe", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935290, "uuid": "860c5d61-d114-43a6-965c-c8cf5ae210aa", "comment": "Malware payload (CoinMiner)", "value": "50f59b6efe71baad62541f4a344a0d7b8b1d39a0254ff58a1839781679515fd3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935290, "uuid": "dc1b74ae-3a8d-4ba3-b038-2be2e6699791", "comment": "Malware payload (CoinMiner)", "value": "1990aa35e335f8697c0b8d3a2cc98ea037b8b880", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935290, "uuid": "81c0a53f-dfdd-4b57-b6dd-4d18df07ad96", "comment": "Malware payload (CoinMiner)", "value": "b34fae2116f37d1b5345ba5b0ea3bd3e95bea5ee7b988315143c7def9f0f6643ebafd080ab37239bb241a0ffb7f822b3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935290, "uuid": "efb07487-20e9-4159-99bb-e0de361e270c", "value": "T1DEB312606A4C19B4E60F0E3EDEC91BD36F349F4F513DCA2D218A7B11382B96AE214F51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935290, "uuid": "f675c3f2-40cb-47b8-875e-199643ce32e7", "value": "3072:p1Us9e/p45uysxmVRa5paTk3eLS037CFm3oAjO59wb4u+qgw14H:p/8p+1WeRaLUk3eS0Wg37O5K3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781935290, "uuid": "554bff1f-5880-4d64-833d-876630aafa68", "value": 115904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781935290, "uuid": "21f0f758-f72d-40a8-8a0f-55aa5b63d870", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935290, "uuid": "554d9ec6-a822-4a0a-90b2-2076ba2f0967", "value": "kworkerd-writeback", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5abd8f89-6cf1-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781991929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781991929, "uuid": "9cb8158e-629b-482a-af33-ab694a20c1b5", "comment": "Malware payload (CoinMiner)", "value": "60e777e3511e77ed3504aa4743edd945", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781991929, "uuid": "9e852661-d4a7-486b-85eb-a217e3f68ca6", "comment": "Malware payload (CoinMiner)", "value": "5122b2cc1fc99c60330b863c94e09e82553eff28cbfba8496f30bea88465b77d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781991929, "uuid": "b6c7273e-ccfe-46cf-a93f-e40684a08785", "comment": "Malware payload (CoinMiner)", "value": "11fbd76ea1316ecc5aaf7face831b33ed0e0abd6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781991929, "uuid": "65016383-bbb2-4d92-b306-c3d0500d4d1a", "comment": "Malware payload (CoinMiner)", "value": "6a88ca9cc0bb220e5d2dc21cd9579cfbaa02eb034ed2b8d256bff860e20e71ffa4c652b342a55330092f1c3392040a4c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781991929, "uuid": "b6b0ecc1-c948-4895-be95-35bb9d7b69a2", "value": "T1CDF533D122C05AF8F1EAC535839C2D154A177675AF26B6EF138386103E3BAC65E3AD1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781991929, "uuid": "c0d7f6ea-1788-4ea8-b6bb-7ef16706d2b5", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781991929, "uuid": "48399889-6f5e-48de-8010-8fc768a8e3f4", "value": "49152:WDJlJnWGWKwmZWz/gk7u+3vxcXhYuaV0tAQl3Cx7BMqQ:vR3jgk6+fxcXhYuayACyAv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781991929, "uuid": "e86abd34-1084-4caa-8c10-cf2b1cf5f5ea", "value": 3446248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781991929, "uuid": "2cb357ab-f99a-4b9c-9c63-96865b953918", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781991929, "uuid": "06e443f8-7683-4aa7-a257-5ab9254f9e7e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b502706-6cb0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781963959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781963959, "uuid": "fc719f90-2ffa-4160-b4f5-2dd3d0b00084", "comment": "Malware payload", "value": "bdbca1c1f12a7bbb9478a22cc20ea6fb", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Cerbu", "colour": "#E330E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "mikey", "colour": "#B4B08E", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781963959, "uuid": "677348bb-48dc-4e54-a4b0-6efca36a49fe", "comment": "Malware payload", "value": "51caa2cec6aecbe77c279f5956ed364acc9f05ec580c98a465a89256fcb9ea9c", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Cerbu", "colour": "#E330E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "mikey", "colour": "#B4B08E", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781963959, "uuid": "1090db63-56b6-4e1c-b5bc-71cb18b3a076", "comment": "Malware payload", "value": "9f498d0c57865b28702fff8363a0a3c838326b68", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Cerbu", "colour": "#E330E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "mikey", "colour": "#B4B08E", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781963959, "uuid": "153826c5-4ea8-4065-b8bb-41cbeeae43dc", "comment": "Malware payload", "value": "8e07f08699661f963a5255b93546eae2c4be97baed6ccda74c99a0b068231c77b7a211e72c2b982e4075be0211aa302d", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Cerbu", "colour": "#E330E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "mikey", "colour": "#B4B08E", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781963959, "uuid": "eb1dcd60-f72e-4bcf-b54a-0446ac44dc7f", "value": "T1E846332B96AD15E3E2EA6A34890ED8109F31B7B54E0F778F934454BA5F123C06D3C762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781963959, "uuid": "74c475df-c783-421e-b596-5fef99b0ca03", "value": "d54f4ce7166adf987d04345af91ff939", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781963959, "uuid": "f685c129-f654-4158-bdd1-bca4f9a06938", "value": "98304:dRjghzBj3IIK+nPGpz6kTAfk8XHeQRWRn1MkzghaxJTjiTLpjPvUQh:dWhdj3IIK+nPAz6QAfk8OQYbzwaxQpjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781963959, "uuid": "cbeba0f6-da44-4eba-a2d5-d68665c2c7a5", "value": 5367802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781963959, "uuid": "733d2702-2d58-439f-83c3-46ee02e06ab7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781963959, "uuid": "88765d4d-b497-41c4-b4ca-aa22effd08f2", "value": "TGZapret.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49288af6-6cdb-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1781982450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781982450, "uuid": "c3245449-7f7e-4da1-ac54-82f1533159c1", "comment": "Malware payload (RemusStealer)", "value": "d45dad3c505e89ac54acb6dbc86ec41e", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781982450, "uuid": "11370be9-852e-46f0-97f8-b47987d0b87e", "comment": "Malware payload (RemusStealer)", "value": "526ae427fececcdfb7d231d95a3a4f3ffa83c130ed5d58192daad06510f4ee69", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781982450, "uuid": "82ccc277-c268-4f87-99fc-b5dd6cfd7857", "comment": "Malware payload (RemusStealer)", "value": "d9e22066987e02a6bd6e50fe3882109a1ad2567e", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781982450, "uuid": "c7f364c7-88e5-4d5f-aab0-a50928108d25", "comment": "Malware payload (RemusStealer)", "value": "5ab62a6c347473d4ad9d375a44d0149255060a28f636de0779f9f5fc379f4b6ba2d59382a150343b1be23cc689edaa1f", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781982450, "uuid": "4bbabbc3-c0e3-47fb-a372-e1ae17f1de25", "value": "T18DF522223F94D902D8AA1E718A70CBF81720FC1D8945DB9734E7AE1F7D9E6C75E02588", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781982450, "uuid": "dc81ac0c-076f-4b58-b426-76495e46b648", "value": "d9c0bfb4053066384ee7484b4c2917f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781982450, "uuid": "010690ae-33e6-47c1-9389-1455bdbafb6a", "value": "49152:ih+DpOIjw1yXYpexFaNpGHrZEf2m04Mfqn4epjK7i2/vx39lA5IxN4S:iADMI8kvxGKbm7AkEx7Cw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781982450, "uuid": "bb14db34-9603-493f-98ae-543588b361b6", "value": 3479408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781982450, "uuid": "006b9088-aa21-4329-b9e7-8bea26ae5649", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781982450, "uuid": "fbfacd9f-0b9a-4f41-a080-cc428e68560b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43752753-6cf1-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781991889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781991889, "uuid": "04bb3479-bbde-4099-8202-17c96df6d834", "comment": "Malware payload (CoinMiner)", "value": "2ed805decde82a5dba7cb9210d0b76ac", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781991889, "uuid": "11ee9850-01bc-43f9-adbd-2f4196e2c28d", "comment": "Malware payload (CoinMiner)", "value": "52764c8c74bc2ec19138f7bbaaeb30fc24f5384709409e756f3edb03848c67bb", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781991889, "uuid": "9eac997f-1b4b-4646-b2fe-df0678520906", "comment": "Malware payload (CoinMiner)", "value": "26bd4d81a16ea2726cc7c645fd00a6427e3202d6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781991889, "uuid": "14edae1a-6402-40e8-8971-2c7510762631", "comment": "Malware payload (CoinMiner)", "value": "21e5e2b45000e918d669264146a8cf84bfb5895097f81dfba6efd8dc06bf4671fdbd6d5c495513dea3979ee1df307686", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781991889, "uuid": "fe95d4b3-b39f-4a79-b5ac-be2dd8dd48c8", "value": "T1EDF533C1B1D452FDC26DF8388BAEAF766406BA323F3349C772817946B6708946E10E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781991889, "uuid": "261e9cab-e41f-48c0-864e-15a3babf7a48", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781991889, "uuid": "31407fa9-4531-45b7-ac05-3f89136216f4", "value": "49152:ScUkaW5OSRRMxaZRupIU2AT9OTDfE4bxc3TspGAsOUzEJwRU+HqhPkDeDNbIZfXP:SLMI1O+JUE4A5zEkHcP0wCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781991889, "uuid": "85457e70-fde6-4295-9460-4b08f0549f42", "value": 3445736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781991889, "uuid": "446aac76-60dd-45dc-a07c-35424f5aa780", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781991889, "uuid": "9554d7cb-f26f-4e73-95aa-49a991bf0fba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dcaeb5b-6ce4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781986243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986243, "uuid": "28a4a92b-a290-4e72-8130-a0dcd7f44aa7", "comment": "Malware payload", "value": "c73ef7a2810a8c499b1ef4f6ead5b26d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986243, "uuid": "23304225-34fe-4c66-8b99-a28394c119ae", "comment": "Malware payload", "value": "531518f1b8c7d743defda272598e38d65f902f89eb152b0881add72aaf5c2e08", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986243, "uuid": "1adaec4c-fdb4-4ee9-8e4f-b3f500c721ec", "comment": "Malware payload", "value": "5e736f5b8069d650ac7c61c02888dc0200007b86", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986243, "uuid": "e2b57ffa-3b13-45e1-9d4a-d19790dca42a", "comment": "Malware payload", "value": "2449f935f4ffa5b0b0951b2d1c9d35aff80fc5efacc74fe0ee0caef7e27d0bc68027143660e0171b47ab2077f5f6fd32", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986243, "uuid": "f1d22dbf-8137-4e2b-9a66-84a92ec3acf1", "value": "T194567C0EFD24CFB5C6A003B649B812981371AD026FC74B03A239F77CBDB6694DE46695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986243, "uuid": "cf43b19f-8113-47a2-b33c-f45957bca596", "value": "49152:IjF2jHDAjjzBTcU3bwZuxxYYupigw+8p15uwQAg5Ev:tjmjzBTcrXBJEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781986243, "uuid": "26e66be9-c550-4d5e-82ca-5acdb69545da", "value": 5963924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781986243, "uuid": "27444171-6162-42c4-a5bf-8dadb7681f7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986243, "uuid": "d87dbc84-c0c0-4fc1-977d-85331cb444c5", "value": "cfg80211d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e279def5-6cda-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781982278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781982278, "uuid": "e6558325-f915-496b-9668-963de7a60745", "comment": "Malware payload", "value": "a6fa8219cfc0270e5cae4d252a78add8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781982278, "uuid": "8b471d3b-6c5a-48ec-bb1c-eef3e236439c", "comment": "Malware payload", "value": "5390c32de7ad5886330c7e66667b41ed652e1e0e9411591c4d9be1d40e2fdb01", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781982278, "uuid": "22e100c1-d739-4029-81d2-6a05627ec840", "comment": "Malware payload", "value": "d73ef6a79c134589c55489c1723059b035ca4562", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781982278, "uuid": "027a8750-b903-4c7f-b73f-f3f1dfd233be", "comment": "Malware payload", "value": "0af7e2c0d36f1f1a0a948654f6ed2a25a9eebc9bb6bfe4ee9acaf908a2ca3dbb2927f6fc9533d947707a60bdb18b5126", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781982278, "uuid": "b1ff81b9-a6ad-43c3-abce-f66841c2a2c5", "value": "T15D01AFC64640E9109069CA5D77A79590B461C3CF074A0B6C7FDD1D2DFB8C914F127F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781982278, "uuid": "ec1f6755-762e-439f-9a9a-6d470a199607", "value": "24:kXCKysE2hi0ziQvZohaSX0dr+0a1etPZXb7LN7:e9Qp+MsSKr+0a1et97N7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781982278, "uuid": "5c3695ff-9afb-490f-8242-f2c16f2dde99", "value": 843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781982278, "uuid": "d7f185f1-03bf-42fd-9573-06f6a551a646", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781982278, "uuid": "a6e1f5bf-a491-4909-9bb4-6a56842ca2f7", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "390e2be1-6cb8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781967391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781967391, "uuid": "48188610-11ce-4bd6-8327-42486d81acd2", "comment": "Malware payload (Mirai)", "value": "f32e11dab70e8588354381dd16ef7fd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781967391, "uuid": "a7e33020-e048-4a8b-804d-0ef4d2464a50", "comment": "Malware payload (Mirai)", "value": "53cd40cb41eebef3f2f645433622de4ad606085337aeb27a9410eb0b0d89afab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781967391, "uuid": "d35e1dc1-700d-4a74-873d-8d06d2222b1b", "comment": "Malware payload (Mirai)", "value": "bd1fd6c213d2c7186b29c86b76a285c8a856d281", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781967391, "uuid": "7e24427d-840e-44b7-a8e6-e2b5e972cc1a", "comment": "Malware payload (Mirai)", "value": "c8a09030db8e5d0c1a543287814f0825bd96e46ee0c410d13f575a5cbdf968bfa23120306a24f4b2178d6a048507eb1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781967391, "uuid": "c66bb55b-6811-4f9c-ad15-60e037a82f4b", "value": "T14A146D41F7C3C0F6E9570DB1106BB33B9B326D2A803ADA53D765AA32ED25742D12E25C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781967391, "uuid": "728bee93-a5f0-4859-a5e4-ef068f7c7344", "value": "3072:hMIMegF5qevaE2f301l+AlY538qlqBYI2LPhULp/afhTyxVIQSFUVds:ieg5qO2fE1lPa538WszHSkds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781967391, "uuid": "5e5035f8-9afe-4d6b-8274-16772b07b699", "value": 206828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781967391, "uuid": "38c2cb50-35ba-4e28-922e-dfece693864d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781967391, "uuid": "e321e938-7918-47e5-b3dd-850be96654b7", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25922dd9-6ce9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781988403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988403, "uuid": "7ca329fb-991c-4b09-912b-57bf311a8f97", "comment": "Malware payload (Mirai)", "value": "2d1013aefc85a0549486356845ad577f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988403, "uuid": "c51b6459-fb63-4175-9991-75137ed3d055", "comment": "Malware payload (Mirai)", "value": "5401b74c9a0d32febbf9ecbaa6665ab839d66f53a54c06fb4f0ac14207a2c4a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988403, "uuid": "297eb026-8614-4bcf-8018-375e6c5b5533", "comment": "Malware payload (Mirai)", "value": "6c769de6f0e2c9bc989b47187c80185c9640ca5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988403, "uuid": "48a9baaf-7a14-42c0-9576-f75d19bdd5ed", "comment": "Malware payload (Mirai)", "value": "65a8444fa1df876ec22543d3f5584dd59b8dd7b78b65ca682e8e0aac83623dde6022c4d7f7375c7eb8f21909ed093228", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988403, "uuid": "674309c5-2a0d-4c5b-9a7c-ddc25979daa3", "value": "T1F3437CC4AA83E4F5FC9701751033A73B5A72F4351069DA87C369D83BBC52A11EA2B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988403, "uuid": "b46ef150-d6c2-4dbe-b0e7-a18186780825", "value": "1536:ZyN5z8bAOpvnd02e98v2POtI7iiBDBwJSz0RZ17+v2nzhNKSM:0N5wUOpvnReO2WtKwgz0r1K+nM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781988403, "uuid": "fdb6fb80-2928-405a-9a95-d2c794f47152", "value": 59152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781988403, "uuid": "913a4b7d-8c1e-4552-a15b-28493614d958", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988403, "uuid": "18bb0198-af17-4379-b8ff-24235a92c7bf", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b0fb9f4-6c6d-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781935289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935289, "uuid": "65783faf-1a9a-4889-9d45-c0d42f8dfea6", "comment": "Malware payload (CoinMiner)", "value": "db5ceabf31f6fa9ded82bac337a21c45", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935289, "uuid": "d2130d74-2fef-483e-b68c-54f58af0e5e1", "comment": "Malware payload (CoinMiner)", "value": "5493b99616ac9ef5b8391505dc0e07544a74efd78f113331e6d536db39fb985c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935289, "uuid": "0f094c84-1775-483e-b328-eb94d2e3ca53", "comment": "Malware payload (CoinMiner)", "value": "0f2dffe446bc1d031f49ddba02e52df34e4543c6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935289, "uuid": "f766dd90-b0f3-48ea-a5a3-7ece6f3151c1", "comment": "Malware payload (CoinMiner)", "value": "28609c8d7d6d447c3d08036afe34d86e90fc74635585388c96073913a9cfe17041e9fd93a405dd309fbbcdfda0d67601", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935289, "uuid": "a7a2b43f-2766-43ec-8260-7932c9d7929f", "value": "T12AA3123827DD584BE4B849B13124A12517BF5A20EBDA2FA765E88EE1CD070C77AF1317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935289, "uuid": "410bab98-478a-41a5-9a21-7cf80ac04d5d", "value": "3072:Cng01ewb5Wh5Oe52bnGGvaZ1KWeM/njaH:Cng2e7qesiWanKKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781935289, "uuid": "ecbb6ce2-47ba-4ca2-b927-887e0fdef8e2", "value": 105136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781935289, "uuid": "17efd053-f7fb-443c-b253-b15d2f38762c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935289, "uuid": "b5dbcd2a-7f9b-46fc-afc1-c1f51e7c503e", "value": "kworkerd-softirq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21bdbf2e-6c3d-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1781914524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781914524, "uuid": "ef6ae6e2-5309-4757-8294-032142b57106", "comment": "Malware payload (WannaCry)", "value": "3e90a82f5360cae528a12c76d22fe6a2", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781914524, "uuid": "119c1925-8b74-4abd-8786-97304eecc74a", "comment": "Malware payload (WannaCry)", "value": "55f65c7a077407e09b5bf46c0d1885e88759583bb56ee3c5495804d0da127dab", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781914524, "uuid": "1682a6fc-0fa1-494d-9612-5614ad7bce5e", "comment": "Malware payload (WannaCry)", "value": "6bfb4ccd96be883142ec5bb5f35846feaca79b81", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781914524, "uuid": "3f13076d-aeaa-4ce8-b6df-621452f75180", "comment": "Malware payload (WannaCry)", "value": "c54edd5243d4493da52475148e53e54c7cb0e4d1025cc00c7cea811b5ccaacb2335ddab1b7247cebb21c8e32924bb793", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781914524, "uuid": "600cec4b-283d-492e-9da2-26a58bec3114", "value": "T16B36239932BC91FCD10619B884B78E16F3B37C5A12FE5B0F9B40456A1E13B56BB60B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781914524, "uuid": "9e46e350-825e-4078-8c3f-cbfe45f74d67", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781914524, "uuid": "f4d2b9f2-2803-4862-89a3-db11f0085116", "value": "49152:jnznRQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:DTaqPoBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781914524, "uuid": "4ac5af32-270b-4c79-9440-e45694831c97", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781914524, "uuid": "7f387475-9933-4bfc-957e-9cf4f726ab6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781914524, "uuid": "2a3e5614-64fe-4cf8-8e06-2441f5e9a63e", "value": "55f65c7a077407e09b5bf46c0d1885e88759583bb56ee3c5495804d0da127dab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1552079-6c90-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781950520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950520, "uuid": "58405e4d-fbf4-4d3c-a48f-b8b4cefaa8ed", "comment": "Malware payload", "value": "d86b2850824cf78bd2bef747d02f36ae", "object_relation": "md5", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950520, "uuid": "d9f93dd2-123d-4b37-884c-1ce261b66cf3", "comment": "Malware payload", "value": "570230c86554d823431b174ac14acb804984eed9c232970ec58c72584e61949b", "object_relation": "sha256", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950520, "uuid": "5049943e-b0ad-4f82-b516-0d412ba578b3", "comment": "Malware payload", "value": "538ed87cd7b5484fdc669ecbefb00870cfc4ccfc", "object_relation": "sha1", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950520, "uuid": "f64a2a87-cd6e-4607-a7cb-c978a0c3f9fa", "comment": "Malware payload", "value": "9481900b160a4a9cd3eb7a6e6b49b7573c05645038f2f6e4059aea125e49362ed0c4dbd65c2e13ecc664794fcfd3f96a", "object_relation": "sha3-384", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950520, "uuid": "41817aeb-31c8-42b9-a752-75d1ee0a23c0", "value": "T1A846D017FCE208B6C0AAA23149726192BB71BC492F3163D72A50B7783FB37D09A75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950520, "uuid": "1613b91d-66e2-4614-92ad-d25d47dffb53", "value": "72d8fd7d53a64b79a1028f9534045520", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950520, "uuid": "fd7ae47a-becd-4a16-b564-25cbde77913c", "value": "98304:QeuOiJsjXi9S9sZQlqzsVwcwjZ60vMO/ECr3lf6Zl8jPJM7:Qeti9msZmPe60UOM+1f6ZlyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781950520, "uuid": "7e838865-64e0-4dde-bfac-1edcffb94f8f", "value": 5621232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781950520, "uuid": "bc9c26ef-7068-40f7-bb9a-ca8e2a178950", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950520, "uuid": "0653fd39-79fb-4de1-9882-05c1deeb7853", "value": "gup_util.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2db0abd-6ca6-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781959972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959972, "uuid": "c699df2d-f255-4897-9891-412bc1abf1b2", "comment": "Malware payload (Gafgyt)", "value": "0fc19cbfa36e288480f16a1abb577d06", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959972, "uuid": "6df96051-12db-4bdd-97d1-56746a81783a", "comment": "Malware payload (Gafgyt)", "value": "5739b534112d327669d19a06fa1ea6fba6bf5510f283dfd2ac561f4edf6b9863", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959972, "uuid": "d1bbdb28-2424-4ba3-a30c-378b9199b598", "comment": "Malware payload (Gafgyt)", "value": "df7cf8b164f86f282c747bacec847df42937da3a", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959972, "uuid": "8192b6d6-1184-42f7-bade-ff49f6a2e2ef", "comment": "Malware payload (Gafgyt)", "value": "4af4ff74be265d749791f14ac91537a8fb4d392b3664c34b220da590266dc28cd25b757e87759dc282907da10e093fb2", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959972, "uuid": "d8654153-ccf5-4929-b280-2022a6c4d169", "value": "T16BD33B05D8509727C6E227BAF79E428D73335B68A7D733115A28AFB42FC1B9D1E39021", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959972, "uuid": "d9da1262-41da-4431-89af-84e7765bd151", "value": "3072:4pfNtKdcp3eQwP+HxP9xaefXW8QupNuXPFuw45hLlFOo6E6ErmyhQCYMhEFg:MHxP9xaefXW8Q3ur5hLlFOomyhQCYMhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781959972, "uuid": "b54d5bf8-8dcb-44ec-8093-3e4af781d791", "value": 142847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781959972, "uuid": "f1e44cf9-4584-4f90-be66-9a08a575c49b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959972, "uuid": "45664892-99fe-453b-9c94-b1c8ccfa4cf0", "value": "assailant.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f09e7f-6c6d-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781935368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935368, "uuid": "6cc2026b-8d3a-4fcf-afb4-6040e1496879", "comment": "Malware payload (CoinMiner)", "value": "aac094cf28c8a025bc8085922df80f01", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935368, "uuid": "40a5968c-fd93-4aec-80a5-7e0b118a93f9", "comment": "Malware payload (CoinMiner)", "value": "57df2674f16175374bfba7367040ed79889fed9d71b06a96d34181e112f15e22", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935368, "uuid": "697cd10f-bb0f-49ad-9744-467038c53009", "comment": "Malware payload (CoinMiner)", "value": "0ef7496d181c9ba4bc1dbba8fa9b39367a142d9f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935368, "uuid": "df125108-14b2-44e5-847b-3d8e9aab25e7", "comment": "Malware payload (CoinMiner)", "value": "de3867ad3f848f8abc4267ec0054415fe4b2b441ac37abf5458827ed74804c1a7c7b8f412a1ca2af31673bedb9c9ec9d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935368, "uuid": "b8e16f05-8c49-41d0-a252-12f7beee86e9", "value": "T15C74184A77618FE4E378C13006F74BA6AAFE216656E254C5D33CEE107A9034CA85FF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935368, "uuid": "ee0aa05c-317d-4c72-b611-d4f8dd4798d0", "value": "6144:tbSgaZBliud+wwZV/bO9hgzwp0Ac6eM7VcpGOIQFvy1mMZyBln:tbSh+wT+NbUJZ4p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781935368, "uuid": "025db743-29a0-4a4b-a65e-07ca409543fc", "value": 349864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781935368, "uuid": "fce6ca64-d1d0-4ce7-9b2f-b652d14d83ac", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935368, "uuid": "82403316-dd5f-4086-aad7-9768e169349a", "value": "kworkerd-netns-rt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf7f1450-6ce6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781987373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781987373, "uuid": "c85bd6e4-080e-47be-baf8-9b53ff7bbba3", "comment": "Malware payload", "value": "2844ddb0b662811e1e3f0b7f41f86d00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781987373, "uuid": "0df37f11-fcea-405e-883f-5e114cd46dff", "comment": "Malware payload", "value": "585b523ab776fe15acd2f5ad75c58dfec436a4311c7bbc96758c7968ccb9ace3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781987373, "uuid": "c9babf2f-bb04-43d8-89c2-644b53f06756", "comment": "Malware payload", "value": "eac71328c90c3c9d0eecd2fcd0b840d531283d53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781987373, "uuid": "77d3df66-8f37-45f2-8210-3374b9a6eb66", "comment": "Malware payload", "value": "703fc1897f9b9995ad6a40279a560a54a50dbc97ff1148eba6d53cd22afc89cfb40d0e8c70150d0527f8ab89560225bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781987373, "uuid": "0c1c6b80-73a6-4df3-a0b0-db4fdc5acdb0", "value": "T157A3122181B8FE50D4FCAE7755CAD0C71F1FC3A0242A37721589AEF3694029A23DD9DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781987373, "uuid": "6fa9cd6a-09f8-4fe6-92c9-dd50f1220d1b", "value": "3072:kioGWpBo3D4Guv2xqPYt+qhSZNUcbLGFBzfB:1s84GuvOqPwha/bLGnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781987373, "uuid": "ded54549-fc88-4bf9-8498-db36ae10ffcc", "value": 104988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781987373, "uuid": "01d74492-dc1e-4d85-841a-2a690caeaa43", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781987373, "uuid": "5cea00ad-43e6-43a1-b59c-9b3a8e9d8c04", "value": "kworkerd-blkcg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43110dbe-6cab-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781961824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961824, "uuid": "0628aa64-5b40-4ce2-a097-e3429847cd22", "comment": "Malware payload (CoinMiner)", "value": "3b118bb05c12ba6f65e001a95d723bac", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961824, "uuid": "94f66b5c-aa6f-46f9-b9f3-74da9aa954e8", "comment": "Malware payload (CoinMiner)", "value": "59c31b45f7e3a04bfc35651d087d063e95f7e31d1246018eed1150a177410125", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961824, "uuid": "ba3edb6c-efc7-41bf-b421-655ca2b6088c", "comment": "Malware payload (CoinMiner)", "value": "d98b8274ad5c0dd6cf544bcda38774a93d50027b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961824, "uuid": "daff538c-e879-4034-9745-c6c594afd9c0", "comment": "Malware payload (CoinMiner)", "value": "45aa6801c01f26908777f22ff93764d42b88774a5460aa67536f3a443da40e0b57401ddcfa9ae5c78291bd4e31cd2f8f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961824, "uuid": "3e6cd221-6178-4fd1-bc9a-699540590862", "value": "T1A5F533C148C110F9D2B6D430CABA5B26F3B5912ADB221ED304B1F5505B7ABD26A36DF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961824, "uuid": "138e539d-ccb0-4e0e-a522-040c67d521f6", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961824, "uuid": "444cee76-e8db-4881-9483-1dd9bf3fad33", "value": "98304:rXE0pDAd+Qoz92xB3JCG44lqZOaStADf:rXHpEQzwxBZJ44IZjSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781961824, "uuid": "c23ba527-7df7-449d-97b3-664cb303bcb2", "value": 3446760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781961824, "uuid": "deac9050-6d2e-4edb-82db-9ce7ae43b2fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961824, "uuid": "c5b0e22d-6492-4fc7-92b8-f0500d149148", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77cce40-6c90-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1781950477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950477, "uuid": "d68047b6-59c9-46fe-b0f4-5ec2ff8a8e92", "comment": "Malware payload (Prometei)", "value": "4ed33408ae31d54a51688ac9bd0a6dd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950477, "uuid": "daf98300-8214-4949-91fa-9df895311d80", "comment": "Malware payload (Prometei)", "value": "59da23a07af0e6e870f5502fd621ab10bf2a2ffd7a8829a3ac042433ac2e32c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950477, "uuid": "553da796-7cf2-40b1-bc36-9c9a6ee931c4", "comment": "Malware payload (Prometei)", "value": "fe1afc025970f4eeca8afb8379c992d044175f3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950477, "uuid": "2bd811b4-8e77-4808-933c-c6b25e273dc7", "comment": "Malware payload (Prometei)", "value": "13f8705f3d48992662dc1248839562fbd1dd93de751d4355c359e074a5699410bbf63be5839fb050cbdab6aabdf33ee8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950477, "uuid": "67134114-cdf4-4e1e-95ef-90adbc77e84d", "value": "T130A423B4F9219E8F6DD769B91B24C31DE182D172589D4C2313AE94A34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950477, "uuid": "03f361d7-4a81-498a-98b9-c9673534dc54", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsds:Fs6pyCC/Ya2hpi6T6N4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781950477, "uuid": "db9ce066-859b-40a9-b1ce-aee49d3f599b", "value": 449084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781950477, "uuid": "f43c657c-b453-40af-940a-2c18ef5942f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950477, "uuid": "44ce4cb1-4ab8-4ce6-9fa8-7d6b6c450e9b", "value": "59da23a07af0e6e870f5502fd621ab10bf2a2ffd7a8829a3ac042433ac2e32c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7efd14f-6ca8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781960732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960732, "uuid": "4a5a1937-0ad9-4b5e-a97f-c2503300245c", "comment": "Malware payload", "value": "970ca4bcd94d691dd586e6f7031a9bd6", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960732, "uuid": "cc468922-cf05-4088-a7ac-3356b7475cb3", "comment": "Malware payload", "value": "5ba5dbab575a73dde2dfb27e53f91512e7242e1de95aeaba69fe20f68d325421", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960732, "uuid": "235458c8-add5-4de2-9f8b-cd618a951477", "comment": "Malware payload", "value": "27b9ab6e1c419ad456f9ca6e2b397ed4a9dc91a2", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960732, "uuid": "eabd253e-e6ce-4744-a37d-261c4379fb98", "comment": "Malware payload", "value": "f8099b4e4ab66e76f9a35dd588d6cde0108e989b71efa67ab0b6af87ef5c9f845f3fae912d9ae1575ed247a737bd3352", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960732, "uuid": "56d075d6-df57-4e59-bee5-f3dffcfd0488", "value": "T141955C00EFD768BAE502173268FB539B2338D8090F369BC7EA547638B9776D11836716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960732, "uuid": "54f80ebc-5218-4197-8fc9-ed1b39abd5b7", "value": "e8c28134163fa189336ed64a759c7015", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960732, "uuid": "26dfbf02-c325-4ef6-8e76-a0364209bf39", "value": "24576:LhIYXDDJ1OCV+g/LKNzQ4NBa0LDPTeCAVrH3XPqioPt1zxVqrnLJM92RY2L1Heh5:Li4RjRCBacaJM9MYg8sbsuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781960732, "uuid": "40215e1c-627f-4d45-9b8c-3b5c5e01b8f0", "value": 1876256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781960732, "uuid": "31bcd542-55a6-48ad-8901-5926d9386408", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960732, "uuid": "fd1c8d19-359e-4d46-92c5-1b8a69e46e15", "value": "Kshwxb.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4567f148-6ce9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781988457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988457, "uuid": "e6220feb-48df-4a1c-a843-2f5395888459", "comment": "Malware payload", "value": "4edf3bb35c31da2d595497d0bca39eeb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988457, "uuid": "f0d84336-e3d3-427c-a856-485c6ab561c1", "comment": "Malware payload", "value": "5c2d1ffb8d00e3e93d60dc3294b08ce9afa08962d2658a67694b8f9c477e87d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988457, "uuid": "69179b2e-6c72-42e0-99dc-e292dd6f0455", "comment": "Malware payload", "value": "ef9bb84bf5dd3942b480068f65d6fc8024a12e9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988457, "uuid": "5d052408-6da2-47d9-b00b-76e6881575b3", "comment": "Malware payload", "value": "a8e3a7447614968cce9554e3cc050ba6946d2aec07747fbcfaa1024bf8916cf7b2f314b4d6c960af2eea1f082dc6332e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988457, "uuid": "99d89389-d096-4220-b1ca-4552ab10a560", "value": "T19CA3122181A8FE50D4FCAE7755CAD0C71F1FC3A0242A36721589AEF3694029B23DD9DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988457, "uuid": "9b85172f-f4da-4938-a09a-c7eb603f1aea", "value": "3072:kioGWpBo3D4Guv2xqPYt+qhSZNUcbLGFBzfX:1s84GuvOqPwha/bLGnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781988457, "uuid": "c946c44a-c5bb-41af-8211-985f6e9d7c26", "value": 104988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781988457, "uuid": "cbc8e56d-0f51-405b-86cf-f6d4af438b1d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988457, "uuid": "dee9cbf6-e802-404d-bd0b-b9a029a1872e", "value": "kworkerd-softirq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "933bd8c0-6c3f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781915573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915573, "uuid": "7725016c-5529-4646-83f5-1043e2bcdb5f", "comment": "Malware payload (Mirai)", "value": "d01fbb6ad4c6e9e1053ccab3953953fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915573, "uuid": "8d3ebbc6-cff8-456a-b0b4-3d4bcb2fc21e", "comment": "Malware payload (Mirai)", "value": "5c4d295c6d573567390f572c0a9254c2624a8b035f4a4794920cfe83a305e585", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915573, "uuid": "f59ccf82-a0a8-4479-b81b-f12fd6e8aa5b", "comment": "Malware payload (Mirai)", "value": "8500675f5e47aa4f16391b451b667b94abf3c7a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915573, "uuid": "2ee78cef-1d26-4cc6-a74c-0614e48f6c3c", "comment": "Malware payload (Mirai)", "value": "3112478b2a431893fa84c6568fe939d7f00ade88ce38dc4a8966f2bffc2aa0e6bf155b83017d896779194df68e506ab0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915573, "uuid": "2afa1b29-1420-42b8-88a9-170e16cd85ca", "value": "T147149E23E8746DE9C26499B4B0F1DFB82B13651042472EBE7696C67140C7E88FA0D3F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915573, "uuid": "fc3471f7-a726-4498-ab8a-2ded54fb2deb", "value": "3072:UQAq7tD0b4oan/mGiskRYI+Xsic+wzx4Wte/DDPEEQMz:OeVo4/mEuYI+8Jdht6DPE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781915573, "uuid": "bbb4e69d-cc70-4b0a-be23-ce553e129a89", "value": 195908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781915573, "uuid": "4dd94990-4417-4631-9482-0bc48cb9fe8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915573, "uuid": "49707ddf-f6d8-4588-8607-4c106d35ed06", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7dd4447-6ce4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781986582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986582, "uuid": "6ea38fbe-d2d6-41c2-a6c0-ca0f5aa0b01d", "comment": "Malware payload", "value": "110828e98e76a39270bd967795901e4b", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986582, "uuid": "d5f32b32-0bd8-49d0-97a5-ce2b305af639", "comment": "Malware payload", "value": "5cf721b03d29a2e45a8d9a917d86e89dc8ecd6000fd6d3a0398949421d20618a", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986582, "uuid": "5f1440cc-05e8-4bfb-8e35-8808510f5412", "comment": "Malware payload", "value": "60b16474942b2eaf9adbd433e5fa01f2461cec12", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986582, "uuid": "3f8628ac-1fb5-4941-ac4a-0121d6c3b614", "comment": "Malware payload", "value": "49503f9dd98b0ab0386540392f0bcce3a75a0d3d3e01a0ca87c623c2a7a4fe7dd5b312625e510bfb62d384364a478bde", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986582, "uuid": "27c9b14a-21ce-496c-9921-c218b8acde01", "value": "T1147533BF73478D938F7209FD1ADE75615A1B940F35F6E99344ADF24C08632029AA07CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986582, "uuid": "79dc8e84-7c15-44b9-a6fc-bbd21e90f70b", "value": "49152:kRcQHufzqak1OFrswhfEz3ruyIU2xK7uc374pkLc96:k2cchnBXEHLni6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781986582, "uuid": "6d779496-9403-4d06-a958-68f9c7651cac", "value": 1676724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781986582, "uuid": "5ed044ea-7d14-4c70-a982-843016ba16c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986582, "uuid": "3ed0c0db-715e-4a72-82c7-fc94a9407447", "value": "devfreq_wq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f83d58e1-6cac-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781962558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962558, "uuid": "803348a4-721f-457c-8d5e-f0f2127dee87", "comment": "Malware payload (ConnectWise)", "value": "69952dfc4e13803c1ded01e97e859178", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962558, "uuid": "70084793-f605-416a-9dce-0d0b9d15d504", "comment": "Malware payload (ConnectWise)", "value": "5d08aed3131bd6ea086a72aca7084f54ad16cc23f05ed8eded1006cece746270", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962558, "uuid": "10971a1b-e934-43a7-9887-b82ab0b98779", "comment": "Malware payload (ConnectWise)", "value": "064df4beb9b4ca437a317b6744dc89f985aa37ed", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962558, "uuid": "926dcc5d-f2b3-482d-8c16-e6ef789d5d40", "comment": "Malware payload (ConnectWise)", "value": "64b305477f62ce19e0ef59b19cc6f2f7684b9f8270deee2d4c3a2d270893e6ac1b3f2e92c018a74b65315ac791077919", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781962558, "uuid": "ae3a473d-dfc9-4d39-91cf-e63bac2cf246", "value": "T1B546E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781962558, "uuid": "5b297a3e-f824-473d-b148-fc61ea84dec2", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781962558, "uuid": "dc843dbc-edfb-489c-ba84-110285935156", "value": "98304:vzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:vhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781962558, "uuid": "de5658c2-1863-415d-93b5-f4f1f7789fb0", "value": 5653184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781962558, "uuid": "e54c894d-b200-44b2-a525-6c008b0cc8af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781962558, "uuid": "9c9eed25-b904-4b6d-9a41-d51c460003ca", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03dfbd2-6ca6-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781959967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959967, "uuid": "ed0a48ef-5bf9-4c1e-b7c8-79066eafd00f", "comment": "Malware payload (Gafgyt)", "value": "2d27418d91f4e97ec9bfb3d40c9da7da", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959967, "uuid": "1cd5318b-66a4-451c-ba26-b99c0ea22435", "comment": "Malware payload (Gafgyt)", "value": "5d717c24c31209776b61d296d3ccfd109a2c57feddb1a37206bdfc7ab5dde6e7", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959967, "uuid": "ef4c0ecf-81a6-4c41-8ff2-24b8e0f4b9b8", "comment": "Malware payload (Gafgyt)", "value": "a479f10a3cd5af24f8370a4087439d6a09af9fe1", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959967, "uuid": "c04b2b4d-8c98-40cd-9981-95af592d4ce4", "comment": "Malware payload (Gafgyt)", "value": "cd26a5c8ba5433000eb6f3e9b72e17b25d9b9f9d6c86072937cf6653038a4ab33a8020f131b3ffd6e7766f34e9b6f70a", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959967, "uuid": "fb992442-223a-48a4-92d3-7132d3a478fd", "value": "T1E4C3F705FC404B27C7D23BBAF79E438D773666586BD733119A296EB02FC1B982939160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959967, "uuid": "6b364b66-52ae-4a30-9392-d0f55d42b868", "value": "3072:XFDcpqlgQSnoHy2K7/R/2OR7nbo5hL+Xva23TG80ojUQQRh6RYAvZR:iR/2Qnbo5hL+XvdYojUQQRh6RYAvZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781959967, "uuid": "c16255af-f102-46de-ba00-f644d19cf8da", "value": 128413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781959967, "uuid": "3ca5f9bb-89f4-4b42-b716-3c00ac52ba2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959967, "uuid": "20ae3378-5238-43a1-b568-cc33aace653a", "value": "assailant.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a85a84e-6cda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781981916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981916, "uuid": "3350833a-9589-4bd2-a22a-9b3facb2149a", "comment": "Malware payload (Mirai)", "value": "652d18f5c359937c016296f5cf56cd3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981916, "uuid": "b09ddafd-35ec-4da9-b1dc-81cc4ebef856", "comment": "Malware payload (Mirai)", "value": "5fa6ba4ecde99d59b3e5f6f4ef495925f88123a24bd7a0e2a3373801c0cc0b83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981916, "uuid": "46fc588e-aad7-41b1-8a16-0e3826bbbf06", "comment": "Malware payload (Mirai)", "value": "61df793cb1e2aa0162bfeb884db6a33ed854be09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981916, "uuid": "da54f001-597a-4555-a20e-59a3b4117f6c", "comment": "Malware payload (Mirai)", "value": "0840bdbae18e66de09f58491e16519b14f9ece802a73f905496927fedcb9e7aaadaf8d4d5f1a151d63a0cfb3b41e78ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981916, "uuid": "01329485-775f-4c09-a1a7-ca72ac9d8352", "value": "T120142B45B643CEF3E41304F011B7973E0B30ED364836D595EBA8AEB5DA27AC166163AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981916, "uuid": "58b5b7f1-c2fc-4f44-bdee-7aca83924b80", "value": "3072:7VQvbpvW59+CyOmZRcGF5hwRj0aKKFk9dl1xlpDi1:7mVOb+C4RTUx0D1hDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781981916, "uuid": "730cf9b5-0b5e-436e-9a48-f3b44d4dc5e6", "value": 192996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781981916, "uuid": "dda4e098-3505-41df-acea-f16cc6e85d75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981916, "uuid": "24df5651-6b2e-4d22-b078-6d72085021ca", "value": "bin.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea155093-6ce4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781986586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986586, "uuid": "d6a43512-a78b-4c29-854b-bda5da7c9aec", "comment": "Malware payload", "value": "fa57bd988a40a6183b998d8dc59df81c", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986586, "uuid": "b1d40231-3967-49b8-860b-3eefe224529c", "comment": "Malware payload", "value": "602fd1e0a2ff3d5a0ce13f4301e93894c8f30ceeac4f344d371f1641baf08265", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986586, "uuid": "6cc23564-81f3-4ca6-97e4-b7faa341c639", "comment": "Malware payload", "value": "0ffa78ed21975eaaf45582506245ac3676a4e761", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986586, "uuid": "771f7794-e71c-44fa-9991-44496bf153c9", "comment": "Malware payload", "value": "3f536564861453f37a069de2418483063665ac37f54b7c8b374cdf84875b448ed402b382ee99455bb50edd5593f54b96", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986586, "uuid": "3d9a61db-80d7-4fa3-89af-847b17504cc5", "value": "T12A75335E1EF6AA2BC79ECDE1E0212B488AAC7D77C95DBC05C075619385ED68E0F40BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986586, "uuid": "523da66d-9ef4-4eeb-a561-4922fae080a9", "value": "49152:4hlZLt/OIkRt+VQa5cJeuFttbFt3g74GFMkPK4:YBKRtB1Jbb58XFMWK4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781986586, "uuid": "5c7f7dce-d22e-4693-8e61-5a5b2539a3a8", "value": 1689648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781986586, "uuid": "55cbeb75-2bcb-4a2f-87f8-00006ff4d0a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986586, "uuid": "6b4c6ff6-1799-407a-8eec-1117fa99d7cb", "value": "kswapd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae48842f-6c5a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781927215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927215, "uuid": "583ef5d2-fdf8-4e0c-b5ee-ad3fda0fc557", "comment": "Malware payload (Mirai)", "value": "94f63803e90efdac1dd00ebea1394d68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927215, "uuid": "4699968d-a32b-4f81-8e7c-d0d2c471e30a", "comment": "Malware payload (Mirai)", "value": "603afabe0bd67f9c66c1680b0e8c1c2d2b319053aeaf41a8b2380530ebf3719c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927215, "uuid": "bfa4c65c-b7cb-4922-bbc7-4d4948a7de7d", "comment": "Malware payload (Mirai)", "value": "1b2d8b8a14197c288d74b4df032e53d8278a2987", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927215, "uuid": "a6ae0d0d-c153-47e7-9285-146a4933a46d", "comment": "Malware payload (Mirai)", "value": "86026962a2e4b593657e77aa3fe1e87ec9be91ac2297026505e7a2748a2cfa9e448cef85181d0e9dbf5d548dd63bf56e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781927215, "uuid": "cdf159c2-a965-422d-82a9-c18efed73428", "value": "T141A302DB58C9EB92CF6955B9F131C991791D8F3820EDAA9200CD480F26F43839199BDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781927215, "uuid": "2865bd6e-f503-4657-bdd4-daef550bda85", "value": "1536:dbYu2nL9yZ4CBDhH8Vx6mPkP9Ol1AmPogY/aWkC94AdLDZfjBUP9adYCTdR4z:dbi64qFH8FK9CJYiYdLDZfjB5X4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781927215, "uuid": "36c2401c-660c-43c0-b88c-6aac2c42ca5a", "value": 105952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781927215, "uuid": "a8ef6d69-f92e-4c00-8aa5-55484450d3b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781927215, "uuid": "bec0d031-6998-4784-9825-a1c64190bce5", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d9e394-6c3f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781915579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915579, "uuid": "e166d69e-ca8b-4d5c-bee9-30190455e26f", "comment": "Malware payload (Mirai)", "value": "c8fdeb1ea2fc53e971b74c6cfac257a5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915579, "uuid": "3fca5b88-14e4-477f-9af2-297fc673f5b5", "comment": "Malware payload (Mirai)", "value": "61d4e9e27da5fe693bcf5d3e50cb2d1bb8d9d363ba2a1e99b30a9479d1d55ef8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915579, "uuid": "3b787fcb-c6cb-4fba-8800-bcb918299300", "comment": "Malware payload (Mirai)", "value": "42ce54010518eea16bcb34994c61134f07ffa4af", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915579, "uuid": "75989c8b-86ec-4834-82fa-6a330a798c62", "comment": "Malware payload (Mirai)", "value": "5db620ae972e11324dcca24393f566e060a98fe4192d6c9b4c8bfe36fd3cb3398c73c61acdbb3d00e6c5d31c932c2180", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915579, "uuid": "4ebccf3a-6520-4c45-ad1f-88a711fe8c4a", "value": "T12841BACA71720474AE5A566B32BA0B4874C6A58614C4AFCEECFD78FE01EDE0464117AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915579, "uuid": "156da851-304f-46af-99f7-2d0ce3125cae", "value": "12:z0Fz07O0F1jbO0F8lO0F+gO0FwO0FggO0FeO0FDO0FVCO0FILdO0FYcNMJcO0FIG:wmhf8p+iSxwnVU6BpJqe3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781915579, "uuid": "5c99e1a8-2e12-4c3f-9909-0ac97a081f1f", "value": 1974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781915579, "uuid": "db897220-0841-43c9-9c9e-fc8b5f379030", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915579, "uuid": "0e83de92-9b64-4045-9b0a-7a502868c086", "value": "ic3atyourdoorstep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df7581d9-6cee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781990863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781990863, "uuid": "5d137dc4-d94b-4584-b19c-a0679243ef84", "comment": "Malware payload", "value": "01942cdc6b2032dbe91a5fda4072d575", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781990863, "uuid": "579bc605-ed20-4506-bba4-e519537db894", "comment": "Malware payload", "value": "61dda033ee6a52ace288049c4d5be53959a5dcd0467dcd4286f3c8203ff984a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781990863, "uuid": "e7f26f8b-802f-4b71-aa0e-572bb022e5f9", "comment": "Malware payload", "value": "ecc766f5c9a1c5f9f781fd1955b58e012a3129de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781990863, "uuid": "b389240d-b88d-4afb-86ad-f53816fe5a0c", "comment": "Malware payload", "value": "05e5fc529f4b4a5c4eef67d08e43cb89bce16d237ae1cace1147db1d9a12e83ca26a4c0e2069312c07a9dd56c40764a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781990863, "uuid": "6ae87f36-a1bb-4b68-8f57-d7fa959a32da", "value": "T1BCA3123253222C21C124247E4D8916E5872C7B6A7CEB3A830796591AC7E71CF29FFE5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781990863, "uuid": "bbc4beb9-7c8c-4629-a55f-0745b1596ffe", "value": "3072:8cujVe+UpCQQ9toPuFvZGdIzFLXYTAkan+TnTl:8Ve+UpCQQWumMFLXmAkanYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781990863, "uuid": "dcdc0cb5-554d-495c-b5da-b29ef0dfc98c", "value": 106952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781990863, "uuid": "71a8b664-370e-4143-af9f-871d709f6567", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781990863, "uuid": "6e891bec-8545-4a29-a1e2-b52a5f6d99d4", "value": "kworkerd-irq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf4cd7e-6ce8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781988335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988335, "uuid": "87d3f60e-2cda-4bbe-9fc7-e98423f3a111", "comment": "Malware payload (Mirai)", "value": "d3aa4b6c3048d319d7bd246d186b277a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988335, "uuid": "cb77868d-730d-4739-8c98-7ab46fdf9a31", "comment": "Malware payload (Mirai)", "value": "637cc40d3f134ef600020e513709b4389fe3c169206dcbbe34171b51528a0024", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988335, "uuid": "acdf3d0f-4c7b-4276-8008-28fa456ee321", "comment": "Malware payload (Mirai)", "value": "17e14e102565bbfe62f5eaf7297c491c5a26c97b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988335, "uuid": "577424d8-7e24-4ec8-a5f3-5dad8bcaa306", "comment": "Malware payload (Mirai)", "value": "0de50ef7c274c9dd5db910610023bd7614e5594af95bb76665ebc1ca724a4ca1bddcf8fe85711a58d5a424032b5d9e33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988335, "uuid": "b175c1ff-d8b6-4b9d-8ecb-b032b191f11a", "value": "T1B8E2F1A4F14D4202C097907D3EB93F872861636DF248C1DB8AE474A6785DBF02BDD55A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988335, "uuid": "9d387003-6a5e-4fb2-8efb-26df28662aa5", "value": "768:wdaQJCBHEwTpA1kmtD3gTbjVcK5StFnbcuyD7UpUcs:urmEwTpAymtD3gT/Wnouy82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781988335, "uuid": "7482033c-fc3d-47c2-8f4c-22cfb8c28c22", "value": 32760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781988335, "uuid": "c11cc42a-dd56-45a2-a4fb-4d481c5b61f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988335, "uuid": "a227be02-6aba-40ef-bb84-47bac137a439", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec91a760-6ce4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781986590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986590, "uuid": "a21c9daa-296e-4478-b61c-266b36bdd541", "comment": "Malware payload", "value": "63e635830daf068b0b34643868c73d70", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986590, "uuid": "5835736e-ff34-4467-ab46-25ad1bef4de8", "comment": "Malware payload", "value": "64e27acb5c452aed9f67c35e59bf503835d0f7197b70fdd56c4773751380275f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986590, "uuid": "fdf26f9a-5625-46a0-b83c-817fb56a7fa4", "comment": "Malware payload", "value": "dd41562cc9e1ea4861aa871b239ad638fae31e10", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986590, "uuid": "0040fafa-352c-4325-ab01-a60bb512b5c3", "comment": "Malware payload", "value": "c073f6467debe5a3901a8a9a0ec015f80869ec5bbd3257b0eb1954aff1cb57564f9e14edf436dc5f9853bcc4ee89b219", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986590, "uuid": "8372a83b-8453-47d3-9a65-9b29710a0a5e", "value": "T16C66F855BDC22B66C1DC03B444FE626662643E454BA5072323E4F7E83A7773CAF5A88C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986590, "uuid": "586f4ed1-b219-4bd1-a359-299b838fa755", "value": "49152:zK6sjnZaQPYleWjEeyy1PKmrZZiucOYS4+LbJJg5Ej:ztSZa5ecyyde0yEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781986590, "uuid": "755a532b-0380-4574-8bc8-16846517ee00", "value": 6815892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781986590, "uuid": "1cdc3c72-6aae-4af2-99d1-a692895749f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986590, "uuid": "e497f489-e48c-499a-9743-cff621eb450b", "value": "scsi_tmf_0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3179a4d-6ce9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781988641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988641, "uuid": "5e9d4e40-6de6-42d9-9e85-4057f7c875f6", "comment": "Malware payload", "value": "be7261f4b8536d8a4d7ca92eb249c60e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988641, "uuid": "6946340e-6485-427e-a035-b1e4e4df0c72", "comment": "Malware payload", "value": "666abe7af5c43351abba61abe9eda5f99f6b84d7702ee36faefc345eddc54384", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988641, "uuid": "0be55c04-9cc6-4713-ab50-ffe3cb3fb2dd", "comment": "Malware payload", "value": "0d3a8d7531556a56b1b3f2367a3fc24acdbb1485", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988641, "uuid": "e3e2170b-3183-41b2-823b-94f90c43047e", "comment": "Malware payload", "value": "cc067d24dd12292516bbd199d8771ef89825876f672127d9a554fe70a4a5890b958fab53bf589a440f7815a7241d190a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988641, "uuid": "3e09732a-e3f9-4b38-9b1d-35e359704552", "value": "T12AD0C2A4736380DF042AEF58E441689110AB72C822B2D6BDB8165B6E9878D063DA495A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988641, "uuid": "c7e51f47-7bd8-4c88-8e73-dcb5ed2ab1d1", "value": "3:GRFoLSDFSOdVMsMXuxAjoLSiOOdVv6axAjoLSfIOOdVYgxLoaxAjoLS6fDOdVVEL:SoLW6luSoLxB6aSoLKI+gNoaSoLfmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781988641, "uuid": "c0d772fa-474a-42d0-8b9c-267bff0d9375", "value": 223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781988641, "uuid": "8aff0024-5708-4dee-b96d-e4af7ad4d9ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988641, "uuid": "9604a345-b887-48a5-aff4-6c9390b9b48e", "value": "a.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8e4590-6cb1-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1781964388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781964388, "uuid": "9f18c066-447e-42ff-95ab-5b365c2347f4", "comment": "Malware payload (SalatStealer)", "value": "e716660c19bd9ca857be57cc3926d60a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TrojanPSW", "colour": "#EF9990", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781964388, "uuid": "489f2991-4d54-42de-ac39-4ead98c0310f", "comment": "Malware payload (SalatStealer)", "value": "6696a32df2f9598926cda34e6a239e24c66e417fe40617ad5853b2cb339481a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TrojanPSW", "colour": "#EF9990", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781964388, "uuid": "3b14ce1d-cea2-4f77-ae03-f944477ec8d2", "comment": "Malware payload (SalatStealer)", "value": "b0e87085fc953ca47d20dd900eaf1765d00ff74f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TrojanPSW", "colour": "#EF9990", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781964388, "uuid": "34cb2b0a-a394-42af-ab36-04d105397bf1", "comment": "Malware payload (SalatStealer)", "value": "cff336b651e103e02776ec85030aa38be069276e69c4194f9808e5e79d6eff8a9b7e464bdbc9ed7656a1e7fc06c4cdf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TrojanPSW", "colour": "#EF9990", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781964388, "uuid": "d0050c51-d290-4bb1-bc31-33d071a6fa60", "value": "T15136C0033BFEB05EEA6B97B4956463518625FC774D91808A35CC148B0F9B9407EBC2FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781964388, "uuid": "0b2ecca9-53bc-4930-9131-88ae25007f75", "value": "8ac2f8427cdb1e58798646eed4dba2b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781964388, "uuid": "a93df500-bfd7-4635-a200-e61b276abc21", "value": "98304:Dic8Sfwua0cZSAlMdigXSMd14v3Rk2syeqS8:WDSwl09A2digiy4pkjl8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781964388, "uuid": "68d770f2-abfe-499c-ac85-8b790dfeadec", "value": 5180232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781964388, "uuid": "30783df5-3f53-4887-895a-97fd5539cbc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781964388, "uuid": "4f61d86b-3322-48f2-9a89-d2956ac03d49", "value": "MTProtoTelegram.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5410f7c6-6c5f-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1781929211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781929211, "uuid": "d0ab6d67-6c4c-4f0a-a8f8-e3a18026c86e", "comment": "Malware payload (ValleyRAT)", "value": "aea4129a13864b196b8bf17ce9190884", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781929211, "uuid": "91793cda-2244-4d36-8246-1e6928e82a57", "comment": "Malware payload (ValleyRAT)", "value": "66c2a3817bf0639b0e39dbe75f906e5f9a571a4d63e454c6bd6cbf11243e5bcb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781929211, "uuid": "1043a32a-2c88-4a31-9237-a08a15313b30", "comment": "Malware payload (ValleyRAT)", "value": "be03579cd9196ab5cadb04e28b35ff431444a9f7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781929211, "uuid": "65b2454a-375f-4c20-acba-47caf0738710", "comment": "Malware payload (ValleyRAT)", "value": "79f3fa9d9279b07264cd1d0cba6a53f5c6fef40f830bb6ec24512cb5955e225623edf42770d8a447056f0335b8566d47", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781929211, "uuid": "4885a5ef-832d-46ab-aff5-2105140ab18a", "value": "T183348C217650C432E9DB0534C5BB8B760AADB8320755D4CFA7E44A7E1E723D2EA3538B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781929211, "uuid": "a187f0e9-294d-4845-bcf1-f07992dda1a0", "value": "f0e23b81c79b122387dbb66564f1f15f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781929211, "uuid": "6f9f8c54-8f74-4a2f-b853-745266cabe6f", "value": "6144:On8K25SLDS5iAbT7uw3YjXdUdnpTxBYtwcuSpzxABRM:GR25D5iuuw3eUdnpTxBYacuSpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781929211, "uuid": "5b611fb6-7f3b-4156-87c5-7970b573cf7a", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781929211, "uuid": "b724c968-ac68-4139-886e-e1cd5f5631b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781929211, "uuid": "f996936e-84e0-42a5-80ae-47c7d21eaf47", "value": "AEA4129A13864B196B8BF17CE9190884.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae450c6-6ce1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781985298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781985298, "uuid": "b7896a0d-e2bf-4be8-9308-01556d93f7f8", "comment": "Malware payload", "value": "ac8c364e24688a56497b491c4d7a1f95", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781985298, "uuid": "5b6f77c4-285f-4637-bda8-72c67b707a06", "comment": "Malware payload", "value": "673337ea6fb0eba12c2e7abe1447878e7f9ee63dad296aa8ed47578bb0c1f039", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781985298, "uuid": "9bcf0871-03c4-4e44-aedb-3c3ad6a32132", "comment": "Malware payload", "value": "975a57af4de7634a6fa149b651603865b356e97d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781985298, "uuid": "7d72060d-05ce-4c5c-897f-d8fc21b57a42", "comment": "Malware payload", "value": "6f561f9cf05c699e67f6d27430fc5fe97581b982d5a1aeb501aff7ef3d66091429b324cba71f34324d5abfa99a282fe4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781985298, "uuid": "4c9ce379-664a-4c7d-8fd3-52ed179324da", "value": "T1F5213AC812A067F38BD8D940B96399EDB06D04D77E1798E4A4084AE36E563C6FC1C366", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781985298, "uuid": "50342ed6-ff49-4244-a6d9-92bd164a32d0", "value": "24:VB59HBqg5vFByqBC1IBdBnBdTcqBVBNB4bGBvf3ByClBNBMW3BpuBW:rThzd7jC18DBdo6rTNxyCT3x8g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781985298, "uuid": "c769ca0d-705c-4576-9bfd-b213cafc4b08", "value": 1414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781985298, "uuid": "ad9202cf-2da9-4883-af57-cb6815b58e6a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781985298, "uuid": "7826dbf2-19f8-41d0-ad4a-99d0d25b7c04", "value": "curl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07b2731f-6cda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781981911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981911, "uuid": "7161ca01-667e-43f7-8a46-6052677ce08b", "comment": "Malware payload (Mirai)", "value": "beafca8d80be4cfcb5619613602cb25a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981911, "uuid": "23bf3761-09b1-4896-974b-0ee459393e37", "comment": "Malware payload (Mirai)", "value": "68f4a84b3f0c2ee40a8f90eca1affca204e8c131ef247afee4c68d495102827d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981911, "uuid": "5867fa55-05bc-41e2-a034-8faa1c671822", "comment": "Malware payload (Mirai)", "value": "8a8f1b3904c6a27e84787cf2241294eed8c3513f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981911, "uuid": "c7e8c450-7259-459c-b011-3ee0c7f6a82e", "comment": "Malware payload (Mirai)", "value": "62e3ccf0ce453ca247c7e9b791b31d84d089c6c434801ae28897df66370cbdb0c8bdb54ba12f83525f15dc693df461bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981911, "uuid": "3f2cab14-26f9-4731-a391-2fa2bd8fa9da", "value": "T184045B22DD25AF8AC416A1F0B1F18E789F12BD2548470FF9A5B6EAF44143DC9F1097B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981911, "uuid": "1087791d-c7c3-4e10-8c3a-9f1fb0a4141c", "value": "3072:NHihj46GE7VHjcMLjuvAfztkWzJW7kfco0yjR7nGw:NHihj/GEJHjcMLj314Ifwyj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781981911, "uuid": "eaca8b49-814f-4ece-9896-3e9366d37be9", "value": 189492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781981911, "uuid": "2112da7a-b2f9-4208-9a54-7b3b6287aba1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981911, "uuid": "da71420f-1853-4fa3-b28d-86b1ed8ac0ca", "value": "bin.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c38e6b6f-6cec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781989957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781989957, "uuid": "b25d93b8-5b4f-42bd-a6e6-50ef68da62c9", "comment": "Malware payload", "value": "d99c29abf7f5ccd93fc4d7e3a619c0b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781989957, "uuid": "ff78717d-0618-4aeb-a261-38bddc3e37f1", "comment": "Malware payload", "value": "691c25e6addecd537d5948e809346235694f18621322f847299f464c35613615", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781989957, "uuid": "d2d04ffb-d593-419c-93e8-bc6d3bdc1a40", "comment": "Malware payload", "value": "dd92f51ab921b04ccb829640d3504003cac23560", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781989957, "uuid": "455a4cb7-26b3-4d8b-823a-e0299eb58ddd", "comment": "Malware payload", "value": "3cbb199adaf30009c703b521fa627ce6b0589690f02ec58875ef19f732cc1b45c3f1f70a27f0cb1b9132a91151ed59ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781989957, "uuid": "e6aa1193-e07a-483b-b183-a1c8a06115bb", "value": "T141745B4EDF750FBFC59ECE3012AE022715DE885A92F6673B61BCCD18B25A60446E3C58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781989957, "uuid": "0b511653-12ca-43d4-9b52-eb7be413bc72", "value": "6144:PlSrtfOw+gAapIWJt7ooEuEVxe06w2V08/HWsxbLT42MHyKJ:PlSAj3exzE6f/HWWfT4n7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781989957, "uuid": "4740b56f-e5df-431f-a55b-729631deaf58", "value": 351800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781989957, "uuid": "1921a223-7ac4-4c60-8e0e-10886a244e4a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781989957, "uuid": "6bb4bd48-1fc2-42dc-bae0-eb4bfd12e989", "value": "kworkerd-rcu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f19051dd-6c98-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781953956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953956, "uuid": "4ff6eb89-0c4b-4120-b5e0-bf7d4e5acef1", "comment": "Malware payload (ConnectWise)", "value": "db5f9352503f9cd7f1c572d03a64f32d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953956, "uuid": "172c477a-dc21-4316-a5d0-a3764f9526ee", "comment": "Malware payload (ConnectWise)", "value": "691c74f56d546998e51af78a4a55a0b13744b3d4a882b0247da05b59e1e1d6c6", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953956, "uuid": "493e9c79-b861-4548-ad46-e7260c05d51c", "comment": "Malware payload (ConnectWise)", "value": "9604fdffe5573bca0dc7e224867e90ffdc0c491e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953956, "uuid": "63e7f434-e5fa-427d-a79f-1fbd1ce9bde8", "comment": "Malware payload (ConnectWise)", "value": "aa6e0587aa571cd87d6bd70a567fcfd4512c28f651e4ca133fdee9b7c169a3fe9f42609442bd57ab6a5e6b0d8a542567", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953956, "uuid": "6059d468-9687-4324-81ce-77c926069de8", "value": "T13556CF036295CE67C07AC7B8BF274B5D57327E044311B6EB5290B96E3F32780496E36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953956, "uuid": "89e9b209-f9f3-4ea2-9d9a-45ffc2087a37", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953956, "uuid": "6b6f5419-d7a7-4799-a1a4-d88cc2e458e6", "value": "98304:uzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlF:uhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781953956, "uuid": "41c5d0e4-7884-4726-856a-6c11722deb50", "value": 5976192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781953956, "uuid": "e6fb08c0-cdda-429c-a67d-cd5143039922", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953956, "uuid": "a3f78d4b-a1b3-4fa8-b16b-6511650bc6d4", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a98bb1-6ca6-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781959971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959971, "uuid": "2dedcba0-90aa-4f7b-8b3f-a4183b11cf9e", "comment": "Malware payload (Gafgyt)", "value": "ce2ed518f21e0fbf91029dcd21680569", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959971, "uuid": "3c16119f-b4ab-45b2-bc15-4c1d0606006b", "comment": "Malware payload (Gafgyt)", "value": "6929657496b56cf92c2a76a7989dcaa52a481581cf8009f11d890d1b125e79b9", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959971, "uuid": "05c2facd-1eb8-4cb2-af31-bdbea02a9837", "comment": "Malware payload (Gafgyt)", "value": "4a08a0127e42a2dc10a1f157490dab8b5dc64691", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959971, "uuid": "6fa92f28-a336-4ec3-ab19-1f42c15ea834", "comment": "Malware payload (Gafgyt)", "value": "c44041fd41834f38d5e4c602d24ddbb016743fd70df60753b1758e97e009780f29a705903e39bbb3e97759d2bf215477", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959971, "uuid": "5c400085-0c71-4491-864b-6cd2ae36d7f8", "value": "T152C31993F800DF66F40AEA3605D34721B630FB624E931A76B3573A669E362D47827F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959971, "uuid": "2e1c5a5a-2ee3-42df-a1e0-86de3a452c22", "value": "3072:bgNaImT9oF6lxbHlDZyRjwJ3iPyqpFp1mva0PDGnSQNER:bgNRc9oF6lNyRcJ34BHmva0PDGnSQNER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781959971, "uuid": "46616896-f152-452c-a85a-1f82a07518b9", "value": 118950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781959971, "uuid": "e2c84e53-3a02-4124-8a55-183b2db5db47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959971, "uuid": "ed27e3aa-92a3-4ba9-90bb-b2428ed3635a", "value": "assailant.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca6b955-6c97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781953438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953438, "uuid": "dab4eb23-3042-4f59-be28-4d5c2b54891d", "comment": "Malware payload (Mirai)", "value": "7fba869d108cec80a4f2d57fbf6329e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953438, "uuid": "e4dba621-5741-4296-8827-6f22e015a9fc", "comment": "Malware payload (Mirai)", "value": "69cacec8f2890f16c21d095b0a68ee13ce9be12d01a404ac6098d6fee0f4b837", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953438, "uuid": "d947b040-8af4-4434-8feb-ddb95b66a829", "comment": "Malware payload (Mirai)", "value": "75abf9aef73f244a7b5c46ba8affad6d0cd636a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953438, "uuid": "c0d8aa62-89d0-4ef9-aaaf-df8eea88f218", "comment": "Malware payload (Mirai)", "value": "22667e08098da23dfb61ebbde6655e65478b6118ce2fec37ff2a0985c40fe5957132427c46b6eb76b0c9b663128a61ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953438, "uuid": "0c76f2f6-e8e6-424e-b0c6-87811183e906", "value": "T1A261E22D5F910E16D817EC391EB2176625DCB437300DF390A57CBD80B82F581B253A59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953438, "uuid": "4b653082-894f-48ad-9481-12396c3fd234", "value": "48:KGlw8rj32+jaJMgZhxMvIPFjXaDfF/0U/zEg/oaYXB/T68TfDkvC6nyyQUUUiF3I:5rj2EUMgZhxMw9OR9bRAxmYfwC6yBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781953438, "uuid": "d813b63c-4395-4728-a146-a9f492a85717", "value": 3248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781953438, "uuid": "865dd8db-94af-4ab6-b4d9-2dfb58e7bb25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953438, "uuid": "038af917-ef46-47bc-878a-cae2e066889b", "value": "dlr.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ed9e85-6cab-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781962010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962010, "uuid": "12df577b-c21c-410d-a879-d6ef5f6600fa", "comment": "Malware payload", "value": "7d5289d073c5fd9b12c2f2b6955724f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962010, "uuid": "6e7639ec-cda0-48f0-bf9c-be398ff4f38b", "comment": "Malware payload", "value": "6a4a65c5deb57b04834fe961dcd5288a27e9337d25a5354cb6eafcf32bc10b71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962010, "uuid": "e6f1d677-e006-47b0-a083-5518f50c9814", "comment": "Malware payload", "value": "aa1f0806640ca74a3a71581dfdc5a29d182f295f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962010, "uuid": "fa200f70-1da9-43e0-a622-a3ee2b718add", "comment": "Malware payload", "value": "2efd57b8e9ba6859ff45656a1459a5d302dd3940bcbd927d8ff0c1f55d96cb08f6c105ad1ef1939a6531fd529e5e3dfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781962010, "uuid": "a72cc0e1-9129-489d-9b72-2de575bb0b81", "value": "T147F63345106314ABE0D5793BFE7FE2A1EF34B374A52E2589453DA2BF3F406C11E285A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781962010, "uuid": "ba0c6db2-4af8-4c41-a937-02dacee06aa4", "value": "d54f4ce7166adf987d04345af91ff939", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781962010, "uuid": "6a8ac143-f4e6-4de9-88be-58ee7a27bf10", "value": "393216:3eFAqtSeSUnvmhoZ778iJjs8gEULOYCAlUqtPGhXs:3aAqHua7hA8glDTtPEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781962010, "uuid": "421985d6-b9fd-40f7-84d5-720c15671842", "value": 15597792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781962010, "uuid": "2b744462-d2d9-482a-85ab-1d9d976cc0cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781962010, "uuid": "797cd4a3-a239-46cb-a991-9c17ff52f9d5", "value": "service.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23399cf5-6c40-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781915814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915814, "uuid": "922c541a-a0e4-4ffb-b71f-191ed5b6bcaf", "comment": "Malware payload (Mirai)", "value": "0d132203e968d40327fafd7ed9c897a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915814, "uuid": "eece82d1-2496-4bed-8a65-b8b77b058689", "comment": "Malware payload (Mirai)", "value": "6b31e1821d5aac5a521927f3a6d90772cad8c60b92c1a9d3b9074f9185960632", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915814, "uuid": "8d398cb3-fc02-4a7a-b7db-3f0039514e78", "comment": "Malware payload (Mirai)", "value": "9810cb586f344f62c2bef9f155cf9224ac64a414", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915814, "uuid": "c5485023-4da1-4d7a-ae67-77c25d1ecc8f", "comment": "Malware payload (Mirai)", "value": "a6e41284240f0d3f402177d92ede5abfbd725849647dcd560d24a672e946e9a935d04a87e1c3a709896705c1ec3ccf8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915814, "uuid": "00a5d411-7c1f-40be-bda8-478e50796f0a", "value": "T197331A95BC829A17C6C152B7FF0E438D3B266798E2EE7303D919AF60338792B0977511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915814, "uuid": "409f1d0f-ccff-4439-92c7-2dbb55b3401e", "value": "768:6WzxSKNiXtVdEEjkWjdO40Lv93xywHM0oeQoNTRsmJy9wfVcVXw3ovQKI:llSQcjiCL8v9B60bQWRZJxf+OovQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781915814, "uuid": "a3525ba2-797d-4add-b487-15ee67272208", "value": 54620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781915814, "uuid": "c25f52f7-4a1b-4c9e-b1b1-5fe02e3a4aee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915814, "uuid": "edba23e9-7374-48a4-99f5-6391f51ec21f", "value": "godisdead.4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b6b2b70-6ca7-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781960147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960147, "uuid": "87341eb1-1580-4a47-9d40-6345ca885b21", "comment": "Malware payload (ConnectWise)", "value": "ed32f554a6e15f3d3112e9b07f21e8fa", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960147, "uuid": "d73fe66c-32b9-4d22-b0aa-69b21ebd986c", "comment": "Malware payload (ConnectWise)", "value": "6bc5bbef79cd96c26cee4702a22eec2b7d49adc7c67b0a76efcc852df2252214", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960147, "uuid": "d1fe69d6-ffea-4158-bc41-3848bf8dd466", "comment": "Malware payload (ConnectWise)", "value": "81c89ddcb7ff90acd948aceaab9aa358fa9674ca", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960147, "uuid": "174780aa-cf1c-4e98-803d-47c555fdfe7b", "comment": "Malware payload (ConnectWise)", "value": "45cec40456d6acba545f2b38f346ff10fbce4ea43994e08b70d401c7afe060f44831b05b5016f9daed0b0552c221cbb3", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960147, "uuid": "edb02c79-9f7a-40ed-b86e-b0ac53f895cf", "value": "T186646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960147, "uuid": "2d48e650-ed62-4840-9811-a25e31337332", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960147, "uuid": "7840bb07-9f5c-4e60-9374-8558f1560e5f", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9e:R1iw7gryNkSV1hy1Z1u2JLu9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781960147, "uuid": "b916e886-694a-42ab-92d8-2ed6452ccae8", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781960147, "uuid": "713765a6-24cf-4dbb-bb1f-fdc585a5968b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960147, "uuid": "e8715e65-b10e-4c86-aab7-5e2600348062", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0268edf4-6cc2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781971594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781971594, "uuid": "fe37e250-a815-4bcd-bea3-00d713dec9c7", "comment": "Malware payload", "value": "e4dc49dafb71a13b1d1e166464212d61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781971594, "uuid": "dcdcbfdb-d2d4-4aae-b20a-2841db04ae0c", "comment": "Malware payload", "value": "6d043401b7ca64e5cf53999b17a0395bd2f224934b5b8acb8ff33c8fea1d327d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781971594, "uuid": "0205734b-0cda-4271-bc09-087d82832c0e", "comment": "Malware payload", "value": "a7d977ffc1798de7423df14534560513b69a093c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781971594, "uuid": "5a62c1e1-08bd-4e2b-8308-4fedc261a210", "comment": "Malware payload", "value": "9583dec20319bcbcb240368f6ccd3b76bb3a88c93d45ca23061367b26c2aa7d4a61fb59d36f12e8b9c7e9de6a7f9a85b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781971594, "uuid": "3baed973-bfd5-436b-8c03-4b1a2e38dc94", "value": "T162056C06EF851FEBC4AFCD30452E834B16DD999706D1B63961FC898CB78D29A5BC3488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781971594, "uuid": "9ece3538-b119-4c63-924f-3a1da845af8b", "value": "12288:17eEwEI6oyXfIW/cMtpBFxB+CiL5LaPl3z/aAd/xHlcDPpDW8VvD0NBX7h4dDTtH:RLlpXuBDFpfa5f5TH8udQTuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781971594, "uuid": "28b3be5c-4fb1-445a-999f-eaf183ea3f00", "value": 795296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781971594, "uuid": "576cc109-f191-4135-a763-d14699d9981f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781971594, "uuid": "e021483a-f255-455f-92eb-423f57800642", "value": "bot_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c9d133-6cdd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781983241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983241, "uuid": "47af85ba-13dc-4660-aafe-df4796e9c222", "comment": "Malware payload (Mirai)", "value": "f45d7d2e578f3497a9dec4e712ce795a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983241, "uuid": "e96d9723-1654-42b9-96a7-f429546e00b6", "comment": "Malware payload (Mirai)", "value": "7165ccfa91053dd6c0141ff42a6d92eeb8d19d582b0f57188ae305ec43235d32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983241, "uuid": "805cb549-9fc1-4473-9952-6eadad83aa90", "comment": "Malware payload (Mirai)", "value": "515aee01b29de96cf4104609520d82ae13e9159e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983241, "uuid": "35ca39da-df1e-43de-bf03-5e7bb6e1d1bf", "comment": "Malware payload (Mirai)", "value": "8489652bd563e093216088ff55875a21de0f8e924e7e5532088614898359c162501449c4ee12a6310c09e21e51a30093", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781983241, "uuid": "0625af27-80d8-406a-87e7-cfbba79e3f6f", "value": "T120F65B47F9A614E8C1AEC430866BD653BA717C48072177E72B94B6302F77FE05A79B20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781983241, "uuid": "9574c9f4-47ea-4f86-b145-02eb54aeb0d8", "value": "196608:ddGnqlnsf8nl4lcmDi1WIPFCBNcJ7oEkLsQXE:dRlnsUlOqUqFCIkLsQXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781983241, "uuid": "b8d88f8e-8b93-4a2c-8f55-8df1676feea7", "value": 16752802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781983241, "uuid": "566e96ff-3926-40fb-8a7f-3618c52fa61e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781983241, "uuid": "34ddacfe-115a-42f1-805c-29f2e2e1f407", "value": "SecuriteInfo.com.ELF.BitCoinMiner-HF.67986673", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "844358d5-6c84-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781945183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945183, "uuid": "22396dcd-e567-4f14-818a-ab04a5d02381", "comment": "Malware payload (Mirai)", "value": "041fcdeee83c6706eb70b2447967cdfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945183, "uuid": "5c239cc5-420c-4b2a-9144-c500bbb19240", "comment": "Malware payload (Mirai)", "value": "724536283a09cc48d0d1487d0bd711ff5739ee6daa2f7dbe72a05b227bb11e21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945183, "uuid": "6e85c1f8-8a3f-4b46-b863-809bf2df262f", "comment": "Malware payload (Mirai)", "value": "f7dfe21f00837b16b7c2d948badb5ac0e21836a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945183, "uuid": "94b8ac5e-c6e6-4ba0-b38e-b2b05e16803c", "comment": "Malware payload (Mirai)", "value": "2972d38dc94b97f081a691d22347e4af63a3049a83db4d9e3466b6f0519cfae5a601c262522fd90e8fb0b98e0b38133f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781945183, "uuid": "e8226d28-95a1-420d-9025-11b3d7b097bd", "value": "T1CA838F23E8756D24D039A970B0F1CB7C6B63A5B581431EB5A5A7C27C8483DCCF56A3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781945183, "uuid": "7dca87e2-a6e4-4bfe-ae6c-5ce55faec2b6", "value": "1536:yNhTNijbKo2K3mtd/DOw5AWkJR81jCVKSZrc7uAcDnEvneNy8gK9:ghuCKQ5DOkkH81jpSAuxDoa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781945183, "uuid": "7363b9c1-04cc-455f-9cee-d4ad59acab61", "value": 87332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781945183, "uuid": "f9af7469-a66f-4986-9f94-badbb496230e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781945183, "uuid": "874bd443-27af-406f-9117-6046ca4b379b", "value": "rep.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "020167bc-6c56-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781925208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781925208, "uuid": "40a3c936-c01d-4cf6-92ec-b507437d4b53", "comment": "Malware payload (Mirai)", "value": "9bc46db12719f5e8d4b060a8fd31e5db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781925208, "uuid": "57fc2133-2388-4e98-8501-eafe5393bc96", "comment": "Malware payload (Mirai)", "value": "731433356e439a75745c9c064d8d6332c1d9e64c4e642f05e5572340edd70d4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781925208, "uuid": "a454253a-009b-4477-8c40-ce9fc8dd37fc", "comment": "Malware payload (Mirai)", "value": "c2618294d3c42b242e856820e22d5564d81b705d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781925208, "uuid": "111fe776-1d5d-44db-b13e-96dbfecd4c2a", "comment": "Malware payload (Mirai)", "value": "a598fbc22c658d2346b2942ba61f21bfd0114f00645012534a5794a5f58ae7410a4833a6bbd46ff9aee73f9022f036b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781925208, "uuid": "2c3e4720-528e-404c-96f2-ac48a03007a8", "value": "T1DAB32942BCC2965AC6D6637AB66E568C336613F8C3DB3117CD114B653B8A92F0E37B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781925208, "uuid": "3c0f8c1e-7495-4341-afb0-da5de2c40336", "value": "3072:n+JHtkdb1TwF+eHqGm3nXKdHMTfzQJV36PpalC0z:n+JH+hs1RmDfzQ33dlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781925208, "uuid": "b1397824-2767-4314-91fb-3042730727d6", "value": 112900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781925208, "uuid": "b2ab28d5-f9c8-4345-ac5d-07827da3c7a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781925208, "uuid": "1430da6e-8c41-45d1-b5b6-a46b044116b1", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d381fab-6cda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781981920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981920, "uuid": "aaf573bd-07e3-4810-8c6c-f75d510dd0f6", "comment": "Malware payload (Mirai)", "value": "078eb04a07c053c331d43ce7e7f23358", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981920, "uuid": "64433c92-1a22-4295-b1a8-c12285f6c787", "comment": "Malware payload (Mirai)", "value": "731aa53e556fe38caf0f74bd6cbb249e35648643c295cadfdf902afd392f3b41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981920, "uuid": "89ee1d42-a537-4ff9-86e3-28251d3824c2", "comment": "Malware payload (Mirai)", "value": "30d321b1dc2b7a774ed5721045b0df70b7e7a38f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981920, "uuid": "64e37760-9ad0-4ec5-9c3d-d8a36329ff41", "comment": "Malware payload (Mirai)", "value": "27ca369a1fd64d0fd0dea388fe6620e9ae1329f81566af279e33101ddb025b3e934ff1f8a019edf30765c2f9acfe5eac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981920, "uuid": "492124ab-f7ab-4dac-b60f-52f88b4d93dd", "value": "T1EB242A027B0D0E07D1432DF4267B0BF14B9BAD6138FAE681750AFEC957B1DB1644AA8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981920, "uuid": "78fa86a1-6e8b-4a68-973c-36bd74498713", "value": "3072:ZUEdJWfJNUaqrJVqNWZMxxN99iRFDYJrMhgfNjZgnGuA:ZwJWacJJZMxf99iTDY1MhAj0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781981920, "uuid": "25f8ca04-498d-4d46-889b-ddddbd8b205f", "value": 217844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781981920, "uuid": "f67a589b-492f-48ca-9adf-65f6d779e12a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981920, "uuid": "cb8c2440-275e-407b-9769-61efde97ca6b", "value": "bin.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e2e576-6cb0-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1781964131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781964131, "uuid": "42031ec5-acf2-4f0d-a7c6-68b5f98eaeec", "comment": "Malware payload (SalatStealer)", "value": "1d562cac7c67ff7ebbe87a6a9dcfcd35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781964131, "uuid": "fac9c6db-2d0f-4283-be51-963d59eb8ef0", "comment": "Malware payload (SalatStealer)", "value": "7348ea4bd90ba897c35d9cdcc1da7470d8ad00db072538e21686db797e3b1a69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781964131, "uuid": "80d1ae5a-67c5-4195-8c5f-ac6f2dc6dbfb", "comment": "Malware payload (SalatStealer)", "value": "0a3fa4f8d598e6a92e0814924a93fc8782e2752d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781964131, "uuid": "14c19369-098b-4d35-83a0-090bfbaf1cd9", "comment": "Malware payload (SalatStealer)", "value": "0df0ebfcc60b4e3de4e69dde1f543f921f645dfd773e7c9ca94a183281757a54cefa9aac321e343e0f11cc04b67e57de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781964131, "uuid": "40551a34-660a-4f93-a159-56cfe7906b22", "value": "T1C4473344B7C688F9F17F81748A058693663234664B50FAFF126043AA2F0BFD9377CA65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781964131, "uuid": "5301a6b2-1d26-4fb2-9286-feec4635416e", "value": "13b130328fcc8ca4b3aa4b0c36da106b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781964131, "uuid": "35930a78-da20-4de0-bbe7-27c32d8ba470", "value": "393216:4eulUKFawh9TXOGJxSARuvGzWlhDcmKg3pjlwhZEQrbqF1pjnEDcQvrAK:4e7KFJhQARuAWlJcI3psty1pzEDfrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781964131, "uuid": "b6057598-b203-4255-9a52-76084061a7ce", "value": 24757840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781964131, "uuid": "156dee09-3232-43af-9ad5-28d7ea27953f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781964131, "uuid": "63bd2520-db8f-49b7-9eea-f1d9504a22d2", "value": "TgWsProxy_windows.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b40716ae-6ce9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781988642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988642, "uuid": "dfc86f27-7d26-4161-b40b-877e6c9bbd3e", "comment": "Malware payload (Mirai)", "value": "42c502d1ea99e9acfc395724556aea1b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988642, "uuid": "5d2e67df-2da8-4d4a-9aa1-2fa22cf1178a", "comment": "Malware payload (Mirai)", "value": "74394ecce3f159b8a2ba94104976e18d32e8077c1df0b9f4b471128d96521b1d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988642, "uuid": "e31aad31-340c-451d-9cab-b64441fa59a8", "comment": "Malware payload (Mirai)", "value": "ac113c655221c2c03a26810ca31f083b5149731b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988642, "uuid": "689b0dd1-775e-400c-83a0-c7959fdb043b", "comment": "Malware payload (Mirai)", "value": "608135af4578d0f0ead9cd8a4e6b39774f2d3805b4af4c1262ae16c845bf2b0427c3b3134ff4371c2b6864c47346ba68", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988642, "uuid": "04cb5db3-0c96-4554-90e0-240fe48ac1a0", "value": "T16C533981BC819613C6D012BBFB6E038D372653A8D2EE3307DE269F11378692F0D6B655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988642, "uuid": "04f33377-b5f4-49cc-89ab-cd586abf2359", "value": "768:bQM3HGue09+OYIRopSsOpPG/ExcEwQ/NMmT33rxvMGdZm+uuim+01Vzswx7vlaI:p3mu79SPpSJPDwQbTHCGdZpqvEl7vla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781988642, "uuid": "6e705d34-6be9-4a99-ba76-45bf4d9eb22d", "value": 64456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781988642, "uuid": "57544a9f-9333-46c5-82d4-19761dc79fe2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988642, "uuid": "8573d90d-3141-48ca-b90a-0007916fdd92", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "505946ca-6c5f-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1781929205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781929205, "uuid": "951def81-4ef5-4b6b-bad5-d3134594e8d5", "comment": "Malware payload (ValleyRAT)", "value": "548f3d80b313a9c8e97c2e20af61949b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781929205, "uuid": "7ab7ae6f-63da-4c3c-b2f2-1db07f2ac001", "comment": "Malware payload (ValleyRAT)", "value": "743b0674221a41f64fc52cdb62dc0f9abfeff460ec6c5660ceb2279f7098a0d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781929205, "uuid": "3465143b-3212-4d64-9beb-d986ca7cfa18", "comment": "Malware payload (ValleyRAT)", "value": "d07709d71e125834aa5ce22ae2a8bdfb8b3df70e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781929205, "uuid": "194d807f-97b0-496d-a1a9-984d2f31f35e", "comment": "Malware payload (ValleyRAT)", "value": "bca979cbc9dcd69b174dfd8c65caf9aa7a565dba1f68104ed8c9a5dc793841829c66332ca157b363d18210daf09a26be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781929205, "uuid": "ef6ca67e-4edc-4f6b-b32e-f4be592f466c", "value": "T143D37D4733A450F9D4A78279C9A25A06E7B374660735A7CF17A086BA2F137D0BD3A331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781929205, "uuid": "baa7acfc-3cb3-40f0-be2b-311ce43dac1d", "value": "fb51ede541a9ad63bf23d302e319d2a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781929205, "uuid": "cc9183e7-e7c2-4f35-b8e0-665dac859665", "value": "3072:kO55k/y5dAj+BMTYlgEQnB+Y+pek7+3OrFZeUqe6oR:kO5n5d56TYZQnB+Dpekyyqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781929205, "uuid": "4a4f39c4-b698-4ce2-bd17-1a1eb3db9893", "value": 133632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781929205, "uuid": "4f587fd8-76f3-42d1-8977-25071aa8a695", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781929205, "uuid": "d78b90a5-0965-4fb3-b907-cc71d0e0ab58", "value": "548f3d80b313a9c8e97c2e20af61949b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f743dc75-6c50-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781923042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781923042, "uuid": "ec1d31a6-ec2a-4b28-81fa-8bb6a02f4cf6", "comment": "Malware payload (Mirai)", "value": "b7fe3fa73c2644e234232d621a4b29d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781923042, "uuid": "ffe57db3-11cb-4efb-956e-694b41cb3688", "comment": "Malware payload (Mirai)", "value": "74717f8eab3eeb56bf59bb12fc976ad4b31fc7a16c1761d2b8c040eb676debb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781923042, "uuid": "da3aed64-22f8-4adf-9e4b-5c79cb2d0bc9", "comment": "Malware payload (Mirai)", "value": "99ef1f49184f1acf61f34eb8e4ff48d006c9942b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781923042, "uuid": "500868a7-d3b2-4b1a-adbc-ea224bbed2fc", "comment": "Malware payload (Mirai)", "value": "87d746b5034476ca79d4f2305761b01f2933a3cf3f5f37c1478d9456064eae0eca7f493ff1072aa0d42788643cc9039e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781923042, "uuid": "3d1bb96c-edfa-4a38-bdaa-9f2e9ebb944f", "value": "T15263025BCD90F2CFE94EF07E3E2C362692AA89154434DDD1A7982611EFB7F132B06210", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781923042, "uuid": "5190ed50-0e0e-4d1d-bd04-c0ad1b617ac4", "value": "1536:zP0Bo43ZvXqFgygr1XIcPI4JiFwc/VoFacjs0Q/nouy8ryV:XItqFBO1fI4JiFwiVGNwout2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781923042, "uuid": "084a9ce4-f281-457e-b219-0f54d7070cd9", "value": 69004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781923042, "uuid": "03f2cb1c-95f5-45bd-a0a6-20af46a7006a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781923042, "uuid": "3942ea4b-067b-4995-ac44-ebc93200c680", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f46abe7-6ce8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781988098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988098, "uuid": "13558bf6-59b2-4212-acf2-1fb61efe320c", "comment": "Malware payload", "value": "741e9c3c08c78ecad01bb33367bb0a2b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988098, "uuid": "e02f34a3-1153-454e-a631-371e18032a41", "comment": "Malware payload", "value": "76edebe707d788acf692af96e3276784d0501dd01eb272f08cbfb2e3a1c14d70", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988098, "uuid": "7542bf73-3b00-41bd-b7fd-abfab3809ebf", "comment": "Malware payload", "value": "ad385165a153e25b87ba9ebb1745e20c088b4d9b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988098, "uuid": "a303a394-8ec5-452f-aa23-647d3b3de83c", "comment": "Malware payload", "value": "ab86bdfd087e5334232732eaeb840432df5e4ce854233b3dfb317ed8ce10c7f2cdf7f5678506818ba6f3cb11f83654f5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988098, "uuid": "dead9d2a-0df7-43a5-b702-7af50090cda5", "value": "T1F3529851FD36A634252DC0F5AACA2500F14B513B461C3909B1AFA254BF3CBAC51FD6FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988098, "uuid": "5ce4f38e-513e-452f-836c-e9694ccd86bd", "value": "192:eNs/MbhrlqTZgKZPVmhxZPKgjlhtVZDmh5RDKlE3O+SUmTx0P3V6tbG8zesvq32a:ezl6S1LBYRQEZb36tyUgNSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781988098, "uuid": "8445f889-9883-4d88-9f40-518beb419e85", "value": 13932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781988098, "uuid": "68276d22-2724-46d8-a6de-77bba81d8493", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988098, "uuid": "55b2827f-d728-4708-a3b4-2357080d5f6b", "value": "init.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a45a875-6c6d-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781935288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935288, "uuid": "7740ce3a-e11b-4495-8322-56bccf02a263", "comment": "Malware payload (CoinMiner)", "value": "96342a612e8a9907cb0a6ebb99ed11f5", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935288, "uuid": "b7696476-9b16-41f6-8693-8cb431982e1a", "comment": "Malware payload (CoinMiner)", "value": "77bf85c043145dd34d7069fff7c3924074303294396ba775c070d1ff2c3a1e80", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935288, "uuid": "60cf7785-af08-476c-882d-48065a15be4e", "comment": "Malware payload (CoinMiner)", "value": "307648359f37d50bced1278e1591d746443c35c3", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935288, "uuid": "86771e7c-08a7-45d1-8123-686af9757732", "comment": "Malware payload (CoinMiner)", "value": "eef2e2b1452e2a0b5337a55d237910516fbf647decedf1e89b2e5cce1346ad394db181430ff278fc1e0830a629c77025", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935288, "uuid": "67139279-0d5a-402c-9728-fa4188ccd186", "value": "T10BD3124B488064EEE7DC9D7D61BB9359894459D331C3C6C2939C3C356AF8A05FBCA4B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935288, "uuid": "d9699955-2667-4069-9024-58861fd1a180", "value": "3072:rlQXurLPMpQCsY+G0tnweAb5gKpwKhek6y:rKuXPEF+G0tnweA93pwKAy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781935288, "uuid": "fcf36d91-3ba9-437c-b782-394650af4f9e", "value": 139960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781935288, "uuid": "e11c19ce-64dd-479d-9864-7b7da3fea541", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935288, "uuid": "15252dc9-73ef-47db-ac92-35dad4c428de", "value": "kworkerd-rcu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1deec33e-6cab-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1781961762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961762, "uuid": "00f8c14e-6a5e-45b8-85c0-fc00903351a2", "comment": "Malware payload (SalatStealer)", "value": "0e7c42de35a8effa21d8aedd55170f6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961762, "uuid": "7dd61508-384b-416a-a10c-ed4f9f7ca46e", "comment": "Malware payload (SalatStealer)", "value": "77ef08194ab04f99824d79503fe719c893f3bf180faf94ba5b1afbcc418d872b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961762, "uuid": "15abad74-cd92-423b-862e-fc4b4c4379b6", "comment": "Malware payload (SalatStealer)", "value": "700a24f5aecb59c23e7142094cb425c0a732624b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961762, "uuid": "42eb9910-2a44-4499-9fc2-ec77bcbeeb45", "comment": "Malware payload (SalatStealer)", "value": "74d948cde1ba4aae8c4c921480fb585229220f61ac636723c08eee48cf4f560aa892e8259e1d31c2e11fd7bbf52a4382", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961762, "uuid": "5fd31404-ce10-42e3-a8cb-6a025f4953f8", "value": "T1A5F5338AD0E7B241F5972B7087524CD780C0ACF3E795962A3F85D4720DC56FAA89B3B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961762, "uuid": "48b340be-bf2a-425d-aa4d-06017ae930e4", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961762, "uuid": "5547685a-10dc-42bf-8543-8e4d2065a091", "value": "98304:dK8WEno9g42bdG0vY2lm1f5PuPjISi/tLxOKZKSzGjE29:EIx42FG1f5PeIBLxO+KwGw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781961762, "uuid": "e2d94caa-7b74-44f1-82bc-5d7808b5a219", "value": 3594752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781961762, "uuid": "db91cbd4-9567-4ed9-8db8-28b1a2e6cb2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961762, "uuid": "902c1587-9204-4584-8422-34001c157e00", "value": "DiscordFix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "265240ad-6ce4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781986257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986257, "uuid": "0ed8f3e2-7a5c-44f9-9e72-d266b51d6af1", "comment": "Malware payload", "value": "305f4065a8522f1e16574501507a2c1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986257, "uuid": "4ab8da5b-85c3-4572-8ed9-22fce3968116", "comment": "Malware payload", "value": "7931ba55069255c1392a01a20633d0d4cff9afb6b029096ef421d2798ca61e5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986257, "uuid": "ed61ec77-e41f-4592-8c70-e1371308fea1", "comment": "Malware payload", "value": "49410bc117c18a538504b063d91f590cdf7eec92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986257, "uuid": "2207d4ee-6596-4f80-a97b-02cb2ab569f4", "comment": "Malware payload", "value": "97af43c6fbec6f8f1411a4f9a023bc4cb81bd7d5880e9a840c9c55806ae45dae45b0b660459089ab8c0db5ac9f256054", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986257, "uuid": "69c75135-87e3-4a6e-a1ad-219b7da6838d", "value": "T1DD560857B8D24992C4E83637B8BE80C433635EFA9B8656566D05FE383EBE1D90E34314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986257, "uuid": "d995c8c3-567c-4c2b-bee1-4d7e5d51edc7", "value": "49152:TmRgv/hgXC1xZyGMIJYm0GEcBBj7CD4aK2OZ23g5EE:iQ3PPByK2OZjEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781986257, "uuid": "90e4cffa-2428-48e1-95a2-9a17c61d18ca", "value": 6226068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781986257, "uuid": "11dbb6fc-f124-44c9-bbb5-a64fb7f7a6c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986257, "uuid": "5b0e5ce2-f270-4bed-bdf0-a3ab56e3d5b5", "value": "bioset0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1c840ca-6c4b-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1781920805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781920805, "uuid": "66622227-e60a-494b-b18a-1c61d07e19a5", "comment": "Malware payload (NanoCore)", "value": "d3e37de6dd2dc8ce1bb72536259529cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781920805, "uuid": "03480a3f-b4ed-4a1c-9391-ef5dd150086f", "comment": "Malware payload (NanoCore)", "value": "798138899fae930a2eb5d70aafd8ba622fd1674fec571e282e9c9589b39cffef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781920805, "uuid": "fe1345c7-aa5f-49a4-94a1-b2a157287fdc", "comment": "Malware payload (NanoCore)", "value": "9c9b962deead54c4364d378324e1f4ec603ab81c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781920805, "uuid": "b3eeb270-8a0a-41a7-a58f-72d3347ddfcd", "comment": "Malware payload (NanoCore)", "value": "0975bcf0430e70707303a389410e98cfab047a32e2ad09ed8bb75ad11bebe76794aa5ce26cec8adb3e26c5d367fc49b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781920805, "uuid": "6278f2b9-28d7-4312-9646-b91445a46343", "value": "T10A14CF1A77A84A2FE2DE85B9611211538378C2E3DCC3F3EE18D855B39B663E50A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781920805, "uuid": "e8c16b61-2b3c-414b-b8d8-039a0221befb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781920805, "uuid": "c669ed81-fd4f-4a4f-b195-24a6c5d78883", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI7gsvu1SEImfAF8V7m8CJvflRR:MLV6Bta6dtJmakIM5ouvImfVqflRj0vK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781920805, "uuid": "1eb25c8d-cd98-458a-a54a-f85e1554a8da", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781920805, "uuid": "de6be1ec-14e0-4d37-a0c6-84d109453009", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781920805, "uuid": "08cd4aaf-84f4-4657-a1fd-6228db8e8eb6", "value": "nomoneykids.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeba2745-6ce1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781985305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781985305, "uuid": "3db6b17b-48fa-4b0a-b8a5-71578544ebad", "comment": "Malware payload", "value": "e9e1429968a654fbffae2c19838d1b86", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781985305, "uuid": "10c95d9a-7611-4415-87a8-0e56d34ac758", "comment": "Malware payload", "value": "79f2856beb38aebc676db11193bef2912299b4ebc21da484e80e36024c3b377e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781985305, "uuid": "f71ffb3f-0b46-4208-b3a2-9111fe3cdc17", "comment": "Malware payload", "value": "ed55960eebafb7a768b84fb747a9436c1bb4b388", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781985305, "uuid": "522f710d-dc39-4e15-adb0-f1c8a6acb474", "comment": "Malware payload", "value": "ef452290cca42ae62c6fc7de0512e293fd4a7e878b3c0e014c7023abe2977941f1decfb9576dcf059864ca2c7c447fdf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781985305, "uuid": "ec96eac7-2d20-4ce5-b16d-bef94cdb6fa4", "value": "T1F42153D423A05BF20FD494456A138CFD799F4CFB2F1399E41D2804E2AB60686FC342BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781985305, "uuid": "9c66d8d5-d6b9-4e91-8d0f-e7337dfc312b", "value": "24:xBFl8UMBQOBsV1B011XABOKasB6N6mBcTBwsBnmYB+V/BYWBykAWLBYdBM9AB7y:HFWUAQusVL0110OFgg62cNwgmsOJYGyc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781985305, "uuid": "43c21cff-8a00-4be4-94b9-a9e6b2eceeac", "value": 1294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781985305, "uuid": "4c5ca053-6fa0-4476-a0da-445774832ecf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781985305, "uuid": "e0f02675-6771-40d2-ad50-087309c982b3", "value": "tftp.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeac9913-6ce4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781986593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986593, "uuid": "68b1b70c-03f9-4b04-9c12-a11168345dff", "comment": "Malware payload", "value": "1c556ba6251cffa23040ca139c5e686d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986593, "uuid": "f73a3cd6-a2b3-4ff3-87e5-3fc2d759315a", "comment": "Malware payload", "value": "7b85b11424041c217a86cb3a197ce0646210592b2f068057b4b883c939634f42", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986593, "uuid": "776b05de-7bc3-497c-bd2c-93595701879d", "comment": "Malware payload", "value": "e946a79dc37a5407c892701d64604be7f2479732", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986593, "uuid": "dec6aa19-006d-4f4a-a57c-6c9f47b97ff8", "comment": "Malware payload", "value": "111d9c6c6f9208b99c347a0ad22f2e3931535a9eaa76227ad8dbc748cf9647c5a8daa4ed0fb13b74399265d143f47765", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986593, "uuid": "dbd2a37c-6457-46db-85fb-8837fb03453c", "value": "T1BD661712BF89DE5BD2A820358EB7C23833D53D04C1B060369656F71D1EBE2A49D6BDD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986593, "uuid": "96170b39-52b8-4049-9d05-f50cc5905ce0", "value": "49152:lZu8QabCQ5930+5XgQNOYyL+6bKv1VHHEt5Ea:eQ3ItGv1VnEjEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781986593, "uuid": "f635da07-7f1d-49d7-a4b0-48548675621b", "value": 6815892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781986593, "uuid": "73f9ea8f-a571-4f2b-9386-4d993282f211", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986593, "uuid": "795a7abe-91ce-4a98-aa5f-133afaa39fdc", "value": "xfsaild_sda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e914cf4c-6ce4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781986584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986584, "uuid": "63bc1d1d-6834-4093-b7fd-b4af218e3a58", "comment": "Malware payload", "value": "6132000f7c4750ffff67cb08be88a119", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986584, "uuid": "4b188105-2e96-4d49-a5a5-79668694b1ee", "comment": "Malware payload", "value": "7cc605b5fffa1478a286c2479f7c6f947fbf1ddf44bbf72f3028b4d62bb08dcb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986584, "uuid": "413d933b-1a7b-4733-ad55-b772782b810c", "comment": "Malware payload", "value": "3600f4818a91f82a78ecd12122a266ef73039a0e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986584, "uuid": "84f29d08-4356-41a8-b1a8-cd01b4d29782", "comment": "Malware payload", "value": "bd9ba966e7e580872ea4da6ea34c7cb0bd7d3cb3c06f1549210a9485825cad37dde2db1edf956ca60e967850fd7da143", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986584, "uuid": "e830349b-c485-43ee-9719-bea4c4fb3adc", "value": "T12885330681A43749C6F36C5BA51B4AB6ABDF42037C48305F67D98D5BF8F708AE1904BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986584, "uuid": "267ca30f-ea20-4715-bb26-730e23639908", "value": "49152:zaQ4vaApkIKQkOLAba4KvkLp1IzDMnBTOyvcyDBEezZH//Uy:zwFKQkHbJKFagAJBvzZH//N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781986584, "uuid": "3397f0a7-0c80-432a-b92f-707e19265895", "value": 1857364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781986584, "uuid": "aae318ca-2307-4569-8fcf-a1af6aeb5a39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986584, "uuid": "4c120e80-9ad3-4e75-a1aa-c1ba1c94ab9e", "value": "ksoftirqd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9dd9c3-6ce0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781984842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781984842, "uuid": "35e7ffc0-9fc7-4cd7-8d83-95d9545b10de", "comment": "Malware payload", "value": "7754077ee9191839a971e99d38e9dc1a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781984842, "uuid": "78dcba0a-3164-41e7-b85c-2e9e3729f7d7", "comment": "Malware payload", "value": "7ccbda568ff313b5e75d20b3bad6b9191a5f5b53eb867d05150c732f5cb039c2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781984842, "uuid": "61186626-38aa-4b61-a7e5-38e4625ca3a3", "comment": "Malware payload", "value": "2eb2d5c3aa11524e031ae6dd6f1715b5c877cbd5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781984842, "uuid": "bde50064-d8b6-4841-9400-ebb4843f6db6", "comment": "Malware payload", "value": "7ccc7bb15094542a073f548e35fdbf005f74b7b11b4749b7523cd1446c2acbb113cee711a0d5b7542b0b731bf62d6ab3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781984842, "uuid": "d7194c72-ebfd-4211-9f3d-6de0ba567c62", "value": "T1F683AC9476E80304F1B5FE36CE7677864436BA80EE318B6C0AA4CC6C6951A01DC71F33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781984842, "uuid": "aa8bc190-4da7-48d2-a34a-183a1b5ed449", "value": "24:foGX/ALDR5yW2RiqTeKT6CwD8Bx51WEn9+JkMRgRrT7UL3LXU5oG6V:f5vIRUVQqTelCUk51WU+KHhkLI56V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781984842, "uuid": "08462633-c0d1-48da-9bab-0f0ae7cb9d29", "value": 85074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781984842, "uuid": "8d3a644d-a075-48b5-a00a-5334b33b0c7b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781984842, "uuid": "785f047e-dc56-436e-8948-703ac9135083", "value": "\u0625\u0639\u062f\u0627\u062f_\u0627\u0644\u0642\u0627\u062f\u0629.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11e3f20b-6cda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781981928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981928, "uuid": "91d2cfe1-dafc-4787-a82d-0abb7ac826ad", "comment": "Malware payload (Mirai)", "value": "91f909420470fc7c9129f6a01d924e53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981928, "uuid": "4eec7a9a-198a-4277-9ba9-e1f03711d2ff", "comment": "Malware payload (Mirai)", "value": "7d25396b6d7fb9cef476ea318eae9a8c89fdffed92616b7792af5298214d5b91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981928, "uuid": "2a76e1bd-f0ec-4df8-8edb-a1af062db268", "comment": "Malware payload (Mirai)", "value": "6a8b4d76f50917c2b7f5284c99939756a9950676", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981928, "uuid": "3ce22a56-f978-45c8-9ee9-9cef13767756", "comment": "Malware payload (Mirai)", "value": "38ef8c390844d978a5becef51d736a0333535ccef4f8f22a4e0060695dba1d583ead62c110b556005c362fd8c1882661", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981928, "uuid": "b266abb6-e955-4ab9-9266-45711686394d", "value": "T1B924E947B991CF12C1C111FEFE5E418D37136FB8D2DA72029D24AFA477868EA0E7A116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981928, "uuid": "b73a157b-e9f5-49c4-a646-a9afbf51af3b", "value": "6144:xoMWDAzSf4sXLCloq+RaPiVv5L5FWe9bmhSjzr2:x6Dd4sXGlgRaP8bWetmIjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781981928, "uuid": "df49b020-05a7-4a03-8f7e-52b35bda07ca", "value": 221968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781981928, "uuid": "00230a83-de9f-403a-acd7-b87ef730cedb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981928, "uuid": "b0aeeabb-143f-48c0-b546-6bc685f79da6", "value": "bin.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12dd6f9f-6cda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781981930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981930, "uuid": "87e98370-a0e7-47b3-a6fa-ee3281c6b71f", "comment": "Malware payload (Mirai)", "value": "a7c81a476e919549fd3e4149d23d76d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981930, "uuid": "f6607464-f44c-4077-8121-d6a2240657bc", "comment": "Malware payload (Mirai)", "value": "7d8a76a128030322c8c2a6a8a618a318f65bb4f90dc9438999e23c99f3dc6760", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981930, "uuid": "9ceed8fc-c524-4151-8499-47216095688e", "comment": "Malware payload (Mirai)", "value": "e998a4d0dc3ea38ed6e406f766b03e35106bb577", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981930, "uuid": "8f51f9ca-853d-49dc-a220-df917b42d18e", "comment": "Malware payload (Mirai)", "value": "6e0b4aa44adb7f30c4269524794e3a896ec01024a0f154c1cd3cc8041bf9facb52b5b1cfbf3bc1df8af9e6967fb84cb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981930, "uuid": "4eab6ab2-f97e-46b5-a7c6-d2972b6503ef", "value": "T17704F842EA43DFB3E55310F202B787310E71E97A6C66D542E3BCBCB4A9615D1A60A37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981930, "uuid": "0e2626e0-7d95-4997-a39b-318ab2ad5352", "value": "3072:nfmM6+Sg5eOESSvk4sOmdc6AIFX3PElOxi32KpzyPN7GE/MlpGe:nxx5eOBLgIFhA32OuFT/iGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781981930, "uuid": "166bdc25-1ec6-4e99-acb8-3bddb1d489df", "value": 188900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781981930, "uuid": "e2b30b55-ef57-4e67-a703-a92f6e663236", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981930, "uuid": "54dc4d8a-6fd3-455e-8f4a-3e1bc4ed4803", "value": "bin.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "871ebde8-6cfd-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1781997157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781997157, "uuid": "e4953e15-261e-4aa4-8702-57d80e67113e", "comment": "Malware payload", "value": "484415eb4cc7b82d41a7770a95009333", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781997157, "uuid": "f36d78ec-f699-459c-9a69-9c9bed437f01", "comment": "Malware payload", "value": "7da9537a0c584918693d4724fddd8c2a7ce0e8a440ffb4d3046831fad23a1192", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781997157, "uuid": "d5a35279-dff1-43df-ba8e-e12a003f410e", "comment": "Malware payload", "value": "cceb98d9c75a6b13736705883a2a311d1ee7b41f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781997157, "uuid": "874d3ce5-3dc5-4584-aabf-29c8f661f759", "comment": "Malware payload", "value": "0480945b72ba60a1bbfb28b3c80f2a32aeb47238b8a81911a6ec83414a931fecbd903c53432212e1c3e5d0d3b8106aff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781997157, "uuid": "f072e630-7760-414d-9cbf-0a9f589238e3", "value": "T1EC08335D082DC842C47F97FA7B5234A9D201DA2B2EB4D43E2F0A57E874D5E6210F992F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781997157, "uuid": "3f8fed21-5bd0-4318-b1bb-c58a4a809152", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781997157, "uuid": "3b0db732-496c-4dbb-b7e2-5ef1406798c2", "value": "1572864:ut9IKPEYxFEARWYBJImKljUoEkB9dNDsMLXgiMZrIuEtKNwZSE7:uUKXx+ARWqImKljUvOhLXMxIufDE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781997157, "uuid": "f1fb7512-6cac-421a-a4ec-e91fdea9303c", "value": 77586543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781997157, "uuid": "317b2ea7-b4bf-4eca-a1e7-1416bd100a05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781997157, "uuid": "2304c1f0-be95-42f1-8bf9-edc5aca4d907", "value": "Zombie_Island_Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd59a32-6cc1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781971590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781971590, "uuid": "9a84a4d5-d9ce-4c7b-8187-d042f1075a14", "comment": "Malware payload", "value": "998bf854d2bd74133c4c8834111ea35c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781971590, "uuid": "d8c4dea6-3c29-4cf5-9430-a62dcb7ce52b", "comment": "Malware payload", "value": "7e94637b5fee7aa4fae48b6025d4ac02a02bcd0dd077c15fa3445a0a26f3c511", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781971590, "uuid": "6e496eba-cd7a-4ca6-91ed-279a8ca13d49", "comment": "Malware payload", "value": "fe254343ae003240161efbac57d4c84a7313a829", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781971590, "uuid": "fbae31c7-71aa-4a68-a691-a53ac2c3cbac", "comment": "Malware payload", "value": "68b0d388b94c184cbab7e394b02ed43b28b434cf14e8fbb85430b152712db5dc684c199dac4066c9fb1fc900f6f8f324", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781971590, "uuid": "c83a0612-3863-41a8-bf31-09800199695c", "value": "T113329651FD32A530262D80F5AACA2500F14B513B0A1C7905B1BF9664BF3CBAC61FD6FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781971590, "uuid": "887427da-843b-41d2-be98-b1774ca7a3b7", "value": "192:Ys/MEhrlqT/QKZPVmhxZPKgjlhtVZDmh5RDKlE3O+SUmlT0P3V6JG8zWJmH76N2x:xlGS1LBYRQEZT384BpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781971590, "uuid": "d0d0fb78-a0b3-4567-9e0e-0e40659423f7", "value": 11966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781971590, "uuid": "2e5f831a-684e-4e9a-94b1-739f12ba9ce0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781971590, "uuid": "7599fc55-1cfd-4b1c-b708-74219b9f7bfe", "value": "init.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde9632c-6c3f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781915698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915698, "uuid": "b5f4b6f3-cc08-410e-8025-9d36e11a5584", "comment": "Malware payload (Mirai)", "value": "4decff27c3be862d90068a3fc9320135", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915698, "uuid": "54590184-baab-43d3-808b-d8d6865f7420", "comment": "Malware payload (Mirai)", "value": "7ee89ef66685f1bfeb95c5d24086989f24fa714b57a55545c61924c8b5773a38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915698, "uuid": "a48e72db-36c3-4e99-b9cf-ec3be7a645b0", "comment": "Malware payload (Mirai)", "value": "ccebed8d57463857b23d1d95d0b6e9513caab1d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915698, "uuid": "3b716058-fe29-4bfb-9fb2-deef5ab2fe31", "comment": "Malware payload (Mirai)", "value": "d78ce4323ff8499bf03756d0cf610778ae3a3bc167f935360f5b913b2299276ce08ff8ddc9482ca84078947f328bd8bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915698, "uuid": "70fdb14a-961e-43d8-8d4a-68054c2bb7ca", "value": "T1FA331B95BC819A17CAC15277FF0E43897B26239CE2EE730399196F61338B96B0977111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915698, "uuid": "f3a8735d-7540-43ec-afe1-477b42480c52", "value": "768:SZk0xSOSiOYVdERxkW64OY9LGQJiykDMWTRNiTcxGeer1U48wa+KIEn:ykwSHtoi9r1GQA6W1eGG9r2b+KRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781915698, "uuid": "afd434e5-87d7-499b-b24e-84dff248c8c7", "value": 50948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781915698, "uuid": "06071d5d-fe40-46ba-bf61-5c0c509209af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915698, "uuid": "29c4f8d6-06be-49f7-8bcb-aea4951274f9", "value": "godisdead.5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a16c14-6cda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781981914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981914, "uuid": "5f3ae1e5-6fd3-437f-9ea3-722d22dc43eb", "comment": "Malware payload (Mirai)", "value": "4c4bfa3ebe8cf3ae2cdf14de8210042b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981914, "uuid": "d91bad80-ef1c-4c63-86da-4dee454680b7", "comment": "Malware payload (Mirai)", "value": "7f191f196150cd89d2b8bf6166166304c5cfbde8b69732d58caedfa283ecc3c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981914, "uuid": "fbfbabd0-82e5-4064-b415-d3d70018b8ac", "comment": "Malware payload (Mirai)", "value": "d54a047c216febd6ba8fda7e0c4bdbf77c7d7dd2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981914, "uuid": "53b53efc-0008-4f60-b18c-8434511046b5", "comment": "Malware payload (Mirai)", "value": "89dbb4dbafee18c949388b63906602035c0b48b0a48ff74d821e041b95a9f5cf160ba399ed4127d8c205824e7b95f0cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981914, "uuid": "8111bf38-d6bd-4419-9b20-89962933bfea", "value": "T19524E947B991CF12C1C111FEFE5E418D37136FB8D2DA72029D24AFA477868EA0E7A116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981914, "uuid": "06bae734-526c-41b3-9411-7a646f987ef1", "value": "6144:xmMWDAzSf4sXLCloq+RaPiVv5L5FWe9bmhSjRr2:xYDd4sXGlgRaP8bWetmIjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781981914, "uuid": "a0294a62-4d79-4af3-8706-5d96fcb08534", "value": 221968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781981914, "uuid": "b7239d4c-d264-4f4e-8480-bd3f402eae57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981914, "uuid": "d1be2bae-42eb-4afa-94c4-2d923f8765c0", "value": "bin.armv4tl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4546792-6ce9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781988643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988643, "uuid": "7c543db8-c874-426c-9b68-719be74004ad", "comment": "Malware payload (Mirai)", "value": "c0f1ea9f8337212afac81bb51f9c82eb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988643, "uuid": "df8e4a6b-7d98-4cc1-a5ac-6b8915dc9ba0", "comment": "Malware payload (Mirai)", "value": "7f5f2aaa392cd5770e6c2dff7d390e15c3e6c774886408e4cfb8b0b65cb31c32", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988643, "uuid": "744181e8-d093-44c1-9946-d63a3568baea", "comment": "Malware payload (Mirai)", "value": "b0877f743594ebff558a254ef149f23f55064426", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988643, "uuid": "f35dcdee-9195-4062-aa66-c76210269bcf", "comment": "Malware payload (Mirai)", "value": "4b3a129a3d1bbc06ec867fdd7159f597fd2cda7df119bdd6e3efcae1b60dcbd24f81ebe93b0f0543b11ae14c37687934", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988643, "uuid": "42f4f178-7f66-4a56-829b-fce206b419f2", "value": "T120533A41BC819617C6D022BBFB6E028D372663A8D2EF3303DE265F11778696B0E77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988643, "uuid": "207581cd-802d-4073-84a8-324e98cb5b62", "value": "1536:97fKQz+kCMLGNM81ysx9SuX2AwHMlml9KahRR:97Lz+Vysx9SuFll1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781988643, "uuid": "eb1a8f14-5a3f-48aa-add8-e4695984fbb0", "value": 62904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781988643, "uuid": "d5deacde-83ed-40a0-af71-462e7daec5df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988643, "uuid": "e24865ee-a310-4101-aeb7-92974c901a42", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e791104b-6c98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781953940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953940, "uuid": "79813d3b-8418-4fd8-9209-f7cda6eb2f7c", "comment": "Malware payload", "value": "2b9747c1655337738c7fd6ebfbb066e8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953940, "uuid": "99d51ef0-84fe-4e3d-a8d4-ce14cedee404", "comment": "Malware payload", "value": "7fe76ccceaec33d07e90e96ac144be83ed622c8af8b134d7429020e476cf4716", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953940, "uuid": "0ddd7ea2-409e-431f-b888-13d71251a2de", "comment": "Malware payload", "value": "53fe3ff374836f5d32314aae77d588f252116e19", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953940, "uuid": "93b8d893-2f39-4693-b171-7d54fe9a4279", "comment": "Malware payload", "value": "e382afd40186a60b33cdf2dcf6acca96f428a7e286617f0e5a051062be920622c6b526971ec170cf3c3d3d0f2ece40b0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953940, "uuid": "b7f0b7e3-0150-49a1-b734-d9be7cdc746f", "value": "T1D0E10DA3A22B9DF2F2381BBE8283979561FD773406E20A490A1805094091D2978B5F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953940, "uuid": "47e354b1-c0e0-40c7-b3d0-3803e8f69810", "value": "c2d02fc98f1d75d7b9457468ec75da0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953940, "uuid": "b90a0637-11b9-47d2-a922-ab6bf1dca756", "value": "24:ev1GSkiiljEowSXUIWMyt8XZh9h9ClfAa+VGEijup+:qkfj2mxPy6XZh9hMlJuijb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781953940, "uuid": "8a3216be-aca8-49c9-991c-ac1b893fc8bf", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781953940, "uuid": "2473bcfa-dfda-4fe6-85f3-03f3ffd1e8cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953940, "uuid": "54657d11-995a-4660-82d8-a310a0d13a68", "value": "7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "019aa899-6caa-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1781961285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961285, "uuid": "13f13c25-8f6c-4491-81f3-9c0426fb3a78", "comment": "Malware payload (SalatStealer)", "value": "ccdc1f893f3e7bd91ac4dd77a1ddc377", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961285, "uuid": "64c1aae6-b62c-466f-bd5d-f2f0ef954cd9", "comment": "Malware payload (SalatStealer)", "value": "7ffea08c03e9c49def06aab41881b65596e26bba26ca30f2cc26640e892d38ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961285, "uuid": "97ed54dd-5c43-4e86-a2f8-c8e881cfc361", "comment": "Malware payload (SalatStealer)", "value": "7d553a1a6d7cdc7a177665644b11ccfa34cd4b30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961285, "uuid": "fc29370b-02b2-48d5-be11-994ff19a4823", "comment": "Malware payload (SalatStealer)", "value": "c2656f69ea03d8039a041684993a0664db90a90d4123fbb208c708f645955d2e103d41981f86ebc3e126a0bef3b9c0e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961285, "uuid": "d9f842c3-a2f3-4668-9d04-9e87f9fa6a08", "value": "T1FBC66B11FADB95F1E903583141ABB37F23315D048B28DB9BEB547B2AF87B6A10C66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961285, "uuid": "7530fca7-536f-4f85-b391-45eee8618c15", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961285, "uuid": "c9ba6291-4102-44a6-b597-338b54727a52", "value": "98304:29Ww51DFthCbKxo4Ez5xkOaBP4SG2Z1LEb:65l0K+n5xkx1/yb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781961285, "uuid": "80d8246b-f580-46c2-beea-b52ca4d60c20", "value": 12574208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781961285, "uuid": "03c17074-7bcc-4b0e-9432-f7f4992c1dac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961285, "uuid": "cf9d7e5d-0ba4-4e06-9321-982efa133e80", "value": "Unicore.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b488241f-6ce9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781988643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988643, "uuid": "97522f20-4dee-41ba-82cb-8a32e2e7a82c", "comment": "Malware payload (Mirai)", "value": "57a830b11f9d1d7e3f6a4c3b33001931", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988643, "uuid": "4faa7c1f-1526-4242-abd3-991722586739", "comment": "Malware payload (Mirai)", "value": "81ae285ab750dfbd504bea7e8f44e10b7e44dc634ace7dda017bb2de7ff2bd2a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988643, "uuid": "014f399b-63ed-4b4d-bb4b-3322521c1757", "comment": "Malware payload (Mirai)", "value": "7756e0dcfbbdbefd74ab7cb60ca5a6d591948ad8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988643, "uuid": "d90c35f0-f234-4e72-86bc-2f9e7b219d3e", "comment": "Malware payload (Mirai)", "value": "63fdb128601bc7c646dfe1f4db29b58ff61d3f20234e87d77d50c79b019552f831693fd59f786fcacb0a8b4517c68f2a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988643, "uuid": "4494d684-544e-4dfa-99ae-dbf6b995a605", "value": "T1DF633AD7F800DDBDF80BE77B44570509B271A79101830F3A6797B963AC721A91867F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988643, "uuid": "54b1f659-d523-463b-9524-0ef2d668a32c", "value": "1536:0xOFzRJ94kegqXZqoi8Si7KEFV5lQToeBPH4VRSnguf:0wpxzqXZqo+5y5mToKTguf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781988643, "uuid": "c91236b1-d451-415d-af88-3c72da129dcb", "value": 68264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781988643, "uuid": "cd09afb5-78c2-4663-b91a-9fd01d380fb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988643, "uuid": "d35b3016-0c0e-4f06-9b2c-28f0674651c3", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eeba95c-6c51-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781923109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781923109, "uuid": "cf7f6a55-2ad5-450f-83fc-4a537545d68c", "comment": "Malware payload (Mirai)", "value": "672108a98a4c503add24ff675ff5fc8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781923109, "uuid": "c45c4337-f2cf-4356-acc6-820dc9dd2ef0", "comment": "Malware payload (Mirai)", "value": "822fdd81134ec40c7da9cd5f2502f07236952a460ee8492cc30e4728de3e0733", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781923109, "uuid": "6dcee63c-3b27-4d4b-abba-9d4f35b5a1ec", "comment": "Malware payload (Mirai)", "value": "d769dad85f76c119b99642d912a53500f3463c80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781923109, "uuid": "3bd441d7-cca8-49e7-9950-55f0d9bb3e16", "comment": "Malware payload (Mirai)", "value": "d9d7fb1d39772d89a755b623ceff427a32c39a258e45b8c0d7a152ddfd76388f66ea493690c14845df66d1b8a8af6316", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781923109, "uuid": "6b8845c9-21e9-406c-a6d4-69f6cbbed902", "value": "T181F38EC1F743D4F5E91B42B020A7F7368B72E439102BFE46D769AD36AC52A01951B3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781923109, "uuid": "17f6fdbf-05b7-4f43-9688-3eee22895115", "value": "3072:vhXlyRIC6GUUt3GnzxD4iaG+e0rvYlPh4zPL7fk3yBHdvMQUGYzv4n:pXlyRIPGUUtWND48+ewvYZh4h5lMQmwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781923109, "uuid": "30380e62-a042-4494-b7dc-d142414c66c9", "value": 164456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781923109, "uuid": "6fd9e57c-f2e6-4829-865e-d5cdcc1f6192", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781923109, "uuid": "e0feb529-8b29-4f9f-bf7b-4406da86d449", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9d0ac7-6c6c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781934757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781934757, "uuid": "a8cc6ede-7cf3-4e33-9c6d-b4f550d098a7", "comment": "Malware payload", "value": "a8ba4a439dc90c8851ab2236a03eff0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781934757, "uuid": "b3ad8ba1-36ef-483b-bfc4-e064c54c13b6", "comment": "Malware payload", "value": "8253ac8b47e87a05c203f6ba97f81dcd7026ae207363602f8cea217b5835dbff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781934757, "uuid": "490fbd5e-e5d5-46f9-895c-ca7459c0872f", "comment": "Malware payload", "value": "cdd73aacd75697ed1ddae20fc904e53c4bf8ebf5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781934757, "uuid": "fb7f3d7f-9cbe-4a30-b127-6a9f529b5ca6", "comment": "Malware payload", "value": "1d0507315cb2c3a18914885057e8333ed998e28c1b17d2a441e91de315e7d53727efb10dd106482f478004d36a6233ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781934757, "uuid": "821c7f6e-a641-4476-a34f-83119cc8ce7e", "value": "T1FEA5AE17A55D29B7FBCEF17CCD8EC5F1B123756903A880963812960DF2C2AE14A79F21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781934757, "uuid": "20cc0023-f845-4a20-8640-a82932a7baac", "value": "24576:o5uxAGyeUtysIDcF/ZXjjnxZk6OZNWtoh6MDEjyzsPFM9VIH06iyhEEN31b:o5uuV1Hz/d8V+KIU6ig31b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781934757, "uuid": "54103458-eb8e-4a91-b25a-f022900e729e", "value": 2232864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781934757, "uuid": "b527187c-45db-4e73-b833-0a59808a1343", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781934757, "uuid": "82cc21a0-2eac-4c55-bc9e-6785ca3804e8", "value": "cliaarch", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b22adc0-6c5b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781927558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927558, "uuid": "beb0c738-0718-4864-a698-515cc09a9b84", "comment": "Malware payload (Mirai)", "value": "b7e42ecb15b5a4553b3ceb96abfa49ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927558, "uuid": "c898f4e4-b169-438a-9eb9-1455aaac6fa2", "comment": "Malware payload (Mirai)", "value": "8262483247ba4362859d36a27320fe149f5af40198faa61b4eb9d1e84b710814", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927558, "uuid": "4810ee9d-9921-4790-b2f0-12aaee90eeba", "comment": "Malware payload (Mirai)", "value": "9c379d80dad0b86dca38f8a4697d561ebe31e190", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927558, "uuid": "3cbcb3cb-055b-4915-9bad-117161303a4a", "comment": "Malware payload (Mirai)", "value": "7de3ba44a897baf0b55c8672f33169974993ff8fd4100761c4f1f0b88a5d2a6d523af991bb22724d31096b25786d674d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781927558, "uuid": "21eda5b0-a41f-40da-a89a-63634eafabe1", "value": "T109243B45BD919E13C6D522BBFA5E428C372A13B8D2EE7103CD225F21378A96F0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781927558, "uuid": "e31e9ea1-2508-4301-9fb9-d25e13f9ebe0", "value": "6144:2KuvWe5Nc7um312KCvzhx4cD/bhHWNB2a:tu+KNc7um31UNx4sdVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781927558, "uuid": "3025ef8e-c92a-4449-bcdf-15b1c3ab4117", "value": 214336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781927558, "uuid": "ad821802-8ea7-4171-a815-3ed43705a636", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781927558, "uuid": "d1f83e93-45f1-4972-a076-d1adcc4c31a8", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dca8c84-6c5b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781927536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927536, "uuid": "64cba569-2178-4e58-af75-7eb39441fc52", "comment": "Malware payload (Mirai)", "value": "45dbc7bf8abaf0e546954e764e579626", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927536, "uuid": "cbba4e7d-262f-4c2e-97a4-1055575ab54f", "comment": "Malware payload (Mirai)", "value": "826a786afce30c67495d60799ae38d1604bea4732476253a3aab81e1dd5d44f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927536, "uuid": "82a13a4c-bffd-47be-8969-0eb224ea2da4", "comment": "Malware payload (Mirai)", "value": "513a50347d4baf0ad02d3b0bcf7e5f23acc680c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927536, "uuid": "e6f49c8a-06f0-49f7-98ae-6742c134f6f4", "comment": "Malware payload (Mirai)", "value": "b9ee59265b1765b5216c6d4ec5fa2916557ee918cae83830b030cee620516cd00ffd4611b0cfb0c97ff8d6b93b7656ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781927536, "uuid": "93c213d4-fa15-467c-be40-4b7f45183d53", "value": "T1988302B45647FC92C9B55A79FCACCF13E3C3065CE2833165D1609A843287D0B8AE85DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781927536, "uuid": "d7b20103-6ac1-49a6-8252-493b080de821", "value": "1536:FRr242mqkbJMni2gxbwU0JfF0aNoWRejsrSNezd:FRCZOJhZmJfqMK+nx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781927536, "uuid": "0d4d18f6-8b41-4fd2-9563-e1ef76f44997", "value": 80984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781927536, "uuid": "124e2620-6f26-4ebe-8b7f-cd95fcd3915a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781927536, "uuid": "bf15bfdf-11f8-453d-a2f4-ce992410834b", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b63303fe-6c45-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1781918209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781918209, "uuid": "63cadd74-3945-40ae-9b45-542e040c6b66", "comment": "Malware payload (WannaCry)", "value": "e80c4a3ceb6417d7194183326d498ea5", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781918209, "uuid": "0e605add-4b45-4775-bbff-49266418efeb", "comment": "Malware payload (WannaCry)", "value": "8408c932e1f5f49509bdb4a3d27b358de7309a660a4fa01841dbf0f2d1b4bf40", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781918209, "uuid": "02d0008b-643a-4913-8b07-1fc03a5bb688", "comment": "Malware payload (WannaCry)", "value": "d9c52e67f65c25c3933ca39fee55d0797b3c2c9d", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781918209, "uuid": "50993778-1d3d-43e3-9bc8-2c62b006e634", "comment": "Malware payload (WannaCry)", "value": "affd32277dd37ac24cf876d216796f890f4ad1ee4cf3894f788c0383513395507447631946732fc3132565fbfa3c4054", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781918209, "uuid": "9a4587c3-c7ba-45d1-863a-c5d42904e33f", "value": "T1B5363358726CA1BCE0450AB844B38D1AF7B33C5967BA4B0F978087AB0D53B97AFD4741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781918209, "uuid": "630948b6-8a20-451d-8f8d-40964c182772", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781918209, "uuid": "4651f814-5e3b-4e5d-9827-63a480ef07d6", "value": "98304:DkDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H0:DkDqPe1Cxcxk3ZAEUadzR8yc4H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781918209, "uuid": "e8bd6e4a-f7c2-4109-9a86-87103821a37c", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781918209, "uuid": "8662143b-f254-4501-8491-0a21eb70e324", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781918209, "uuid": "867a393f-8a5b-4918-a28a-06ef01e65b3c", "value": "8408c932e1f5f49509bdb4a3d27b358de7309a660a4fa01841dbf0f2d1b4bf40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ed004ac-6c50-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781922679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922679, "uuid": "eee732da-d712-4231-adfc-5c8c53267b11", "comment": "Malware payload (Mirai)", "value": "8f9db7d54f8a9f28c5529fb613266f3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922679, "uuid": "e856bd25-cf26-49ca-8528-6c3cd814881d", "comment": "Malware payload (Mirai)", "value": "84407f9deea07e1447a8e09129ff79adf4bc19fbbe8f4ca911dceabef7552e61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922679, "uuid": "11f4e7e8-9880-4292-b66f-19f77c4ec9a5", "comment": "Malware payload (Mirai)", "value": "663db51c4132cdc9e68464bb900215b88a8703b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922679, "uuid": "88563656-6a77-461a-928c-c502b203b0dd", "comment": "Malware payload (Mirai)", "value": "e9531d2718c8dc21bc3bf043d0a892907826feab76e55673306bda835faa2ef52ec5e29449cc04c95411980d5b66c871", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922679, "uuid": "7ab02700-bbcd-4682-9dd1-a5a4bcdac3b7", "value": "T10A830251D6801A55F673ABB3EB94DAB4DD20139A77020D212091CF95D3BA5837C18FAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922679, "uuid": "b4ad7bae-48c5-411d-84dc-baaddd99d1fd", "value": "1536:o1YjVWn1B48eQNI7n3wj1ql2xm/wIoOfcCt0XW0pk7J488gU54u+qgw095:gYjEnT4fn3AWIVDAcCNt4/R54u+qgws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781922679, "uuid": "1aa5c116-a0b0-45ac-96a7-9feeb7b98a77", "value": 81116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781922679, "uuid": "dc6a917f-493b-48e7-8f8c-01c3a5e758fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922679, "uuid": "5ca69126-b15b-4c57-a22b-15e2012ac420", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75baedba-6c70-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781936569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781936569, "uuid": "f3522abc-a1ca-489b-9170-2a71b8c63339", "comment": "Malware payload", "value": "14edeab59ff33c77eb4572ad20ee1748", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781936569, "uuid": "9b358eb6-ca1e-421a-ba1f-d6bcada3df52", "comment": "Malware payload", "value": "84fd276f367261305680ac86fb00c14946604fdb5ca4c22401395b5694110496", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781936569, "uuid": "3e3e36d3-aed4-4df3-b3db-b26ab9e5a08e", "comment": "Malware payload", "value": "802136054fc1b007ca4c88075f0208816cfcbd30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781936569, "uuid": "13c5c98c-cb9b-4756-b99b-b48b57c837a9", "comment": "Malware payload", "value": "c3ad91dc2ac5897b89c662eda50bcf2b1f43c1fe1ed4b72faad4fc0791ff091f99d96227fbcb23d3076e06b0df8f01dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781936569, "uuid": "a422f8c7-8526-4b2b-8ca9-e31005b186a1", "value": "T18CF64A87E8E21DD4C4AA8170D12A825BBAB17C491B3D23DB16A1F3301F37BE45E76761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781936569, "uuid": "38fe3f53-cbd1-44ed-afde-9c9c09c84884", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781936569, "uuid": "40ab683d-8d58-4429-83c5-8fa1512a4e17", "value": "98304:AgUwL5iURF8sEkzHtEgxOQH5BHgyD0FLRDM/2O7bdAS7KwKlVJVyJc:AzsZztE63J0FLRw/lxAS7lKN8Jc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781936569, "uuid": "e2dc1265-c6bf-4e27-8049-cd6670b5695b", "value": 16736051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781936569, "uuid": "06670889-1351-4ad3-a432-6c176c363345", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781936569, "uuid": "fcba60a6-2baf-4f1e-a0c0-b36bd7ea5634", "value": "14edeab59ff33c77eb4572ad20ee1748.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb349392-6c97-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781953436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953436, "uuid": "ae445d4f-1334-4f9e-bf7e-d36273d91ba0", "comment": "Malware payload", "value": "255a48a08af7ec78798ff0d1048da8a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953436, "uuid": "5d0766a7-afe0-4087-b26a-e5b1e66a768d", "comment": "Malware payload", "value": "8585383d2f5a3a8ea036a9e33a41ef933497b47632a69ab7cca3e2502dc90fd3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953436, "uuid": "44a426eb-a783-47c1-ab74-f432c7a1ce79", "comment": "Malware payload", "value": "931fd3fc6da46defd413ffe8eacd3f2b6b5f32cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953436, "uuid": "42384483-f720-44ab-b94b-391af26cc970", "comment": "Malware payload", "value": "d08e369ae1d2971181ba4958bf6b7749522deba0b5dfa16c12aa100a4ae8370ec2f780e6c506b61876c27300aabf5360", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953436, "uuid": "42ab1fc0-6e98-4fcf-bfaa-09023112afea", "value": "T1BE41CE2EF3578DDFD06642FD055EB207F401746A85331527623AACAA0D7B3E092D7789", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953436, "uuid": "93de9c42-8a41-48d8-bb7c-2721904d7236", "value": "48:UpSpe2vSCB37pNbiFtz6dKINdBZx8CIrZUUUiNqv:UEqCB37pNbstz6dKINdBB7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781953436, "uuid": "2110dbcb-fa23-4edb-beae-9b7bb944dfd1", "value": 2064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781953436, "uuid": "257c415f-4521-4be0-a1f7-92763e5abfca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953436, "uuid": "bc14d4a8-57e7-4e82-b7db-eb527a56a106", "value": "dlr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32450af-6c6d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781935464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935464, "uuid": "732b9792-a1a0-45d4-aa7c-2462bbede878", "comment": "Malware payload", "value": "64044409df6e38e11086776da181b19b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935464, "uuid": "44f5ea49-1025-4bcd-9d78-3e3ff526a5c5", "comment": "Malware payload", "value": "85d3344475715bffb0f82b461c7a9b8b8cc0c031bd4a604b87c4dc8a3d558a7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935464, "uuid": "adcd3516-967c-480e-ae76-338e42303ce6", "comment": "Malware payload", "value": "fd52b8644aaf73b0a035d7ae72b9606ce69ad780", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935464, "uuid": "817b59b2-4860-4036-aa5c-9dc46d024895", "comment": "Malware payload", "value": "9bf4a86e121cbb30739c0a3b823e5edfbda39de770ddceed6cf7f8aea20944f0be3fc30c0d7f4894ed55b16c56995709", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935464, "uuid": "616d4ca1-4dd0-4491-9e4f-633fb8ad2245", "value": "T132A4E149F2463D83D4D7E935188BC6C04A59E56B23F393453A07A4BF386A7734F2934A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935464, "uuid": "1b722279-b8e0-4b8e-a075-9aa2f5fb6811", "value": "12288:okJz1gfDJFM78cLL8GluLbrSjhExXE1gpFmbHoN:oG6DJFM78cMG4LbrgLzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781935464, "uuid": "74023d9a-ed86-44b8-aff0-3abbf10522e3", "value": 456004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781935464, "uuid": "b332ae81-d5bc-4ad1-b3ff-04f3dbffbc09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935464, "uuid": "6dfdd634-56bf-457d-956c-7f43b87e8759", "value": "bot_armv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4ecb41-6cbe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781970000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781970000, "uuid": "d7948008-04f0-4dd0-98a8-b038b09f2622", "comment": "Malware payload (Mirai)", "value": "55d3a21eb52309f67d0fa7f1f75746de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781970000, "uuid": "81f9b8ef-aa46-4ed2-ad07-1e6bb457980b", "comment": "Malware payload (Mirai)", "value": "863e44292c98b19060a7cbce0603e514a70295a02a0318097fae341d2aca7846", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781970000, "uuid": "ae3fec07-4971-41a8-bf6d-d5d3b4efeb98", "comment": "Malware payload (Mirai)", "value": "f8386d6249d98ba3873765f64bbdea2d5286966b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781970000, "uuid": "001693d9-cd7e-47ff-ba90-8d58ecda866f", "comment": "Malware payload (Mirai)", "value": "9df84eae46e94ac858c5c79c953eec5756751459e068c6fa1dadc71605a7bc52af2eaf2ab284ddd27ac041a310c62b92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781970000, "uuid": "095de856-11a6-4ede-9012-c592e135d864", "value": "T1D8242324939FF43062104BF6E8114352F689DE28A54584B71DA1F82A5C6E5BFEAFF343", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781970000, "uuid": "296ce9df-2756-4b89-902e-0a32457a2137", "value": "3072:Xbbf6UVnS4fcR5NivEc8JmkbIV1AwOhnlkuNmLUdOd8auwGg6N1rceWPZVQO4:Xff/NcMvz2vhhnKUdObObXgeys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781970000, "uuid": "d3eea9cd-6ce8-4a1e-9275-47ba0266fd41", "value": 226616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781970000, "uuid": "0f1d6bdb-7816-4199-aec1-ffce6d691e96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781970000, "uuid": "ca6feba1-471d-400f-88e8-e7d356a0db99", "value": "barm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e4d3fd-6cd4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781979485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781979485, "uuid": "241c3e3f-b017-43f3-992f-92235ec8c732", "comment": "Malware payload (Mirai)", "value": "b4a8b4dbc3f8d4a41a76d4d35df628f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781979485, "uuid": "abe3c416-6631-499d-87ec-3779d195ad6b", "comment": "Malware payload (Mirai)", "value": "86b43917db066e1833b6f0a01e53f27906d78385e8b761c47cdc6a72cfbf597e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781979485, "uuid": "54c41699-f2e0-41b5-8d1d-d1182817a2cd", "comment": "Malware payload (Mirai)", "value": "33177b3ebc477fa4149218a23d9e5936ab5193f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781979485, "uuid": "1da8c211-555c-4248-b3fb-7ee6b51ac978", "comment": "Malware payload (Mirai)", "value": "48b719715647e40275a32fba10c6946fbb788439b619d9a8a1beffe413ec6eec604965bda0c2f1eb4091fbac8a8c7a50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781979485, "uuid": "9ce31110-1f94-4bf8-9808-fc777b36b8f0", "value": "T1E1433A42731C0A4BC1A35EB02A3F13E093FFE99021E4F685651F9B4A96B1E365586FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781979485, "uuid": "9b09ff9a-cc3a-4735-961f-a0a3a82e5296", "value": "1536:jm1qiIYkATkiEmZ/yRhdvAwIIIUmBqcUM:awdATImwawIAm4cUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781979485, "uuid": "1eaef8d5-9579-4719-b6e8-bc89f4192861", "value": 60564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781979485, "uuid": "b55ee5b9-3bab-4ab6-b653-6f4a8a01729b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781979485, "uuid": "789b1f8e-3b01-4dc3-ae9f-ce8fa9b61451", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f09a3a1-6cda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781981923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981923, "uuid": "e471ba14-b8f3-4562-90e1-e221a927193a", "comment": "Malware payload (Mirai)", "value": "a735f5eeba5ceab07967966861332698", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981923, "uuid": "92f47d2e-3ea4-4d33-b8d3-fab9f5aa7d51", "comment": "Malware payload (Mirai)", "value": "8797ddcc018291354d75d56ba44b6dcdef8d8e4b593dd92a859d63200248bb76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981923, "uuid": "b05195dd-9ee1-4882-accd-cc6e0deb01e1", "comment": "Malware payload (Mirai)", "value": "b77c8c2856b8cd1969e26f2982402eb1ad019a93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981923, "uuid": "6bf05449-148e-4251-80e4-f5fb374e62c1", "comment": "Malware payload (Mirai)", "value": "27a6fb71e6d1112f5c72497ac5c3476862a6e3c100414af5798023f5058f62b24524118b041c0572b964ba3f54066e84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981923, "uuid": "05267f01-526f-423a-b634-d08255fa5476", "value": "T12B14F74AB9919F11D5D231FEFA9F419833136BA8D7FA7101DD206F6033C699B0B7A212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981923, "uuid": "fd852c68-00fa-4415-b3af-9c0af8e30cb4", "value": "6144:1YL5UvebhOc88zc/vCcSaU/MvNL1QH0hP14iWXj06i:1YLWedONqc/vCZaUcNL1QHGeiWXj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781981923, "uuid": "9c828926-8ee0-4c8f-96c4-2955ae7f90f4", "value": 201416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781981923, "uuid": "fd8563cb-26c0-4df3-85df-b2ae05aeec2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981923, "uuid": "804bc01c-d1ee-420b-bc74-37bde1c773bb", "value": "bin.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962dcb93-6c3f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781915578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915578, "uuid": "58635125-ee13-49fc-9a71-18af8a9c2c8c", "comment": "Malware payload (Mirai)", "value": "a2dc4e17b0ff42e687ad449e9e64ff8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915578, "uuid": "e67b0924-4873-4ad1-8e12-8d6e0287fdd1", "comment": "Malware payload (Mirai)", "value": "8848dc31c6c08faf0617aa0f915e9e3833857a29a1fe0126d978b45f6c0ed1f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915578, "uuid": "7a892a44-3199-49ab-886e-8e9bca0f7444", "comment": "Malware payload (Mirai)", "value": "b698e18cbeab01a05344bf844024041da738acbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915578, "uuid": "2a096634-a25f-4836-b23a-6ba6147f8e4a", "comment": "Malware payload (Mirai)", "value": "d6aa725702642ee2d5f5ce9c8ec3ad8b9803af8771501fe952afdd9de3a0b38bf72a1cb09fadb9b49a8772222631482f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915578, "uuid": "2c5b6936-0f89-4b42-a46c-d14045a056b3", "value": "T11F136BC5EA82D0F1FC9601B31037A7629B76E5391138EF52CB6E5534ED13A50A72B3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915578, "uuid": "2ef0e70c-d186-43c1-b8d2-511665f58dd8", "value": "768:wesX59OtaZ3tvPLV7flX+ZF/PhwPVUs/QXlegT48RZ1SK0IU:w99dvPLB98wusoVtT5Z1SK0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781915578, "uuid": "262af8aa-5a54-4e15-bd9a-613a543012dd", "value": 42668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781915578, "uuid": "75e32668-4e34-45b0-b772-0cbea757a263", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915578, "uuid": "e5ee1f4f-2531-48f2-9107-dd184bf64c11", "value": "godisdead.1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dba755af-6c3f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781915694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915694, "uuid": "81a5e22d-9e86-4e63-8a74-ec9796c4ad1c", "comment": "Malware payload (Mirai)", "value": "efa6aa16cb271350b59b16f1706c4ecd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915694, "uuid": "7b39917c-4bf5-42b6-a3c3-4ea60bda1934", "comment": "Malware payload (Mirai)", "value": "889c9ae1ab2208fca436eeaa6790363b805a6da3fcf979daa85c269240cba02b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915694, "uuid": "ff70dc89-d9fa-4da9-9421-675171c30848", "comment": "Malware payload (Mirai)", "value": "cd9877a2bc2604afae557e44f919cf099f30c268", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915694, "uuid": "55ad7332-69c4-4d0f-a81c-c020e37d00ef", "comment": "Malware payload (Mirai)", "value": "890e965f6dcd6e60c34aaefdd30ebb846384aa9388d94d9f974bb53bb3040c5a2115e7546e96a5e25b08eae3bc6ec74c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915694, "uuid": "67d062a0-11f1-494b-bc86-bbbd2e3a6e53", "value": "T197234C132590C0BCC8AFC1745B7FA92BEA33B07E1235B65923D4BD277E9ED221E1A144", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915694, "uuid": "168f006f-e969-4649-881b-9874c19fb285", "value": "768:5OziGENJlpjCkZs1GaTX7QX433n0lKVt3XNX7aOeAWeHQ3/kSvEIg:+UNLpjCkq1GaT704UlKfNLaOeAFSvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781915694, "uuid": "164baf66-f445-4ab0-b25e-aad50cf54800", "value": 48208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781915694, "uuid": "282b7979-ac12-4f64-ac8a-4d404f010759", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915694, "uuid": "c2889251-b0d3-4ee1-a9d3-afa752b5ec59", "value": "godisdead.13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08c8d4f-6cad-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1781962974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962974, "uuid": "d1091dde-dd52-4ead-b43f-f8b5dd19f48e", "comment": "Malware payload (njrat)", "value": "f72f667fac878f750e4b8d4d59643f26", "object_relation": "md5", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "raton", "colour": "#68B54F", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962974, "uuid": "0dfb721e-3a36-4b40-ab47-e3bb0fa4fc36", "comment": "Malware payload (njrat)", "value": "88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18", "object_relation": "sha256", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "raton", "colour": "#68B54F", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962974, "uuid": "277678ce-2280-4636-818f-7364d27a1e46", "comment": "Malware payload (njrat)", "value": "df5cc073aaec64c7998cca5e7561d1a423112f7b", "object_relation": "sha1", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "raton", "colour": "#68B54F", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962974, "uuid": "0c5a002b-e99b-4eb3-8086-744d36b8e01c", "comment": "Malware payload (njrat)", "value": "3c2d0b5da1249f07a1fb923c05d6c8ece42dd7a1d167b470eacdcca745f6543ac1510aa17124d51fd9f71279cebaf1c9", "object_relation": "sha3-384", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "raton", "colour": "#68B54F", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781962974, "uuid": "f6473fce-f6d2-4422-a32d-71b19fa62f06", "value": "T158D5121C33FACB18F2AF4BB4A87185664371FD179D62D76C58A139DE04B6F48AA10B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781962974, "uuid": "19295b77-8464-4840-a77e-79ddf7eed4e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781962974, "uuid": "8e0879ad-1743-49c0-b6e4-853b23aff2a4", "value": "49152:VgVUlsHjkmiGWU5FLGpMZ7iKPJ5W1tsclR0BxMzaRw486Wz:VgVUuHjkDGjzqpgmwQ1GuRxzew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781962974, "uuid": "a9bff129-ea1d-4b77-88d7-42c0283e7a00", "value": 2972672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781962974, "uuid": "fb7818ed-a98b-49f4-87bb-5e29b6d9b1ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781962974, "uuid": "5e069bba-6c24-4157-a95a-c5e60af89745", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e23edb25-6ca9-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1781961232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961232, "uuid": "efe64132-4c0c-4cd6-a78c-576064d41369", "comment": "Malware payload (SalatStealer)", "value": "cead56d13a90d65bc036283e71985c10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961232, "uuid": "607a4129-931d-449d-bb42-a3c6df88a843", "comment": "Malware payload (SalatStealer)", "value": "89a9dfb74bf31b40951bac672cd108db9c7c4cbdcf282d1f29e8049d3b4b47d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961232, "uuid": "0fa2bb1b-c1cb-45cf-8282-96f090645d5b", "comment": "Malware payload (SalatStealer)", "value": "c8e94b71624a15d3ac6661856c943e2c9f989da2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961232, "uuid": "26a89695-cad8-4d0c-a255-3c9dec3f1dc8", "comment": "Malware payload (SalatStealer)", "value": "39bc5f51d7dd4d79bbd495e612de7f258b4ba2f22636596a37c62cd09e239c7cb50909ec45b516dd3a2c3db0c5f7c4ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961232, "uuid": "85672428-d7fe-441f-97eb-555231710307", "value": "T1D8F5333227E2E914D2160F7562DA239735CD7A830ED7D66920BC9EC1768D0E33FA164B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961232, "uuid": "d338af24-b39e-4524-9c74-a135ff2662b7", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961232, "uuid": "80294978-f71b-43ca-8a55-20599b59ad68", "value": "49152:aAAFLFJ1X+dN8lCulypH7iUzQ0UxRhZRHVI3L+zbFFrtKcd1tLvAJ03NKBErq4Is:1A7J1sMqQlRhnmAbLRfJZNKB+/ILb+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781961232, "uuid": "f2bf1730-a0c2-44c5-b941-557755445a7f", "value": 3594752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781961232, "uuid": "2c589ce1-07b1-4696-b2eb-9b3ae5add728", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961232, "uuid": "81ddfcb0-efc1-4975-9108-3ea9d17e4226", "value": "Unicore.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0e83d63-6c6d-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781935380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935380, "uuid": "0e8c986b-0b00-4142-87cc-f04ca0a90068", "comment": "Malware payload (CoinMiner)", "value": "392014a4c917a18c502287c34ce1166e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935380, "uuid": "a2d0f52a-ece9-44eb-8b7f-9753d687735d", "comment": "Malware payload (CoinMiner)", "value": "89b54cb1327c87c2fe8aeb3d3c6e81cd8d2bc7122acbc2cca3dee6aa446788dd", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935380, "uuid": "79cf059b-9525-465a-821f-1b79df60e25a", "comment": "Malware payload (CoinMiner)", "value": "d0abf3d92c4ab82c48441fa082fdb23b7ca932cb", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935380, "uuid": "bb977a4c-64e1-4356-825b-b06037205d43", "comment": "Malware payload (CoinMiner)", "value": "c45c1867ca37591b24b481ed10765ab4faa545f3cd255cbc34d1aea3b04328743b022cd3ec85a34a2f19b138167ebbc6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935380, "uuid": "c8ee4c3d-5f14-454c-8749-51fc46781b59", "value": "T189745B4ADF350FBFC5AECE3016AE022715DE8C5A92F66B3761BCCD08B55A60446E3C58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935380, "uuid": "91101548-b15e-49c4-aa79-7cac0796aece", "value": "6144:UAS2llSfl6lAm6r33vfo9fOFUwabW71uexnaHAVziL7NSMi6KJ:UASvt6C/g9fOK+DaHA5q7NbiTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781935380, "uuid": "946abbbd-0ea8-47eb-8001-ce079f536975", "value": 351352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781935380, "uuid": "852afa0d-fd0c-4a8a-84b3-112ee463635f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935380, "uuid": "c80b5c9f-e03b-4084-bbca-7b0b8db88a0f", "value": "kworkerd-rcu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b6541d-6c6d-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781935279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935279, "uuid": "4aef656c-288b-4284-a932-03338d70f185", "comment": "Malware payload (CoinMiner)", "value": "b248137a9781a97e4bb14566ea5d25a3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935279, "uuid": "eced5365-3bdd-462e-b7b3-7b5f5735f60a", "comment": "Malware payload (CoinMiner)", "value": "8acfc7ae345d55ea28156b52b2c62ef656410ef513d6b3871022b87d669b9913", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935279, "uuid": "57b3617b-a507-4ea7-8e15-cca7b1dc1a62", "comment": "Malware payload (CoinMiner)", "value": "1c5e3767b8050c0cab017439eaad89f89bab75be", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935279, "uuid": "60af0e93-974e-4b71-ae4f-7af19a384d1e", "comment": "Malware payload (CoinMiner)", "value": "568cb3e26b966dbfb266b80dd03a404d4718d28f1204d2ee1f1f9e01cb8caff237c47c7c1c1928c17d5bfe9a81e544a1", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935279, "uuid": "488d1362-1866-43ab-a23f-9ebb91bdbea8", "value": "T173D312FE0DA36B9AE576003E64BFCE482A11DC07E5A05C03544AEDDAC85D8B1D7832DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935279, "uuid": "a15ee5df-d138-4693-830f-a27b6ef45fd7", "value": "3072:sw6eSJYso7HOUQuQsOB2PGfDluMSZ75Ndb3nWKwVc:sk37OUaBjfZuN5f3nKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781935279, "uuid": "82ea03ee-5e18-432c-aae2-551897e67b80", "value": 138356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781935279, "uuid": "357a8590-04fe-45c2-a2a6-93b7fdeb2968", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935279, "uuid": "1b98f70c-366d-488e-8609-0ee412d97561", "value": "kworkerd-netns-rt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cbb55ac-6cdc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781982912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781982912, "uuid": "fdba12ce-aebb-4bc3-9d5f-444271470e95", "comment": "Malware payload", "value": "1df1670262960591ffcd70179d1521fc", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781982912, "uuid": "a5100f00-0ade-4bc6-b9be-87baaf4cc6a2", "comment": "Malware payload", "value": "8b0ef90a42476f8df2eae4c3e271fbb558a5d136d22e4e6f87e138b6d3281a08", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781982912, "uuid": "31e09385-7c85-4e6d-932d-0200949caa91", "comment": "Malware payload", "value": "c372b46ea7163d98c63f75c242801e6cc7c266ee", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781982912, "uuid": "51189525-1a17-40e1-8925-5bd7ef1228f9", "comment": "Malware payload", "value": "bdf211930777828a102c60741776d3cc2b04820d5d4e801a2c82cde028784cf23f712d1c80b81768bc883d495d658380", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781982912, "uuid": "a643eb61-c356-4595-b371-cda99da2520d", "value": "T14A373377A28A653EE06A5B354A72D110953B6E50AD238D0ADFF4346CCF3D1B03D3EA46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781982912, "uuid": "e074f870-a81d-42a0-b8f1-1bd5ce1faa55", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781982912, "uuid": "d49e6b87-485e-491a-b1ac-7d1ff1850700", "value": "393216:27YD1NCULP0Uqqca8XjyJvwK4N581I4ES9F+qN:AYD1gULMBqca8XjyJoK4HNnk+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781982912, "uuid": "dbfd9814-490f-4048-89e3-7c3f4d07c098", "value": 24440692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781982912, "uuid": "38a8825c-074c-433c-8ca4-69f2c03dc96f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781982912, "uuid": "9b4e02d0-e26f-4ebe-ba18-79222085d49a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2416e0-6c3e-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781914972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781914972, "uuid": "4bcdb00d-f8ff-4dc5-9b3b-734837680398", "comment": "Malware payload (Vidar)", "value": "f05d44b7ccfedce2a7b9c5c79ae764b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781914972, "uuid": "a731d3d8-562a-4570-af9d-eec1572fe634", "comment": "Malware payload (Vidar)", "value": "8b5d256425865d07c2f65313a1a730ad87f7cd672e9785d69b4431adb2be8c53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781914972, "uuid": "1dbe8fc4-ac9c-445f-85be-149b7aab2afe", "comment": "Malware payload (Vidar)", "value": "8a478893320c2b956ff255074b486eeee8fc1c3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781914972, "uuid": "987517a4-4aa5-43ab-8a80-7180c32467a6", "comment": "Malware payload (Vidar)", "value": "680b523d3a8b1d40bb979d3c75c23182cf875b32af73ea02d6e48608c7d3f0c6f4edf79221bc814d6b356d9b2507e2cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781914972, "uuid": "897be35a-5a33-468c-80d3-c3148142ef29", "value": "T1AA068D07EE91187AC89992328CB64651777CBC052B3277D33E90B6BA2F777D06936B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781914972, "uuid": "f457ebe2-aeff-4881-9a9c-42fdab3e6c67", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781914972, "uuid": "e95836c6-aa7e-4993-b4df-4f06fee99906", "value": "49152:0UEkidi3AmOf0pyW8qoQZwKCLXvIp8/UMNFbA8AzZUvQayeu210:0nHWrnQwCo8A+Bjh10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781914972, "uuid": "ab0556dc-68b6-4061-ba85-4f6376e87e38", "value": 4018568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781914972, "uuid": "e0a223b6-2345-46e2-9498-968f258611bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781914972, "uuid": "ab015842-7660-481f-85de-cdee01d9a854", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32aa47cf-6c53-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781924001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924001, "uuid": "559cd4fb-3ef1-4aa0-926b-f311f9faaefd", "comment": "Malware payload", "value": "8c11864c9d56156802bf7990d4ed914c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924001, "uuid": "6545416a-cf4e-400c-97b5-7e95145f06e1", "comment": "Malware payload", "value": "8bedf6ba4034dde861d0ca248a44c98d90e066f3631a1d1d72a8c5b2df849843", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924001, "uuid": "1fc8058a-74fc-4ad6-9611-1539560c373d", "comment": "Malware payload", "value": "b080b39e54d030e8060bc0b935d433451f57d9fc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924001, "uuid": "c2e28bf7-195e-4363-88e3-5f788936482f", "comment": "Malware payload", "value": "dd1944ffd6ecd0c1293488bb3fb55c732b23e71a98bc184c8645659bdbfbddaf1da8d20a795283bc714c0a901fa52716", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781924001, "uuid": "42fee868-936c-4de5-a898-2b31e79d9fb7", "value": "T14B137D6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C55A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781924001, "uuid": "9221aba7-8e3f-403d-987a-d0b56d1b4dc2", "value": "768:0XRWNGxVnK9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:Ilxhcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781924001, "uuid": "ebbf1025-73d1-4276-b206-c3d04eed3ab7", "value": 45216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781924001, "uuid": "0c104386-669b-459b-ba67-5e6812a584fe", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781924001, "uuid": "86c33469-6244-4fd7-a68b-5bc8a1bb193f", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2775c5a-6c4d-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1781921746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781921746, "uuid": "96c61324-74dc-4fdc-ab6e-f0885c5d4e55", "comment": "Malware payload (WannaCry)", "value": "9d9e293be0bc3323060ff6271cc00d4f", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781921746, "uuid": "67f20348-12a4-4683-bdce-8b8d8508fb8a", "comment": "Malware payload (WannaCry)", "value": "8d347ecef1e388d150a55d84f0397dc39be24d22c456681eb57ca23580f4083f", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781921746, "uuid": "e643ae8d-1130-4002-a8af-96b85cb89fce", "comment": "Malware payload (WannaCry)", "value": "d7784fdaca930daf2e664a388ce2c9fed3ca7ca4", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781921746, "uuid": "76dbd2a3-c8dd-49d7-b786-9ca22ab1e6e9", "comment": "Malware payload (WannaCry)", "value": "34bd17ab89bd4a850025b2a528044df4ccb14247465f12dbe8bac596d0114a3ac7f3e5413caf178a122bd3d7dd88c002", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781921746, "uuid": "68172345-e3ac-49c2-ba87-7f1ff962ab5c", "value": "T107363358726CD2FCE0020AB444B38D16F7737C5557BE5A0F8B84866B1E53B9BAF90B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781921746, "uuid": "5abb6150-023f-41a5-96de-d891faa095bc", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781921746, "uuid": "cf680c94-0c8e-43fa-aa55-ddc2507b34a9", "value": "98304:DyDqPoBhz1aRxcSUDk36SAEdhvxWa9P593G2:DyDqPe1Cxcxk3ZAEUadzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781921746, "uuid": "0218a1a5-294d-43a7-b473-47fc4ce76b41", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781921746, "uuid": "c4cc7dbc-5c4a-41be-bfcb-5f3174621cd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781921746, "uuid": "96a119d0-2096-4be3-bcbd-d52b62772833", "value": "8d347ecef1e388d150a55d84f0397dc39be24d22c456681eb57ca23580f4083f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ec956d-6c7b-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1781941505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781941505, "uuid": "5de9d351-cad2-420a-a8ae-4c030c5168df", "comment": "Malware payload (NanoCore)", "value": "6ac427de669f5699ef25c81b16789e8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781941505, "uuid": "49fb622c-2829-45ff-93db-b60d0929cdc0", "comment": "Malware payload (NanoCore)", "value": "8e13eaba6888b0e7638c7d1adfb208e6c6f2aa9879a53e519aa1741a7d2eb546", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781941505, "uuid": "75230303-7c03-4c99-986c-c8c06f86ec83", "comment": "Malware payload (NanoCore)", "value": "a2a36e7d5badfd6fa1c8d6f5c9fefe26fca9a51a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781941505, "uuid": "a8df4e08-b95a-4c1a-8f87-48b5bf4f4900", "comment": "Malware payload (NanoCore)", "value": "ab10458a5e273bf8964d846ad02008003438e273596763ae7b9c2146919252e3b861d5c75739e7523a49161589e93628", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781941505, "uuid": "fe0bc3ec-c5ed-43db-8189-4fe10358c721", "value": "T12B14BF2677B94A2FE2DE8679701206539378C2E398C3F3DE28D855B68F167E5060B1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781941505, "uuid": "6654af14-154c-43f1-b969-114be7d9b524", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781941505, "uuid": "0a7aa027-e6ce-4b9f-a408-2c7dd1321097", "value": "6144:sLV6Bta6dtJmakIM5ABGmPDZ1ZgJB6QUWv:sLV6Btpmk9BGmPDZ1gB65Wv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781941505, "uuid": "21a5bd4c-5c41-420c-9578-341397446dcc", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781941505, "uuid": "1be3f86c-9900-4205-b850-cfe0e4388c20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781941505, "uuid": "25dc6670-b2f5-4a5f-a39d-f897214331aa", "value": "gg8862.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334376b4-6c84-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781945047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945047, "uuid": "736b061a-aa93-47ae-81a1-d93b3e48a98d", "comment": "Malware payload (Mirai)", "value": "ec8a5e637a89c490f0946095b5452945", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945047, "uuid": "7bb6dbd6-da17-4df1-a8ae-64c864c24b77", "comment": "Malware payload (Mirai)", "value": "8e14ba8834408f2b408c49a1ce8213c88a1b357e5f9e99d165d27f1d02319bd6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945047, "uuid": "6ff7a8a3-5a25-45b8-b42e-5e624937eac5", "comment": "Malware payload (Mirai)", "value": "dfa9dc7c6c093797b9eabcac92d2795db32c689e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945047, "uuid": "660e1dba-7874-4a1f-a543-489cef547c01", "comment": "Malware payload (Mirai)", "value": "739cd0c250a5c23a1a6d73827f9de5877a7def68dae12db9ee185301e2579b831cd71a5b605e6a3cbdd06df6dae9d6f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781945047, "uuid": "e85163e8-aec8-4e74-ba7e-bbba452292d9", "value": "T1EAC35D41AB52C9F3D5970FB906B797110A31DC225B2FCF86E72D3DB89E02689712A35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781945047, "uuid": "87b78ba0-83af-4a38-b713-4a2862bea474", "value": "3072:UOhgdnlvQAdO9mZT+z9mBe/Y6bnUMAQkwC4KFccfwgQGH:ja1QN9m0iMYuUM+X4KFccfwgQGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781945047, "uuid": "5a0e4122-f2cf-4425-bae6-b4dc64502112", "value": 121719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781945047, "uuid": "f6df5954-3fa3-48db-b221-960a2753687b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781945047, "uuid": "95721df4-2cf9-425b-b3b5-2ac72b199255", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d27481-6cba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781968345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781968345, "uuid": "6d1132de-c225-48aa-bf50-620576bdc98c", "comment": "Malware payload", "value": "a88000aa3f6d41c1e94e9c60242fed70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781968345, "uuid": "b1b30bc9-be46-4470-b134-1ebdcddbb2c9", "comment": "Malware payload", "value": "8f3876c7e711e7090cea94d5ff64c627e941ba65601ca96f6b6e2878dca85e8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781968345, "uuid": "b951a404-b351-4410-8981-e42190fba562", "comment": "Malware payload", "value": "f05aecc639569c46f9bfc529829262cee28e2526", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781968345, "uuid": "9bee1101-a6f8-4434-bb0b-95e21b30fce1", "comment": "Malware payload", "value": "b5826e3deac84f5e0702824b4fc02a081d74d32ff39b9a211f0ef79dc079b8ef02c7dd0e99f1b11f9d23836e72131775", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781968345, "uuid": "1a737534-2eb0-47d3-868a-806f4dfb4b79", "value": "T1CAA4E149F2473D43D4D7D639188BC2815A5AE46B23F393452A07A9BF38693B24F3934A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781968345, "uuid": "96054509-8dfa-4555-9043-aa608f4328a2", "value": "12288:WEDkhghK+NMdLSPfFx0FQ8nRko9BPBW+gpFmbHY:HTE6Md+FcQ8ni4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781968345, "uuid": "8bf4548a-4e93-4d59-9128-ab94c6494da5", "value": 456004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781968345, "uuid": "4ac04052-90b0-42ae-8196-0b74133dca76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781968345, "uuid": "d91d7cfe-32f8-4e77-b607-323c553ad320", "value": "bot_armv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d486218-6c55-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781924904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924904, "uuid": "613510a2-e415-44ed-b0e1-41f11190b80b", "comment": "Malware payload", "value": "41e9facfee7ceeedf93ff55527bc65c0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924904, "uuid": "9e2665d2-e146-440b-8303-7f46bd30480a", "comment": "Malware payload", "value": "90ed1cbb30bccdf6f91b25ad39e350498a999b7033243bfdf7b8704a6485cfc6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924904, "uuid": "9f0a72b2-9574-4f03-8d48-16e526b8747c", "comment": "Malware payload", "value": "0f51ba570ecaa95dcaddba452be02812dc8b36e5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781924904, "uuid": "f843dcd2-6c99-46be-9f2e-a2383026c521", "comment": "Malware payload", "value": "546d21ebfc276afe5d25a07b2749c8fbe62d78bb3246907e4fda13a1f828b053b022816d124869e5015146f77e80155d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781924904, "uuid": "d64cb9ca-a895-4a08-8871-8156817649f6", "value": "T1770188C986406D00906ADE5E729B5590B811C38E068B0BB8BFDC192DFB98908F066F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781924904, "uuid": "1c783de0-d72c-41b0-833f-e2424ccde67d", "value": "24:kXCKysE2hi0ziQvZohawsFEi8KsxEEbS7:e9Qp+MswsFE3KUESS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781924904, "uuid": "48608c39-23e4-4a79-91d2-4ae2f96e7fb8", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781924904, "uuid": "4712efa2-f54c-4b43-be8f-3f135b2efd88", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781924904, "uuid": "43f88072-762a-4776-b623-97f5e1e9bca8", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22fc96ac-6cdd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781983245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983245, "uuid": "0b356b77-bc2a-4da0-87fc-e52856a6abe8", "comment": "Malware payload", "value": "7560006cd7ec668652484999aae4dba3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983245, "uuid": "045b8000-8a0a-4522-994f-73720769e012", "comment": "Malware payload", "value": "915d8baa66a420bd67b75a9d6152ab99036c16d29f1b73b2ad4d8e3dbae382e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983245, "uuid": "822ebaf6-88d7-4140-bec1-6b0c19555280", "comment": "Malware payload", "value": "4ef4a5c697705a2dbc6dd918ba32980621f51185", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983245, "uuid": "3887d57d-984f-45db-abe9-8fb2bdf60c44", "comment": "Malware payload", "value": "a54cc50dfc2392c878d0ae9d9a5777e671bfe1edab18f5da3e3e73d26a66adcc33b6a796afe72c511f019c30015c3d52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781983245, "uuid": "e3f97ca7-642d-4215-893e-11dc3a6745f4", "value": "T14CA31258F08E9422C796017A8DD5DF1B0E9ED399F77BF5AB0540D3F0C76358212AAE24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781983245, "uuid": "408e0af1-98c5-4ab4-82d9-5aa58c07c078", "value": "3072:XIdadX7BdsrJJG+jHlv5Gbldm/JOwbKoGL:Madldsn9jHlRq8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781983245, "uuid": "bbcbdcc4-eff4-45e1-ac72-59c1138476e9", "value": 104972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781983245, "uuid": "d9016ca9-2bcc-4dfe-8412-1876b90880ce", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781983245, "uuid": "6f4d49e6-f9c8-4169-bb2e-0137df3c15e1", "value": "SecuriteInfo.com.Linux.BackDoor.Armada.1.30483.9391", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0142679d-6cc2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781971592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781971592, "uuid": "dd7cf2dd-d7a0-4abd-aac2-3ad096388988", "comment": "Malware payload", "value": "93eea51429b0c73740bacda98d8a74a8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781971592, "uuid": "be9e414b-ad08-497c-ab7b-7fe1d0f9892d", "comment": "Malware payload", "value": "93b3d9b30c6463e043fd1d6a3fc9348827b5b86a67bc5520803e23ea8352044e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781971592, "uuid": "de7516b5-5d78-4d1d-b096-c7bc968aae9a", "comment": "Malware payload", "value": "db0af497aa5e7b27f02eae4da72ff7dc7857c1fc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781971592, "uuid": "30a8527d-a52a-471a-b956-d73f104869fb", "comment": "Malware payload", "value": "64d51603b47590d423f2c5ff0b3d92c1803d49476a9e5af51d5701dfa25912792483013d9e7aef6e63fa58277281834a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781971592, "uuid": "fdb6984f-70f5-4703-a0fe-66a88980891d", "value": "T1CA018CCA8600AD004029A66F26A75290B810C3CF568A0FB87F9C5D2DF7D9914B066E98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781971592, "uuid": "efcb507b-c424-461a-85be-851505096e03", "value": "24:kXCKysE2hi0ziQvZoha5wWNI9SW9qvJ/gG7:e9Qp+Ms5Pu9SW90gG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781971592, "uuid": "971ac2dd-869e-4e99-8c7a-53cc9c0ff356", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781971592, "uuid": "c135ba87-2caa-4e49-af55-0ff37c348935", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781971592, "uuid": "8d507871-be66-429f-b5fd-81181834f1c7", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f03aec9-6caa-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1781961468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961468, "uuid": "8504e878-1cbf-449f-825a-d689d40cc588", "comment": "Malware payload (SalatStealer)", "value": "8ad98d809e87c146555686b252feacfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961468, "uuid": "6d12bdb1-b635-4306-b35e-6f011ec2e466", "comment": "Malware payload (SalatStealer)", "value": "93de66680b277c94cf8925ea36b9e396e6a57096f018f493edf64df898034dd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961468, "uuid": "b55e36ab-19fd-44df-885b-cfc66d5f4d3d", "comment": "Malware payload (SalatStealer)", "value": "4ff4720313ae142d1979ed78678728827eb508b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961468, "uuid": "ce1eaf59-e57e-4135-8c6e-a6055ccb0c3a", "comment": "Malware payload (SalatStealer)", "value": "16ec2618f16a67147321f647fb0d2a6f1492287cc5b9da33da710fd0ae00fecb0eb0ea74b977ab67ba475bf07cce2a2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961468, "uuid": "460a3bc2-0435-4930-94a4-5a3c2821dced", "value": "T15AC65B11FADB95F2E903583141ABB37F27315D048B28CB9BEB547B2AF8776A10C66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961468, "uuid": "36b6af5e-c96c-446d-9774-1141c46cdd8f", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961468, "uuid": "446fda4b-4154-4e28-93d3-b802044998fd", "value": "98304:RBbA+H15zAC1d08E+Dbt5D4j3Hxm/ENvO/:g+zrd/NDxZ8llO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781961468, "uuid": "ffd03fce-72f6-403f-ac37-2c0f29053a63", "value": 12572160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781961468, "uuid": "05b05636-4c04-452e-b17e-4606afb14425", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961468, "uuid": "6d8164be-6092-4bf6-ad21-7e5835d26bcb", "value": "zapret.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979ee1c1-6c4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781922452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922452, "uuid": "5db5afbf-3010-4188-a514-8cdba9722e18", "comment": "Malware payload (Mirai)", "value": "9b4b852f8076831abf1b3e4ffbf4121c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922452, "uuid": "86d2bb10-4199-489a-a157-e073c213b46f", "comment": "Malware payload (Mirai)", "value": "95596c76f58ff43a1d77820f3c3298bb3ad4afc4e30ee39ca909c8ab1b429bec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922452, "uuid": "949a836d-e421-4eed-ac0b-eb01c54a84e1", "comment": "Malware payload (Mirai)", "value": "2a54530ebd8ee5600c3d3124188ad1c3467dc88e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922452, "uuid": "95c3c850-1dad-4323-bfcd-fd4de09b48d2", "comment": "Malware payload (Mirai)", "value": "d0b26829c9b37bc54e1b0512d26203df038768a05b98fa379d2a406435cc51a9ae8b80e6f76c1e462e80daf03e722e4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922452, "uuid": "b7069687-b1a3-499b-9b94-c9a06cb4065b", "value": "T16A54C61F6E229F7DF3A9C77547B38E249B5823D626E1D680D1ACD1101E6038E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922452, "uuid": "2f5f9584-497d-437e-9080-7f66de662415", "value": "6144:M9mdDAV782l8ksuhA1NnmyjiyDixwq9+bIf:M9myGORhym5y7bIf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781922452, "uuid": "75b67f07-991f-46b3-bb48-65c6af83eaad", "value": 280516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781922452, "uuid": "3042f03a-f429-410f-ae0e-a951b15067c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922452, "uuid": "a272e303-0bdd-4f16-8390-d2b9566f6199", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d81ab6-6cc2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781971596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781971596, "uuid": "c35bb278-a05d-496b-b8ff-7eb7951b1a41", "comment": "Malware payload", "value": "389cb6d2a283c525151a857edc18628b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781971596, "uuid": "9db116e3-1b61-4860-a6dc-d07f8fac4cfc", "comment": "Malware payload", "value": "95db7a2c030d4153c1320cf980a6d11d98d2ac152c2df482d67c7e300feb366f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781971596, "uuid": "321c2a77-bb2b-4562-8f66-9a8db7d174ce", "comment": "Malware payload", "value": "3eab4cb99c1c8b58af89122855eff3700ceab4eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781971596, "uuid": "2a4cecf9-a7b2-41d2-aefe-02184dd51126", "comment": "Malware payload", "value": "75fa2d1d6e3d00caaeca364297d9a8df1e9be0a30a58cd3dfd5c3e0c0f1e51b0c5228d4cf1dc14ab28b90de35baa819f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781971596, "uuid": "81a40e55-0e5d-4618-b807-e0bce9dc3478", "value": "T176157E88E7C7D4F1F66300B1068FD7E61934A3265013FAF6EB882A577472B526E17329", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781971596, "uuid": "fa62c04c-ea16-46a8-85a4-ef28f949c4c1", "value": "24576:XD4KAph34hb4lkTKiD8WIeRiqcNmD/2KX1JQhmBAdwd9m:0K8h34hl2riRi8D/Xeom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781971596, "uuid": "d9c060a3-c292-415f-93d0-51b1935194ba", "value": 926596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781971596, "uuid": "37bdd231-c42d-4414-a4a5-1ae41d0d406d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781971596, "uuid": "11216ce9-03de-4872-aef8-2ce62c83b6c7", "value": "bot_i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9657be28-6c4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781922450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922450, "uuid": "8773123b-1c26-4b6e-b77d-0bb353658f9a", "comment": "Malware payload (Mirai)", "value": "01b21587f1bc8d8f910a07a9533d2e9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922450, "uuid": "058211e5-c8bd-4f1a-ab4b-6c156cee6b28", "comment": "Malware payload (Mirai)", "value": "970b716721efde1a97a214d26fb641631d70ed51916ad3bdd9faa4ced59cb33b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922450, "uuid": "200bcbdf-0f41-4aad-941e-4b623d4fdb27", "comment": "Malware payload (Mirai)", "value": "d9babdba46ded4e6b70382cb4e66cc1fda73df3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922450, "uuid": "4eae1fb8-1b12-47e9-9f1a-69c42212f772", "comment": "Malware payload (Mirai)", "value": "4026b8417487bb2df7e630130709bccb28877643a13e1d200dd7e748701a3da3aeefe8c6469fc5c391c0263cf5bb4a30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922450, "uuid": "a56898e6-480b-451c-9b6b-0bd0d904b6c8", "value": "T1AD543B46EB414F13C4D627BABAAF024533339764D3EBB206D924AFB4378775E4E62601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922450, "uuid": "0b8e02bb-5133-4642-a8b9-93a5be10b203", "value": "6144:dERaHl6I2qlrv5BJeTA2arN8xxd10Iyz7BsKWziTV/GjmU2hxas:S+Z2UJeTA2arN8xxd1LCNsy/AmU6xas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781922450, "uuid": "34c90e8d-b077-4e62-831d-666aec127130", "value": 292189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781922450, "uuid": "7000d965-062f-4771-9de9-b5c2d581db0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922450, "uuid": "83337bee-489e-4f79-a6b3-793ae16424cc", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e5865ac-6ce4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781986271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986271, "uuid": "0938ee5b-d611-4fd2-95e8-e1f363299f2c", "comment": "Malware payload", "value": "81b56755404f0b833b433f578ce5c681", "object_relation": "md5", "Tag": [ { "name": "tirepatch", "colour": "#D584FB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986271, "uuid": "d761447d-eca6-4256-bc9a-aafc3ea92765", "comment": "Malware payload", "value": "977d720443bbac5473d10ca314861eec8a6bf050b2be56485bc8d9c4766a4c7c", "object_relation": "sha256", "Tag": [ { "name": "tirepatch", "colour": "#D584FB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986271, "uuid": "d07cadc8-9bb7-4c44-8bbf-8f415c4ca8c2", "comment": "Malware payload", "value": "9a5d131593d4e1ebfcc0cd47687d14ebda831866", "object_relation": "sha1", "Tag": [ { "name": "tirepatch", "colour": "#D584FB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986271, "uuid": "6340fd55-c06d-475f-955c-9c29d8c81d76", "comment": "Malware payload", "value": "01c6015091181e7a257c0e22243e33f6b3e2259f4c66e8ce5502a3e62011be4ee31cbdcf94477af85658f09fd59f2926", "object_relation": "sha3-384", "Tag": [ { "name": "tirepatch", "colour": "#D584FB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986271, "uuid": "d1db4a54-97ef-4144-ba1b-39b4ca08793a", "value": "T101C312E0E487BB0BCCA6DB3576634F61A431793864462BA55ECFF296E091120C46F22D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986271, "uuid": "35032407-5c27-4ff3-8c8d-4d2d381b6829", "value": "3072:lXHTxcBi+gSxQ2eeO6H6v739k37sSBz+yW+:lXtcB7xQKav7tsoSN+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781986271, "uuid": "af460d0a-4a1d-4406-98e0-5f7344d5e59d", "value": 122257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781986271, "uuid": "04300936-9ab7-4154-a1db-c645ffbb8e7f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986271, "uuid": "5a76a874-34bd-4fe6-b972-3f27f26e0b13", "value": "obfusticate me captian.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "093b1317-6ce7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781987497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781987497, "uuid": "96865864-097e-403d-a676-3f0db95849ec", "comment": "Malware payload", "value": "8929456ded01078a2f8d69dbb7beb275", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781987497, "uuid": "6078bb3a-5c48-4d1e-91f1-bfbbbf89153b", "comment": "Malware payload", "value": "97ab95191daea05b15024ff2a3a52081a30d4238ba4db4efad5e232f44ab97ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781987497, "uuid": "fc74fcb8-2617-4eef-85a9-1a9b866e4621", "comment": "Malware payload", "value": "5639fe9dda5bd0df766625a88a0086ad0a42aa4f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781987497, "uuid": "4389423e-f1ae-44d3-8121-809f91d5c2f4", "comment": "Malware payload", "value": "053f0244f75b0f23d5dcea5781d81ad5e7d4945d491a2042898f4636b04d9b1385bf194c7f6deb8c9385131a6c736a6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781987497, "uuid": "c56fb9ce-9d11-4da5-83ba-dc100612a3c0", "value": "T13F344A81319C7EAEE2973E3EC141951A6C0CCF14B886DD2241F9FA472ABB5DB1F3A145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781987497, "uuid": "653b11fb-2b8c-4dbf-b5b7-465f617890b2", "value": "6144:sLSDY0MD2dJT7mJcOKeAQM93/gvkiPrROJ3h:5DY0OcJd6kiP8Vh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781987497, "uuid": "a7023541-ed3f-48a5-9ff9-67248bad373c", "value": 234648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781987497, "uuid": "ac180c13-0d4c-446c-8d80-93fe962c0496", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781987497, "uuid": "2ae9c550-7781-4e41-9b6f-308d112989aa", "value": "kworkerd-scsi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8bc1503-6ce4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781986583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986583, "uuid": "5d528f50-5033-459c-ba12-614fb3f3059f", "comment": "Malware payload", "value": "0c0db6cde9e15c8d19ee2ae0bf26ac29", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986583, "uuid": "cc61eecc-f2e8-45fc-b0a0-bfe11f3da953", "comment": "Malware payload", "value": "97c458bad070c33011bd4e1500c208e72ee5c376e6f92dc42e81b676fef6dac8", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986583, "uuid": "f9b757cc-1a15-4a33-9c23-bba64b574e19", "comment": "Malware payload", "value": "51572c99fab069b9472334e3e029ea6b37f9786e", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986583, "uuid": "da03550a-74e9-4496-8e74-04182e79acbd", "comment": "Malware payload", "value": "fb11f93aaf48db96b33d393ada7f980086631472870ee4609d1943bdb54a2a9b5562302ab169a5d99980d3f9d959bc2d", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986583, "uuid": "0a7f7901-48ac-42b1-8a42-ce0a01732aeb", "value": "T17785338746CDCBB7642A7DD8D384BA2409554AFD330A54D61731426FFAAD28330F6AF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986583, "uuid": "1aabf2ec-d04c-43f7-89d0-d7bfa74edc2c", "value": "24576:agVKVekxuNpsGz9eGXn46SWhx+l38iORFF3P5zCA1dMX21xJ/xKwG+lmq0:agYbYNpzz9H9x+lsNPVCoP1xJjG+lmq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781986583, "uuid": "8b28a953-d5b0-4884-90f2-6faeae4f7205", "value": 1732856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781986583, "uuid": "76ccc94f-50bb-4b22-82ed-2e8601b17c96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986583, "uuid": "1be67b3d-3190-4282-9e6d-fa1e151143c0", "value": "jbd2_sda1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b75ed0-6cbe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781969996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781969996, "uuid": "ffba7630-0355-45a6-b43c-aea5cdcb0710", "comment": "Malware payload", "value": "2b858ef2f0990916d8c75347112f6fa9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781969996, "uuid": "6e66aa6f-b444-4af4-97d0-4272a6ba2b61", "comment": "Malware payload", "value": "9bcab2badeb92396cf9bd00ed323b0291520d4036de0eb4dc7d0ad4d957fd4b6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781969996, "uuid": "93b20b8b-fb20-404f-b93c-617e64964491", "comment": "Malware payload", "value": "77d60fbec6f27b054895195d35a09c96e93d7af9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781969996, "uuid": "cffb4cae-2208-40af-bcee-c9a98c6c525d", "comment": "Malware payload", "value": "fbf5c9096ae4f9642d5f8a8c94c8cf5119d6dfac617056e959f994eaf34bb5acc8ae53fbe81b40968c474b764f6fbc10", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781969996, "uuid": "8e8f7e56-d434-4fe8-bd94-5e0e8bff4f64", "value": "T1DA136C6526953C25AE99883B5C7F2F0CB9A983E2304491DDBFCA3CF18C15A9CE31871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781969996, "uuid": "e3a66d40-536f-4e5f-91ed-baafc70d65a6", "value": "768:Jr9NyXsZztCy9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:BHusZ2co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781969996, "uuid": "731abb3a-20af-43a7-9f86-1bd090ce7cc0", "value": 45509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781969996, "uuid": "f379423c-1b47-47f8-8d68-386d7ae723fc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781969996, "uuid": "e3adbafb-673c-4909-a07a-0eab680a20a5", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b1e10c-6c98-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781953955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953955, "uuid": "18914b04-bf33-469d-a6eb-c969d0ac32e2", "comment": "Malware payload (ConnectWise)", "value": "f97369c65ce71afac2ebab1ae5c96e16", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953955, "uuid": "53d933ee-3b0e-4300-af27-b9e3a7980a83", "comment": "Malware payload (ConnectWise)", "value": "9c48fc643b569e7b37d851c8e3c3a19d1469427a99d405b7f9fdefaa0b40f9b4", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953955, "uuid": "f7166075-0c7b-40c4-b592-c996cba653b9", "comment": "Malware payload (ConnectWise)", "value": "9e7c5644cb14f71db5a5ec9820594ee55e4eb949", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953955, "uuid": "a8e0f590-5556-463e-9e14-988884f552b9", "comment": "Malware payload (ConnectWise)", "value": "403800ef622d904fa56b08d03c35472bebed9e9be3f7943a28783e9e46f3c0abf08ab5c2a170178cfb4d7c683c551b2c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953955, "uuid": "ac48ac16-62e6-437b-bf71-4e144e1f8cd3", "value": "T1F4646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953955, "uuid": "a8b5c763-78d3-4f3c-b479-d984c72c8344", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953955, "uuid": "88298da9-4815-4bec-950c-1d98f0c33d54", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:h1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781953955, "uuid": "2591043c-af8a-4d50-9c4a-c8750a876fba", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781953955, "uuid": "58d606ca-89bd-4427-9286-f4fcf4eafa1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953955, "uuid": "c04cb2ab-f057-4645-81d1-0d36701027b1", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee6158f4-6c83-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781944932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781944932, "uuid": "fddca4e9-8e0a-43fd-b33a-f1ff33fad2fd", "comment": "Malware payload (Mirai)", "value": "11ea3f94d57b99fe485eb4ea613aa6ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781944932, "uuid": "bd5bcfbc-e746-4e7a-9e2f-a8cf4c5068a8", "comment": "Malware payload (Mirai)", "value": "9cac4e526dc6fb7a44c1b51da88ffb2cca0a1e483b82d93be7b96788566d725b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781944932, "uuid": "5920db14-7306-49a6-9af4-57ada852dc5d", "comment": "Malware payload (Mirai)", "value": "bb7933db9bd61e7d350b725dfad7fc0105a57cd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781944932, "uuid": "818ffea0-e674-4a1a-a5fc-a21c897056c6", "comment": "Malware payload (Mirai)", "value": "f5927d511ea849b99e4bc20c58f9a7136f04383382ddf404998aafba9d9862ee38a7da2a7716360586df4c347456a581", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781944932, "uuid": "8ecf43c0-e6cc-4d5e-984b-063504703b53", "value": "T114C3AECBF24B5950C82147F11BC79F8E2F5322148D5FE8EB2C0EA63B15BA5DB1906782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781944932, "uuid": "d1dcd402-0a81-4dba-9860-717bb699f0ad", "value": "1536:JAeLgCjop3veeAio0XoWiQjlXbdh9qIxhW/ZRNRKxY8PYX3OW0DUmT1egF8Gxg/O:JjuGXinhXbd/wBzRKxlk3OW0NT1eggq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781944932, "uuid": "02bab304-1af1-486c-850c-1c1a0191c666", "value": 124084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781944932, "uuid": "0181dd9e-07ea-4ac5-a756-c7a42d0fb7a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781944932, "uuid": "464f4d85-06f6-40ff-9725-5bff49a0fda7", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85367754-6c84-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781945185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945185, "uuid": "29f19f4a-ed2b-4ef7-9c14-78b88c92b476", "comment": "Malware payload (Mirai)", "value": "8371fab18df3cc6aba589a9eed5254bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945185, "uuid": "4a759f4b-d9a0-4b38-98bc-23b3d6ebcb21", "comment": "Malware payload (Mirai)", "value": "9f517a5050093c44a4e57dfeaf63a5a56a7aa852789788c878df7b0c14c60143", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945185, "uuid": "9a45dd27-2ad5-4cb8-9d2f-f3bbf7259a42", "comment": "Malware payload (Mirai)", "value": "f1ed7368ffbdf3d19779c24c0ffc3c8a66c33e82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945185, "uuid": "f4c46fd6-fb4d-4479-ae78-65d74e52e07b", "comment": "Malware payload (Mirai)", "value": "5f53285091d3faef39bdf208da1f64d57a285813c137cbc02c3f08721ca43ef7efd6dea3f0509b89d72a9a59ccb707f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781945185, "uuid": "363d6031-033d-4603-8357-519ba259c7f4", "value": "T1CB143B46FB808E17C4D62775E7AF42413333DB64D7DB73068928ABB43B8669E0E72605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781945185, "uuid": "419facb6-e00c-4ae1-a09f-f24539d91013", "value": "6144:j9N1ijXtgQ3XXa0XK+YrUTVK6GqgySL/KBIp:j7kRgQ3XXa0XK+YrcXzg/IS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781945185, "uuid": "0a786054-1eae-4853-b6b7-2838ea4b90ce", "value": 199207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781945185, "uuid": "b465bb3d-dce9-4fc9-8104-dddf8b4e6773", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781945185, "uuid": "4e3c7cee-4c6b-49d1-876f-6f5a6c44f9d1", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818b4589-6c51-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781923274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781923274, "uuid": "5ebe498f-151e-4843-b9a4-caa089c51884", "comment": "Malware payload (Mirai)", "value": "fc2d8c4dfe2d70fb5f43d7edcb881994", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781923274, "uuid": "aa8df9f4-8f90-409c-96df-f5a3d4ea006e", "comment": "Malware payload (Mirai)", "value": "9fa6d2fd9142a363ae55e41e63bd8c979b402ed3536f1a786f5b86490238c5ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781923274, "uuid": "f38b577c-e453-4bed-a02f-337db5365109", "comment": "Malware payload (Mirai)", "value": "ab17cb2b3b77a28871f12c67a987b2c44a5aa6b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781923274, "uuid": "18a1bd0a-454b-443a-b622-4374a9e2bb4d", "comment": "Malware payload (Mirai)", "value": "1fd425688990a094124bde279d33a81203b01c9e5a9174b57327f6223716204450b669cf70fa3d610a1bc6ee129dc017", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781923274, "uuid": "0f73c63c-026b-40cf-8037-633527c4eff8", "value": "T16D8301D9AB1C1826E4FC28F441A88D49345E2F396CFDA95D2F7086942D270A5FCF12D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781923274, "uuid": "143154b9-e3ef-4360-9e4b-ad3c6009e0b2", "value": "1536:X6iDLmEhtj2Y1wgXsZUSTaV7Iwb3HRuN9AyPH8H6yHW8PR/1f8i9QyCRD/zCoMii:qYLmEhtqY1KZUSTmMwb3EN986yHfp/KU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781923274, "uuid": "2b2a2a44-5641-4ea4-a981-8cf1131c20d4", "value": 86032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781923274, "uuid": "9cb0c0aa-fe12-4795-8805-ff50061af77d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781923274, "uuid": "27a8c8f8-9cad-4b12-b7cb-8d79a9fdff7f", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5012b77-6ca6-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781959975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959975, "uuid": "6d7e890c-8989-408d-a35d-2205720d14f8", "comment": "Malware payload (Gafgyt)", "value": "ee9605f9b9dc4d1ca3fe14d1a91d0b2a", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959975, "uuid": "03f2c07f-5481-4c08-87b4-335d4ba35987", "comment": "Malware payload (Gafgyt)", "value": "a093743fdd8267704bc8dbe330f458da98c8c1a52b72ddee473c34efb0306430", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959975, "uuid": "db1f58d3-c4b4-4514-8d0c-d315f40e07da", "comment": "Malware payload (Gafgyt)", "value": "487d064ac2463e3206ece0646acc5dab6c2a8ece", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959975, "uuid": "501b6121-155e-4a25-b363-b8162844c07e", "comment": "Malware payload (Gafgyt)", "value": "9b799baddb632ee49b9844b71ad23c47f1205d114635c3ba2018a8a4c0167e014baa5f6364990c7f85db110482d97150", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959975, "uuid": "e7e34acb-df9a-452d-b86b-4407204d962a", "value": "T13AA33882A640D5B3D09306B6129BCB150133FB3F4A6BDEA6F35D3DF88B109817225B9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959975, "uuid": "f662d72a-aac9-454a-8567-76cb23a38be6", "value": "3072:0qV9RRUcUQ9UjjZaLPPpQlwj24/3CZ5hdThZ0inF0OzTyoQQub:RfX9UjjZaLP+FWCZ5htsinF0OzTyoQQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781959975, "uuid": "cebe6700-95a0-440a-9bd1-8486e05e877d", "value": 99773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781959975, "uuid": "695a9d2b-2bf7-4783-8e53-e48c636b8e0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959975, "uuid": "dfb509e5-de0c-4ef3-a1ac-973dcc338982", "value": "assailant.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce6a06b-6cc8-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1781974430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781974430, "uuid": "b888dde3-458e-47e9-8eee-3eafc6cc6962", "comment": "Malware payload (ValleyRAT)", "value": "1c95b93ed0c018ade4980f117b031f23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781974430, "uuid": "1fd9c8e3-ea39-4c07-a9a5-64e6e5d0c608", "comment": "Malware payload (ValleyRAT)", "value": "a1bebf922ec25ea218d165605716c37a5536b2b046fef5462b057594297db2ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781974430, "uuid": "f12e6b9f-1520-469a-8c25-a13ea1b4643d", "comment": "Malware payload (ValleyRAT)", "value": "c39fce373d82d1ffda14ae3025e8e5f6fcda4595", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781974430, "uuid": "86d2e16c-b054-4540-ab71-c51dadcdc7b6", "comment": "Malware payload (ValleyRAT)", "value": "16cd2431be038a13bd2cd31e071eddddc4d5a57296f2635c79c87219b55564986f07b8e9b33e2c7bd0fc7b0bafc6b6db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781974430, "uuid": "99543583-13f2-4bc4-b52d-246a3d878528", "value": "T1A8F7C502B643DD9AF4664275885B0FA0A361ECB4977083A722A8761C7FFE7CC6EF1514", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781974430, "uuid": "ff5f3311-e275-45c3-a446-f4fe44dc5059", "value": "380560563ebacca1589d8d38ac610187", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781974430, "uuid": "a2e1d533-0b37-42e7-97d2-3bbbe80899b7", "value": "98304:NuX9nmn1jJ6I/EoPZQi7kmeHh2yeH7rkfvVsJnndxMcGNUXhngr/GALvixMpfrf0:8NnmnbcoRQi7ZkfvVsZdW+RC+AzmMpKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781974430, "uuid": "140baeb6-d44f-4d52-86c5-b2c171fa33a1", "value": 73518592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781974430, "uuid": "9535c877-dfae-4770-b825-f7d40019ec38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781974430, "uuid": "3a2229b8-9338-4478-adfa-6e03d2ff672d", "value": "a-software85650002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a5dce2-6ce7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781987484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781987484, "uuid": "05bb9d46-a7a3-4aa7-87cd-c1a8725423ee", "comment": "Malware payload", "value": "0e30a8647ea9499eca8937826ba68949", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781987484, "uuid": "d0c91be7-e7cb-47e8-a286-4092895acc92", "comment": "Malware payload", "value": "a32e7b6c1bab32642fa78f78d1891f8ba1ca8c4fa2bb382ea91350c9290a1107", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781987484, "uuid": "9dc8270d-1cd6-4310-9f06-4d5ca1d69018", "comment": "Malware payload", "value": "374c01e99cb6771a0be332609c47f46b364bddbe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781987484, "uuid": "9352e7f4-b985-4dea-8d59-873fd56a35f9", "comment": "Malware payload", "value": "57c3f4034d89bf9f0e1090460bbc5b060638d36e51423acea45402cedb6c2ab7b0b31b1bf82ec45e05703d8395207f93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781987484, "uuid": "7c2a6e7c-e232-4f3b-899f-f2f81d571a00", "value": "T11D3419A9BC40DB62C6D427BABB5D829933130F74C3DE7506CC241F2976EB55F0A3A582", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781987484, "uuid": "fed2c574-c1a2-433f-ac17-69103e0dec16", "value": "6144:srLotycUVDE1UAeEssM8jaMK3771WChKHYOa:YLoUc3UAeETaMyBYa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781987484, "uuid": "ec2425a0-5b72-46a9-bfe9-c61be65587b2", "value": 243552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781987484, "uuid": "a210a354-3290-4130-af20-0d0ee70d1404", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781987484, "uuid": "2b437476-f21b-4ed0-b679-d794c4cf7316", "value": "kworkerd-blkcg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edaddabb-6c83-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781944930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781944930, "uuid": "68e816f2-1162-4b26-a2c7-241701a42ecd", "comment": "Malware payload (CoinMiner)", "value": "5e7f658d2c9b9ab8a55daab1d2112436", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781944930, "uuid": "aa9c1e40-964b-4d09-8183-668c198c1f0a", "comment": "Malware payload (CoinMiner)", "value": "a5bd3148f357f3d47425e98f5ffbd8de459f255e6895f9f9f75a718205c85a66", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781944930, "uuid": "c8ef55d7-4082-418b-9dfe-a45dd278d922", "comment": "Malware payload (CoinMiner)", "value": "f59e1b4eb45aa8131760b6ba5eaa366a46f1751a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781944930, "uuid": "3d043fe1-49ce-4f14-8a2a-e2e70565fd07", "comment": "Malware payload (CoinMiner)", "value": "65aeb7982c74d58081b9aaca3b751ffaed8fad6a5fdd5719cba3f9047d267a543f11a3b855ec4a3e9358481bf963666d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781944930, "uuid": "b04e5997-6146-4941-9f90-d395f5636d22", "value": "T199A24A869903EDF5E82622B66537E7B75F32F0BE6489ED47C334E4329C82500E61728D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781944930, "uuid": "bd6359cd-e6e1-42db-9e64-e9019f27f472", "value": "384:fDuRbP07bLl20GxKmI6Qrjq77B8S1Hwy9hom5cwCLa0J:EsI0pp6STSzoecw3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781944930, "uuid": "c69f7940-45a2-488f-98a9-afc0408bfc63", "value": 22992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781944930, "uuid": "5a567c0e-1b2c-423e-be01-7bf608fc2894", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781944930, "uuid": "83649e58-fa86-4cdf-a196-80b7a6fa05ff", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02149703-6cd5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781979754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781979754, "uuid": "75ee732a-4bad-46cb-9157-b76476647b54", "comment": "Malware payload (Mirai)", "value": "76fe7a88037c3bb0e6c73f0fd783e9fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781979754, "uuid": "875060e2-ff5f-4a67-8d72-d4796f28a8ae", "comment": "Malware payload (Mirai)", "value": "a657eb64288c844fc179c28c87b9348288c952b5c5a8a7ec9c0020e4113b5f30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781979754, "uuid": "6952a305-46a2-4b4a-bcd0-43de7aac6008", "comment": "Malware payload (Mirai)", "value": "fcab914145fa1a8743623575972e81b0c6f9389d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781979754, "uuid": "37989bfd-8ba3-4c95-b814-b13cd9e04268", "comment": "Malware payload (Mirai)", "value": "546691a2478825a4118b0101c9dcbc234b009d7eb1e7e6b7c50ab5dfa44a4d7a36fb083d9eb2aaa2a257f6fbcc5ea9d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781979754, "uuid": "181a47f1-13b5-499c-8184-8f1f6d8cc4a2", "value": "T162631956B8818B22D5C512BAFE2E128E3313177CE3DE73239D106F24778692B0E7B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781979754, "uuid": "00da2dc7-54bd-4d11-8deb-f497fb6e445a", "value": "1536:2Wne4T1vVwAwsmFRM8hizYaZPCVPpQKMdiZB50i25PYex:h1vwRfizYaZIB50i2prx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781979754, "uuid": "957b5e49-fccc-4e49-a2a1-f80c235915a2", "value": 71964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781979754, "uuid": "a7ddc2e7-bfad-40c8-8500-5398ff65e76b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781979754, "uuid": "25e8f761-e8de-4e49-ba01-9418cb5588e2", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e24534-6ca6-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781959970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959970, "uuid": "3ab255da-480a-4203-bf6d-ab064c3e5e4e", "comment": "Malware payload (Gafgyt)", "value": "5295d24dc4c43fec636c64c3dff3305c", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959970, "uuid": "00791501-e723-4d36-b8c7-d134837e247c", "comment": "Malware payload (Gafgyt)", "value": "a675bf9998afa7412c16ef9b867098882b43cd9293a90b9aa9cd952ec2c8c146", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959970, "uuid": "349e38be-d024-4206-8d16-5f00c4bcf56e", "comment": "Malware payload (Gafgyt)", "value": "27cad1417ad00dd1d048e353d1de79c030301da6", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959970, "uuid": "bda3867c-8c30-4efd-9600-12174869b285", "comment": "Malware payload (Gafgyt)", "value": "e6641fadadd6cce93a273b8562427d7443fe5e7b6a1b99e783ab499389fb5460dbca958cac8178ccc1845146769b8ea7", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959970, "uuid": "70d89f4c-b7db-4a8c-ba82-f46c91f8c534", "value": "T1BBA35B86DA43C6F3C4430AB1126F965A0632FB3A4E3B8EAAF71C7CF49B129D53115791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959970, "uuid": "de4e4ef2-6167-45ec-ad37-f75f6a2266d2", "value": "3072:OVDTUPKBVjBW/EZbb29akWbjN1UQ5h0TegrXnF0OzTyoQQub:O9UPKBVjBW/EFb51UQ5hAeIXnF0OzTyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781959970, "uuid": "957c4642-c2f9-49b9-85a4-6a6e61000a97", "value": 99773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781959970, "uuid": "4bef94b4-8cd0-4515-b260-7ab9aec28cf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959970, "uuid": "9b3afb77-8ba3-4e52-9c4f-82f9b6ec6822", "value": "assailant.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e260980-6cda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781981922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981922, "uuid": "7c7acdc7-0b93-496a-8461-fbc6d2130420", "comment": "Malware payload (Mirai)", "value": "b9c1c21931e143a671494eb2e89fe5b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981922, "uuid": "5424a4bf-3849-40c0-a3ef-bfd1589e75b1", "comment": "Malware payload (Mirai)", "value": "a6ec23370de4e1849d6e91f60494fd39c6069f25b963110cb13cb60c371e8512", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981922, "uuid": "bd336fb8-57d6-4d85-9659-23722d7ca934", "comment": "Malware payload (Mirai)", "value": "f3ae306c4a7bf200c2194846fd0017d36cbba614", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981922, "uuid": "9942aa19-5ebc-4641-9783-dc9f0997d89c", "comment": "Malware payload (Mirai)", "value": "91b01b5714c1dc40db1045bedeaaec3c110f752b8e71fee5e747dc5f322757e2b1f59a669eaf72cd9bde62daf5a58360", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981922, "uuid": "b89b7098-2dbc-4c07-9166-55cb6b948787", "value": "T1612439027B0D0E03D1532DF0273B1BE14BEFFDA128B5E680755EBEC59271DB22489A99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981922, "uuid": "cb23a9a4-2ba0-4d7e-b4ab-86c48a9931fa", "value": "3072:AaQzEan+B5RL6tiseuDTc5AIxseNkAbZn9HvVFS8Q1jHMnGIC:W+B58xesQ5rxRkAbZn9zSvjgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781981922, "uuid": "b9a91c3e-ec34-4005-b1ce-fde3befabd15", "value": 217844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781981922, "uuid": "100b51e9-7ba4-4e10-a1f1-00f9649357e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981922, "uuid": "54b73ba3-8226-4465-a22d-7e709097ece8", "value": "bin.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "430bb18c-6cf3-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781992748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781992748, "uuid": "e6a4832d-5421-4a09-995b-d6764fce1a64", "comment": "Malware payload (CoinMiner)", "value": "1479d53b5b86ad090d66775f14fb03fc", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781992748, "uuid": "a1903e2d-6167-4f7e-b350-5854beaa12af", "comment": "Malware payload (CoinMiner)", "value": "a9303e3948a212476179499bf5e7aaf5df89fc490bf28c8ec15005bf8b023ee5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781992748, "uuid": "34ec18b7-c0be-40f3-a806-ccc77be3837e", "comment": "Malware payload (CoinMiner)", "value": "2acb65032e6581214fd927404d761dda32e0fd62", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781992748, "uuid": "c6e7bb08-7295-476d-b2a1-20943a17e298", "comment": "Malware payload (CoinMiner)", "value": "5798ec0beb4d5260d00961fe409b7347e0a252545e0ec91c2e323c3d04fa4bdec021c7b6ce10aec152a9865fe2bf795a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781992748, "uuid": "f806afea-5a21-4c62-9159-539f58906d0e", "value": "T174E533A0FA96EEE6CA0843368E5F430E027DF68913495723552CB7251F632E07F8B957", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781992748, "uuid": "fe48ec8f-1529-4d00-99b3-d1334dc970af", "value": "cd40545a33dc365b00dc388241fa5c66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781992748, "uuid": "7f137f58-181a-4a37-907f-86365f73e193", "value": "49152:wyJ269N6mK/B2PA1Jkjs8oUToH0teRQD7oNHDPrHI+xY8eoQfAHkfCuuRDzCjRo8:wkz6mKpXXjRUeE4NHDjxeookrzUc/8q8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781992748, "uuid": "498c6064-0b95-494e-8b7e-930b8a0584c0", "value": 3051444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781992748, "uuid": "99c72bb8-bbe0-4e30-beba-961db0eec8f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781992748, "uuid": "f74af9c2-d910-41f6-99f1-772244d216f4", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa2ac7b-6cf1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781992063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781992063, "uuid": "47e4004d-1907-492b-9cde-8e64fd0b487e", "comment": "Malware payload", "value": "be6f4554b3eb5284b188c8ffedf32897", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781992063, "uuid": "251d586f-5559-44c5-aac9-176512fab582", "comment": "Malware payload", "value": "a9b58569a98930ebe0b68bddd9fb13e4ddc9e75530b283d07b853c97b6c13d8a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781992063, "uuid": "747d5158-7137-4c7a-9aa4-295d9b1ab0ec", "comment": "Malware payload", "value": "ba2a3ee966ebef320b85c3f14514f350c84b7675", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781992063, "uuid": "f9b174a0-1e34-466b-9eb5-2a4b7c23cf9d", "comment": "Malware payload", "value": "daf29f386d84f8401ed7c651f51256ee773482afcfc3bd6fa56a64fb4e0e9485cc3e03f7df6361c794f4c3fb3377cbda", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781992063, "uuid": "0ee5f17a-f369-4cea-87f8-cfe4a6a30560", "value": "T158016FCA856069408129DA5D7AE7A6E0B420D3CE1A860B78BF9C193EF79C404F166F54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781992063, "uuid": "f15ae54f-7083-47f7-90d7-e41660612bbe", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkapCrNh/jCWeCCItcfqDC1XFCyuBFUauD:kXCKysE2hi0ziQvZohapoNFPDoFi87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781992063, "uuid": "5e8a5c6d-e51f-49e7-83c6-7ed25d3cd322", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781992063, "uuid": "85293694-97f0-4042-a30b-51512e60b0f9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781992063, "uuid": "e39beb23-7ea4-4bbf-b570-464d2dca7a2c", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dee7c4ba-6c55-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781925149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781925149, "uuid": "8f3abe42-253b-4e5a-9891-6d0248a4a88c", "comment": "Malware payload (Mirai)", "value": "38e113c877497aacbb6d369797207bd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781925149, "uuid": "57ae3a86-f2b7-4ec3-a338-bf41524b8e26", "comment": "Malware payload (Mirai)", "value": "a9bdf0bede8fca35c262c4e727969fd7649140b102039f43796a931bcf0ad715", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781925149, "uuid": "d1df9c63-b4b4-4cdf-be12-df914cf5624c", "comment": "Malware payload (Mirai)", "value": "32f7af0406256e005cc6bc15807723a1f9895622", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781925149, "uuid": "651f2f1b-ec38-4025-b343-b43e2e571a28", "comment": "Malware payload (Mirai)", "value": "ef3133daa6f4ff46cbd5567ce29aa2c2ae7dac1f6f35bc6ccb8ec103ab72a3671e82005817e717bacf2b93f161c175f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781925149, "uuid": "21f6ac21-e64c-46ac-a081-1de02589056d", "value": "T1FB53013BE673D145E59A25BA3D467AAD6280F6FDB11014BAD4D052BE00FE10AC704E7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781925149, "uuid": "c66d2b2e-ed19-40b8-8bd9-6fb69ebe5618", "value": "1536:+Kdv5ODzfrHwfI0UeDFeRMsL7FJh0pryE+WWoizUh++:+Kdv5ODOFeRDL6pr7sdo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781925149, "uuid": "4c3a57c6-bf7b-43b6-aec0-18491fc0a71c", "value": 62740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781925149, "uuid": "010943ae-3165-42ed-af73-04dead795df2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781925149, "uuid": "a202c72d-543e-49bb-a738-7d00d1916955", "value": "monero.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b025c0c-6c56-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1781925357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781925357, "uuid": "d44e53d1-50ef-4930-b02a-3c823cc96e97", "comment": "Malware payload (WannaCry)", "value": "6640820a921a5235ffa3448c7640039c", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781925357, "uuid": "63816a2c-3497-4556-a61f-661792fe9979", "comment": "Malware payload (WannaCry)", "value": "aa40a70d1dbf91af1d2bfc5209417fadb3b4ad2192a4ea4cbf802e2b10d5b0ce", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781925357, "uuid": "38b88902-239d-4de6-bc3b-9b6e1290d3d5", "comment": "Malware payload (WannaCry)", "value": "791618590c32a2164037f241b401f4698e37c239", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781925357, "uuid": "60c95925-ba13-4f46-a971-4ef40849aa08", "comment": "Malware payload (WannaCry)", "value": "572ad420bf435ec46f789d58483099bcbcc0fc1ddb069c2aa73bcadaf8156d4ae88cab9bcafa9aa1b59f42362e0d3d3d", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781925357, "uuid": "43fd572a-8409-4aa1-9b51-1d66d0596cb3", "value": "T156360104ABD4C9B5C56612304AB783206F7AF854A6B5CB0BD3F4997D2C277889F61F83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781925357, "uuid": "6dcdabb9-7814-4b36-b751-922aff6b6939", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781925357, "uuid": "8839ce2d-9af9-4586-9191-bbd3719ad08b", "value": "49152:jnYnjQqMSPbcBBQej/1INRx+TSqTdX1HkQo6SAARdhNREroVeiC9avc:DI8qPoB1z1aRxcSUDk36SAEdhFeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781925357, "uuid": "bf4ce6e4-cbea-4d3f-9ea8-8dd6c4b79bce", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781925357, "uuid": "f06550dc-bae7-4447-8cdc-c49891af406e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781925357, "uuid": "790fcc22-a379-49af-892b-9f50850599ad", "value": "aa40a70d1dbf91af1d2bfc5209417fadb3b4ad2192a4ea4cbf802e2b10d5b0ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd46f62-6c8f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781949947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781949947, "uuid": "1bfbbfc5-0cc3-4807-9f83-3c312e5e07da", "comment": "Malware payload", "value": "6a86dc35bd253403bec5a609a56ab7e4", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781949947, "uuid": "251d419b-0746-486c-83ea-3ec0840f2289", "comment": "Malware payload", "value": "aac6c71656df8ccca3697cb32c802d5a6f0005999cc196f81080e4b6ee4108b5", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781949947, "uuid": "28b4a60b-915e-4bed-8d8e-6a427b0dbbe5", "comment": "Malware payload", "value": "2920186e39886bb9d3bb203aa867bd90fed86059", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781949947, "uuid": "9f3128cf-7a23-4394-9991-0fd999beb84f", "comment": "Malware payload", "value": "e18f1bc9fca004fcf123e0d79c3bab524022d45594e987073a183852426dc2c29b712bcdea3937105f0e1fe51dbd9dbd", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781949947, "uuid": "7ab692b0-016d-42bb-b7f5-c4b6e7c78e98", "value": "T144956B4BBCE014B9C0AAD636896665927E71BC440F3237D72E90B37C2FB2BD09A75714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781949947, "uuid": "6b2f86d1-78a5-4096-b677-726a1469527a", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781949947, "uuid": "461093e5-4e9f-4e09-9404-8f895484425b", "value": "24576:bxYVqDSOuYoKESB+LYTnk5eojuB+tjx8u02IYyXnc0mVd28fYL0V:aqDSOuYoKbAYTnk5eojtPI5crs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781949947, "uuid": "910927c7-b523-4541-8f4d-823ca5562a25", "value": 2016984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781949947, "uuid": "c9247544-0825-466c-9a12-fafc2d441e0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781949947, "uuid": "2cc013c2-8d4d-4e94-9a3a-5d859ffcda7e", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d05bce74-6c97-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781953471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953471, "uuid": "e67e5e9c-3f79-4f4c-b81d-dd2025540e7d", "comment": "Malware payload (ConnectWise)", "value": "f69859707432442f70c49c2f0678f675", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953471, "uuid": "cee1e22c-a815-48f7-88f8-d4066cb70d5f", "comment": "Malware payload (ConnectWise)", "value": "aadc96fe85cb6f7089b51457c2bd30ff443262ccd53fbb3ca4529289c70a595f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953471, "uuid": "c5d672c9-9b23-45a8-9342-9d70c1700d68", "comment": "Malware payload (ConnectWise)", "value": "a77cb0942631742512c5a015c580ad0c6a6e2afc", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953471, "uuid": "456e421b-a405-4137-81f0-f7dd45264593", "comment": "Malware payload (ConnectWise)", "value": "02b598fa5a4415bea88895ad9dba9f5c82a47a544bbfbc496e825a646309a3b388396e5d19dcedb0b6079fc0cca24ef8", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953471, "uuid": "11f8d4d4-3038-4c0a-9393-e247fcc7f9e6", "value": "T13C836C43B5D18476E9720E3118B1D9B4593FBE210E648EAF7398422E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953471, "uuid": "0ef06da2-02fc-4bd6-8432-2bf501cf7a37", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953471, "uuid": "9f04f457-2f17-4ccc-8d78-090e56701b4c", "value": "1536:CxoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYx76J:genkyfPAwiMq0RqRfbaWZJYYxS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781953471, "uuid": "cab2b792-ddae-4c94-8cb1-c112cd71040f", "value": 83160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781953471, "uuid": "0a1a2e01-061e-4c46-af88-8048e2ce1441", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953471, "uuid": "3e6fd64c-56a1-42f1-a6b2-ebe1ece4c40e", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b6ceca-6c6d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781935460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935460, "uuid": "5dc09ce5-1463-46c5-9b5c-06304def2796", "comment": "Malware payload", "value": "a23fbb9b99984c48a6837d2d87bb350b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935460, "uuid": "5678e8aa-49c0-45d5-8ef2-12172e1c266e", "comment": "Malware payload", "value": "ad97f40c2f601818ea056358c1e1be3bfbecd1659a79a442e3428208d630e59a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935460, "uuid": "1c8104c1-5aac-46c9-9442-d7cd70538172", "comment": "Malware payload", "value": "cf101ad0eccd3bcbf0778150a895dd47efec9c48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935460, "uuid": "9ae82b09-402b-4013-a927-a305617b496d", "comment": "Malware payload", "value": "6983c13892eee20ce3850aaec4a69fafe43ec700fe1d478364fe010ed2c9194aee200a1ad46b53b5638ee54bf4dd2c1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935460, "uuid": "eae8f321-149e-401b-abc0-1909fb10c042", "value": "T172056C6377218F58E360D57009F38A619AD522A71BF294C2A3BCC9107E5076D6C6FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935460, "uuid": "9d15ca6c-8efb-478b-bbaf-17830eac9bcb", "value": "12288:/DhA8IFMgQiOiv5eG2HfQCL4KIG95AVAQdGRpsJIDgpqOE6pfcQ9:/DhADFMg2Ke7R4KIG3AVyRpsJI4HpfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781935460, "uuid": "c16dbb63-cc27-4c44-b54d-6689bb583a15", "value": 795292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781935460, "uuid": "6fd38bb8-7114-4d3a-bc1b-bd2ec98b4de0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935460, "uuid": "ded9c71d-0b7f-40c1-bd18-5da8b2dc3d7c", "value": "bot_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b88ae5-6c6d-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781935285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935285, "uuid": "80ed91d3-d234-49b2-8a9b-e82da91dfbf8", "comment": "Malware payload (CoinMiner)", "value": "5070d90b6316cd9e68ba7c0b092ba661", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935285, "uuid": "93e9cd11-bc0d-4c34-b085-c2cf6965226f", "comment": "Malware payload (CoinMiner)", "value": "adaee0af5bc0376c62b7b87408d9e346f2da326d25d474638bbfc4a6b85f3560", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935285, "uuid": "f6c221d8-1f42-4f3c-a07b-625e977c3971", "comment": "Malware payload (CoinMiner)", "value": "5636d84ea69ed5185367a54a5119c7f87a556948", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935285, "uuid": "baa63977-8786-456e-a9e2-f0c622dac9a8", "comment": "Malware payload (CoinMiner)", "value": "14809ba5da80a97ebf54d30b25642ebac9903c371633bef0297b9878299def859ed550014903078522f0e7a29c9e2767", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935285, "uuid": "ec21d773-daa5-44bd-9fc3-6f268bb70bc2", "value": "T1DCD312FD0DA36B9AE576003E24BFCE482A11DC07E5A05C03544AEDDAC95D8B1D7832DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935285, "uuid": "26279076-e5cf-43a4-b151-76105ee1a886", "value": "3072:sw6eSJYso7HOUQuQsOB2PGfDluMSZ75Ndb3nWKwVb:sk37OUaBjfZuN5f3nKb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781935285, "uuid": "264acb6a-4c35-4273-898d-3b26e8c0a249", "value": 138356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781935285, "uuid": "d6410ee6-3aaf-4c43-9092-5519fefc3aae", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935285, "uuid": "6ee4cca9-5c9b-47b6-b1c4-81d1bf968d6c", "value": "kworkerd-netns", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a25b1c8c-6cec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781989901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781989901, "uuid": "d1b924bc-4f6f-47c4-aecc-1d104646b5a7", "comment": "Malware payload", "value": "7f2028446e827cbb89976b00df5cff7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781989901, "uuid": "168ba16a-cfef-4ab6-9d38-89327d5c17f9", "comment": "Malware payload", "value": "ae5db9eb1406557f12e2d9b474b2519beba3b6fc6afdb8ded74f41d258ae82cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781989901, "uuid": "87b37f10-7d68-4361-8c1b-bfb6cd1b0d98", "comment": "Malware payload", "value": "2a5860757ce73860559de452e5e9f47b1a3a0867", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781989901, "uuid": "ea1e73f8-6938-4b9e-b79f-9796058eaf21", "comment": "Malware payload", "value": "cdfffa4bfedbffd0301d4776bed9b3d373d4749a60a76acc5c3420087af9bd64a7da027eb3944f8e9fb015f19629cd43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781989901, "uuid": "eacea3e5-9983-4951-b819-05bef78c72c4", "value": "T1D0D312ACE813BD0CED1B07F3E996164B5583D49755758EA2C7228610A6F8E4EA4FC02E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781989901, "uuid": "f9dd0934-f312-4c4e-bf0f-73aaa8465d8f", "value": "3072:PxjzrStHLrAb7hNbAGy6H6FTmRKdi1uywyDR1:5jMHHg6G1aF0KdcuSz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781989901, "uuid": "ca698ea6-c5cb-4f01-a9fa-beb54c34d381", "value": 140052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781989901, "uuid": "b9569da6-fd7f-4027-b954-577acd06a07a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781989901, "uuid": "dc91daf0-6a1d-4931-8ac6-78f2a02d8326", "value": "kworkerd-rcu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f510b1-6cac-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1781962557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962557, "uuid": "3302d57e-a0f1-46ae-9629-8e1847e97982", "comment": "Malware payload (SalatStealer)", "value": "5e6a3929d6e3020f75115a47addbf987", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962557, "uuid": "62d4c0c7-0604-461d-8aa5-8ae8c21c07ca", "comment": "Malware payload (SalatStealer)", "value": "aefc4db306e46c7b1baf4542dcd7ab3e0324f92fc5e5734be180b90c0546205b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962557, "uuid": "2c9da908-fd74-4815-8ef3-997377dd3449", "comment": "Malware payload (SalatStealer)", "value": "70b9a9a1b50c2b48bd1cbc0fd0465618e97b3faa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962557, "uuid": "923e0e79-9d12-4c21-bc5b-f9fd65810ef1", "comment": "Malware payload (SalatStealer)", "value": "b4441a671aadea53620fcc255560411e2e5034e0a9f4947ebad566b7098160ca9022c67ce0d6697fedef8aa31e519796", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781962557, "uuid": "9c4a5b9a-1d83-4ea7-a46b-8d96d41bcf50", "value": "T13CF5338C7A96DA52FCC1C33EB703AB05F6DA66B6D4A2BC4137C4264DC7433896C849D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781962557, "uuid": "bfa5f087-c3e2-42f1-b873-6108bd5fbf2a", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781962557, "uuid": "c8173c6c-2653-4a19-85ac-f2b7b4757770", "value": "98304:3iTh2/xX8sL7JGhxRMs2IOi0MjQKA4r4Mbz:g+8k78IrEfrNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781962557, "uuid": "221de642-3533-4663-b974-9c7a73530208", "value": 3596800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781962557, "uuid": "c1152337-fa5c-4b8e-8ffa-39b0cf22d5d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781962557, "uuid": "36d66f7a-7c19-42a4-8f58-7054bfadf63e", "value": "Dior fix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ca7baab-6c6d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781935292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935292, "uuid": "dfbd2c22-72b8-49ba-8780-64f4a374cc77", "comment": "Malware payload", "value": "08748e8c148fee7a4299165e07f4a79b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935292, "uuid": "e5a13e0b-350e-4d85-b1e0-1746a110c4e7", "comment": "Malware payload", "value": "af4766e3258253c3318678d5441400e6a908e2b787ad1a20a990df0e4eab111b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935292, "uuid": "e06f420b-8c63-41c7-ac00-789728adfcc6", "comment": "Malware payload", "value": "6769681c4daa73d2847d8e6aef234d707d22252b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935292, "uuid": "7e867f03-c48a-4ab2-a9da-193e589885b7", "comment": "Malware payload", "value": "89c235efeb2e8cffc8bee829c6b9122790c82995d86b53b00dbdd057420c8f012fb02a60a9d81ca1846697cc2dd94df6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935292, "uuid": "f0d771aa-614a-42d3-b2fb-699b416deb2f", "value": "T1B2344981359C7E9EE2A73E3E8101A51A6C0CCF14BC86DD2241F9FA472ABB5D71F3A145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935292, "uuid": "cc37868d-2516-43d9-b49f-1305d90445d9", "value": "6144:EFsDnsQ02LV3bmJcOKeAQM93/gvkiPrFOkdn:lDns12VZ6kiPw+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781935292, "uuid": "96be1875-67e1-4f0b-a8ed-3b098da6277f", "value": 234648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781935292, "uuid": "4351c62e-f32e-432d-9d2d-69c8981e4f92", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935292, "uuid": "6b9a2b79-1e91-42fb-9bf8-e0b330f1f190", "value": "kworkerd-scsi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b95e7d-6ca8-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1781960730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960730, "uuid": "2022caa6-b8a7-48a3-81d7-de380c96db3f", "comment": "Malware payload (LummaStealer)", "value": "2f9ec23d6ca74629b928f5f149d9feb4", "object_relation": "md5", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960730, "uuid": "7ee0490d-2139-46c5-b3b5-0e1e741521b1", "comment": "Malware payload (LummaStealer)", "value": "afa807cee34e8b931688ccf2be76b7ea5337af3d64714a348bead839c756643a", "object_relation": "sha256", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960730, "uuid": "53d06be9-34a0-44da-8ee6-ddeb771da08d", "comment": "Malware payload (LummaStealer)", "value": "c23880aace575129c384723e82fa92e8e25d54c8", "object_relation": "sha1", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960730, "uuid": "da56283e-c7ab-427f-bc30-1f84c612a377", "comment": "Malware payload (LummaStealer)", "value": "04cade968b361745c0f13498933d3e326b3369cb5ff3ca34dcc5e9ff2fe10b5f84722d90f7b6ea6d60123c9162a75019", "object_relation": "sha3-384", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960730, "uuid": "135abbcf-aea7-4333-b3eb-739e55a941f9", "value": "T156754B01FED718BAE512123358AB53EB23389D0A0F359B9BEA44367EF9771D21823715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960730, "uuid": "7632ff01-4718-49e9-a9bc-0158d5bd8697", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960730, "uuid": "9e497423-f20b-406a-bcc7-a7490a4363a3", "value": "49152:QnqyXHnmQvFeV2dNeA43Y8JVhQLs5bsut:EJXHnmQvFeV2dNeAuVqLPut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781960730, "uuid": "e694dacb-67d3-4f6b-9092-fae7cfe3f31e", "value": 1588592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781960730, "uuid": "186e5d72-5149-49ef-a1f6-d176da70f4f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960730, "uuid": "dca21f4a-c64f-40d4-b81f-2dcfa4644189", "value": "Vmlyjlrir.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3716c45e-6cf1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781991869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781991869, "uuid": "f251f027-6bd1-4791-b93d-dac8c6848cd7", "comment": "Malware payload", "value": "4b835dd01dbb7a0c03c62890338df8e7", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781991869, "uuid": "80d92fa3-6c9f-4dd7-9584-c0d9d4a4592d", "comment": "Malware payload", "value": "afac970888a621eb5a408c1820d941839c28ce4fbc351dfa0d23402f04fcd3bc", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781991869, "uuid": "d9d3a066-5eab-461b-a338-4502bf09fee3", "comment": "Malware payload", "value": "78fb18d81f24dfb070dee1c754dc801c66973045", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781991869, "uuid": "5037504c-2ab1-4fe0-93c6-822ef44c5ddd", "comment": "Malware payload", "value": "110e07be3a201951d4dae8c73c06bc5d0be54be4757c278f3ce78349e87cba7dc70d76d6275c13dc0456e62e2650833a", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781991869, "uuid": "9a230130-2a64-469a-934d-ec872a776e37", "value": "T198E523867B44E047D61E5EB9E962C3AC2762FE1A9B58970B30D0BD1F7CC66E31D84183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781991869, "uuid": "c4426963-84e5-4028-97e3-dacdc4f9c46e", "value": "25162c295acc7b35a7ed65cee17f3a6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781991869, "uuid": "cdc2b71d-71e7-47d0-936e-d83d85949a3a", "value": "49152:tmu3B4Dk1D5xCFaqcKcUxg8aI1vOKc0vQqd5XeBVKVdpvoWoYolJoy7nHfEKhWM4:tmaXk+lUxUIM5qdsBVKVdpg7ncMv/bRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781991869, "uuid": "51b5110b-e256-40f1-b6be-1b7f31744c67", "value": 3087664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781991869, "uuid": "307f34d1-616e-47e7-a74a-619328e4899e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781991869, "uuid": "9e1a5fc3-6ac7-4907-9355-eb8004c28c54", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74fa93fd-6cad-11f1-a769-42010a9c0008", "comment": "Malware payload (Sliver)", "timestamp": 1781962767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962767, "uuid": "e4441551-4e9d-455e-b7d4-69a4da0b28ca", "comment": "Malware payload (Sliver)", "value": "b0e1d25b47d005257990f1626739383e", "object_relation": "md5", "Tag": [ { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962767, "uuid": "47976f51-45df-49c4-82fe-01ada7c7be91", "comment": "Malware payload (Sliver)", "value": "aff0e85a8e066750e4380b756c2a12b9c9b4bdf7460eff4dba462422e572fe81", "object_relation": "sha256", "Tag": [ { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962767, "uuid": "fa15063e-2398-41bc-b2d4-c876316e40ad", "comment": "Malware payload (Sliver)", "value": "063cd1d546e0ebc972a8be86415848262795375a", "object_relation": "sha1", "Tag": [ { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962767, "uuid": "340a1a65-6b35-4016-a8a7-c919067f483d", "comment": "Malware payload (Sliver)", "value": "e732fef41104eb2af16ddb78c872620d1ee3d1dcedf09330ed33280b3b5db5fd9292565761f3e18aebe86d239db62df4", "object_relation": "sha3-384", "Tag": [ { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781962767, "uuid": "a2c00993-7750-42e5-bcf5-7a707fc76d7c", "value": "T173177C47F8A105E8C5D9E630C6B692137BB17C448F3263D72B60B6786E76BD0AE79340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781962767, "uuid": "3071525f-8256-433b-be18-e943e2d08ba0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781962767, "uuid": "a454c817-a343-405c-b7d0-0f7c27c650e7", "value": "196608:mbgz5UQKjn3YDTbnxM3j39SuDkfdNQ3wTxFZ+7l9DeLXiSbch:m03Kjn3uM3D9SuwA4+7lfxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781962767, "uuid": "52e359ae-9fac-4067-a2e0-72cbb0ef710e", "value": 19229696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781962767, "uuid": "f8225155-9592-4ed1-87ef-3c1f6abfe2e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781962767, "uuid": "5c454455-12b0-4549-8d8e-281b7f47600c", "value": "test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e11e3a3-6c50-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781922678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922678, "uuid": "954d77fc-88b9-41fb-914e-1b2e4ebd70f7", "comment": "Malware payload (Mirai)", "value": "9cff7189a7b2da399eda9526b02644b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922678, "uuid": "c2e80989-c4b8-43de-a3c4-570d97e9c248", "comment": "Malware payload (Mirai)", "value": "b05b56bf91c6024cf1cc2869e09fd1a35aff2496f0f7363c84b10e15d171fbfe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922678, "uuid": "b97693b1-c2b2-43a5-aa33-c52a02953700", "comment": "Malware payload (Mirai)", "value": "1e1ca06973667c6ceee26fec4372d0cb8473497e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922678, "uuid": "77589d98-e089-4ff5-95a9-c5f6571f7e5c", "comment": "Malware payload (Mirai)", "value": "75acebd50360399e870b550f883c3c8d15518d97d9b9ddcef0b1c47e56bb11cb031b0b71b05bf29d3fbeb581010e36e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922678, "uuid": "1afca7df-e624-4bd9-95cf-d93a2cad2404", "value": "T1A393024CD2EE5237EDFA3CFA44B749AE778440A279E99EA55314CDC0F38E10A3997054", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922678, "uuid": "f505b38c-0673-4247-9cdb-6c0538286d93", "value": "1536:fSNifRjqU4o+08sz4aO7wkReJfinMBlNTiPxUoQexRYcwnfdGSg9mSH:iifR2UR+3szl+tuKnM1+YpflSH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781922678, "uuid": "38f86710-d5eb-471a-973d-be007c7e8cc4", "value": 91516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781922678, "uuid": "4e0b72af-44d9-420e-8685-cff49f2078a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922678, "uuid": "501c2a9a-e96a-4ab0-9a5f-b73a7025698a", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d50c1c-6ce9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781988642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988642, "uuid": "cbdd6022-71e0-46ce-9cb6-e0c4f54dab41", "comment": "Malware payload (Mirai)", "value": "aa96fc2dba74cbd95f6e58f59e304960", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988642, "uuid": "05e3b5a8-6eeb-4d60-83e3-acc45426d398", "comment": "Malware payload (Mirai)", "value": "b090e5a3b3c104c446018af559c074adf42dc10a8c4e34270fa2228a1f2f82c5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988642, "uuid": "45bf714e-2800-47a1-8aac-af477c497e1b", "comment": "Malware payload (Mirai)", "value": "72c53b03ead5730363e3c13991a582396dadaa90", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988642, "uuid": "b1a78ec0-c40b-412c-a94c-1ff39f99cd91", "comment": "Malware payload (Mirai)", "value": "44156c76f66b48b952a3045b324b32fcd820a5a338fdc788068f8c77d484f01e937f95b6a0b9f97b575127945ffc3231", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988642, "uuid": "9afe81d4-1dc9-44f7-85d4-f88265774121", "value": "T1F0E33B46EA414B13C4D62775BAEF424533239B6493DB73069928BFF43F86B9E0E23605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988642, "uuid": "8771421d-fc8e-4e54-8284-ad8e34d576d0", "value": "3072:JhkvVURs8Oa5gCxCi0OFcV4x/zvQkvXpioM/9QeO:DkvVas9a5gCxCi0+c+jQkvXvM/9QeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781988642, "uuid": "d5e917aa-6a3f-463c-b40d-109b4bd2ec2f", "value": 144334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781988642, "uuid": "2c63c251-6d9d-4a68-8bb1-0346091b236d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988642, "uuid": "0519c0c0-da97-4858-b891-be8721bd4fea", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e9c1ac-6cda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781981933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981933, "uuid": "b30801e0-808a-4964-8196-aea9d3c63c66", "comment": "Malware payload (Mirai)", "value": "59c21ad2fd35dbfc4c75d660f1f2b184", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981933, "uuid": "a751c1a5-06e6-4bf1-9b8c-ba8c2fe7cabb", "comment": "Malware payload (Mirai)", "value": "b187869c3dc6e0f1c3b6666867c26be9d5e728ac8b0aa88554078ad3feee2003", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981933, "uuid": "a0fd3f32-05b9-48c8-bfe8-c8e5ec6f714d", "comment": "Malware payload (Mirai)", "value": "3ecf048d32c19c46f3b076e9104db52bea8ff1d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981933, "uuid": "8db7aa0e-92d7-4259-af0a-516f047dd7e7", "comment": "Malware payload (Mirai)", "value": "f3d3b4f78d536e21571c1e4c9f2eedc02282bfb82abbd37496b7353a5c0904a9977b025a8460adfa7ce9681e036b53a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981933, "uuid": "f5a31d47-68ed-44e7-a622-a9440dbfab74", "value": "T189342B87F900DF7EFC0BE37244674915B130BF6A18620677F122BDE6AE290D5192BE85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981933, "uuid": "83499696-5ca9-43be-9e1f-f9b31f0d4f33", "value": "3072:wqgVIOAS+iztekrinjxXFvr/pJTMy/ERp6mX6CT0TOiGk6Ex4VdjbiTL/iBglpG9:wqgVIOboTdOy/gp6mpTKGZExdLagGKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781981933, "uuid": "76594d5e-88ac-4a99-9443-c6b136209b40", "value": 232184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781981933, "uuid": "afb50481-a02e-43a0-89a1-68eed132b61d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981933, "uuid": "820f637c-1f59-423d-acd0-194227c4a52a", "value": "bin.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e669abb9-6cf2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781992592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781992592, "uuid": "c0c025cd-9bc3-412d-a02c-4cefb21e6941", "comment": "Malware payload", "value": "40cbcb6bf953f2953581757420fced18", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781992592, "uuid": "de77cd04-6338-46d8-8d2f-88627d1c6cf2", "comment": "Malware payload", "value": "b1d863f55530e9f30b6d80d9930a638581e6c00674d5e25cb38b88911cc0ccba", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781992592, "uuid": "1da7756e-cd95-43f1-b0bb-a1349f978ab7", "comment": "Malware payload", "value": "900beabe327834536b897d67287da1f3c54e0b2d", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781992592, "uuid": "a41485c3-14b1-4a8d-865b-73e7e21180a3", "comment": "Malware payload", "value": "bf47bbb95596102de754907e4768ec25d87966c9f4180f9357dab58359584ab4347c06e06169c04594dd835f9df3808c", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781992592, "uuid": "ec8a0861-2cbf-4e3d-9256-b3299f8f9d2f", "value": "T1F1C61295A4D5C2FDC845C470E24829FDF0DA78594EBD593B7FCA88122971C48C8FABB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781992592, "uuid": "e406dfe7-9ddd-4fcc-8568-144a702750aa", "value": "64a82792ae217a318cbb528c890e0d46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781992592, "uuid": "277ca29b-440c-46e1-bfd8-f9148c57c26e", "value": "196608:ix/2hUd2I5mhmEaFF+dTDs6pOyVhNFrHMWQIFFkMMs2xHnUX3oUW2D1odA4MpOjx:i3dDDEoc86pOyVhTrHMgFPMJSX3dxh90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781992592, "uuid": "9207bd59-f252-4298-afe1-fda184aa7f66", "value": 11991040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781992592, "uuid": "af312173-ca7a-4e7c-97ae-dddff655cf43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781992592, "uuid": "c646230a-a7eb-4ea0-9825-3e36ded45217", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc54c0e9-6c3f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781915696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915696, "uuid": "980109a6-ec70-413f-b4ce-a0894ae56b9f", "comment": "Malware payload (Mirai)", "value": "59e32f70d424764063dc1a055c25e4bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915696, "uuid": "b20a7aec-d973-4b38-b22f-925063bb9ae3", "comment": "Malware payload (Mirai)", "value": "b358ba81091f5d327c3d9de935870273365ec32086523bf6e31187a5ab02e15c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915696, "uuid": "a8cebee0-b32d-467f-a3a9-9909dd6f9876", "comment": "Malware payload (Mirai)", "value": "9b856023c7994c9f94657265627a21dc07523e57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915696, "uuid": "3621a058-ac2d-4450-bb9a-a85f434687c4", "comment": "Malware payload (Mirai)", "value": "6115f43ebf39f2b7d833a8766f19f0f974b2ed692c82cc95f70ae0ddfb561ecfd60632888046a52e498fe997d4ac30cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915696, "uuid": "fdf0489c-cf25-4d64-8d57-f064768d995e", "value": "T18A13F775B812B5B8D5EA0038E00B71B62D9312CD3688E3E3A17A2535FDB6705BDB5E0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915696, "uuid": "a32d2698-43fc-4dca-bbc7-9902fddbfab7", "value": "384:cfe+qgQ/anY03TZtiUPcRN/tW8Lo/KHx05N+bcFlBoRZInj0myxohSxZPtKUekTI:cfeobnY03Adodlf1CkaCryi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781915696, "uuid": "69a9123b-7f2e-4e8f-b374-27369be2752f", "value": 42572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781915696, "uuid": "27222138-4272-4a5d-9a8a-c16161e99f92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915696, "uuid": "d82dcd21-6d79-4042-b490-84ba1a139d04", "value": "godisdead.12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f07284b5-6ca6-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781959967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959967, "uuid": "033dbc0c-813f-42aa-b95b-5c2bf7666e3f", "comment": "Malware payload (Gafgyt)", "value": "5bc2bda37773c456b56a873da8832b0b", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959967, "uuid": "8efb20ef-ca00-4f71-81f0-a91506c4f346", "comment": "Malware payload (Gafgyt)", "value": "b4d45c2019de60043a2ab17a93249e26e90d0987fd9606dba34e62ca0340b02f", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959967, "uuid": "a2894e9e-1154-458d-90a8-9f7f41bf74c3", "comment": "Malware payload (Gafgyt)", "value": "39297acdd3d95ec76abad7edfa0a77018c067f1a", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959967, "uuid": "2e18ab06-f581-4a3f-a8f4-399bd69ead84", "comment": "Malware payload (Gafgyt)", "value": "f1c1f5d7f2eea35d1f1422506434c57dd96b824b819bc9edaff7e83186a1ea3ef9f7277cd6ad4a9c1de273687d38d887", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959967, "uuid": "8d2c3b99-4c2c-4fa4-b617-6aa39f9673ee", "value": "T169C3F705FC404B27C7D23BBAF79E438D773566586BD73311AA296EF02BC5B882939160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959967, "uuid": "db1a1c79-e1c8-4fdd-84f2-d5451512e9ea", "value": "3072:3FDcpqlgQSnoHymKg7ucpGQZVY5hLTsvnEDXlSSYz3oCxDQlD6ObAF5R:5ucpfPY5hLTsvQr+oCxDQlD6ObAF5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781959967, "uuid": "3c71af82-aaa6-4ced-8e8f-d546c722c8f1", "value": 120867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781959967, "uuid": "7e234ce7-95d7-43cd-baeb-97d11b7d4e4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959967, "uuid": "28f4d1d2-d7f6-488a-bff1-1ac927df13fd", "value": "assailant.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e68856-6cec-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781989776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781989776, "uuid": "b529705c-2a91-477f-9b05-0c0927f5cbd5", "comment": "Malware payload (Mirai)", "value": "494c35b1e8cf30ba061b5e8427935c02", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781989776, "uuid": "59b2a0a7-37a9-4310-a4f9-b332bf1efd2c", "comment": "Malware payload (Mirai)", "value": "b67542ebf7ea604cd661298d3e8dfb0e49592ea342267a4c1320363cd0afed50", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781989776, "uuid": "54f59b61-b88f-4f0f-902a-bb9b0dd00ceb", "comment": "Malware payload (Mirai)", "value": "00d39e462c1b4ed7e528cac6c07a97075fe2a9f2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781989776, "uuid": "c5b2417c-d81d-4735-ae02-2b2f41fadb6d", "comment": "Malware payload (Mirai)", "value": "3c3cb688853697dccf27a26df3b27cd77d74ff19f6f959f46e0e4f68208340f042002cb7a1f380d657cf74598d0a98cb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781989776, "uuid": "8bcc9458-d7c9-4f43-af32-954e751842e1", "value": "T18F3181DA01245A396202EFEE77B32548701DC5EB285BC7A5DC4C0EDD52489CCB265BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781989776, "uuid": "ea0d39f8-54a7-4328-a50c-7d06ae189df7", "value": "12:UxL6x5B15j69SOnX76UAgcy6z6iiAVKHx659ZMGlr6XX23w3i63/oJNWI6NWf4y2:eI5B1AnAghKjUGA23aNgmcfzQIW5KXVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781989776, "uuid": "5d181a6a-0e49-4ae3-8bfd-4ea2ad8cc867", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781989776, "uuid": "806b677b-680a-4dba-aa88-07f693df48ce", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781989776, "uuid": "f2447005-100f-4000-9b01-0af5e0d7e446", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df77e5f-6c4a-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1781920208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781920208, "uuid": "9d68be9d-af01-4c75-94a1-893807fd09b3", "comment": "Malware payload (NanoCore)", "value": "63ab7828b518397c0b01596c92a0a0b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781920208, "uuid": "0888c0fc-9890-44f7-92ca-337e348251cf", "comment": "Malware payload (NanoCore)", "value": "b8431716195045f269fabd7d4e58fc37d24281a7bc0e4af3ce5424276add5792", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781920208, "uuid": "56ba528e-4e42-40bc-b554-f78499b4f3c9", "comment": "Malware payload (NanoCore)", "value": "c7bb21bf48c0c879b9f382143b94c9e16bd6c81e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781920208, "uuid": "34016fc7-3861-478a-8292-b50d9b545440", "comment": "Malware payload (NanoCore)", "value": "5e6233d684ce783c535ac06f7acc9cf04afbc1589e10f88e47589e1bcdd3f1c43ea99a81d95ef5aa51752bbb02160b27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781920208, "uuid": "440019ad-3da7-4548-ac46-a5390e118488", "value": "T15514CF5677A84A2FE2DE867D611212169379C2E39CC3F3DE28D455B78F267E00A0B1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781920208, "uuid": "78f4dc6f-0bd4-4cd3-bd13-7c81c66a02d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781920208, "uuid": "f63b0911-d3e4-4e36-817a-2e598a2f6cf0", "value": "6144:sLV6Bta6dtJmakIM5x6V2qhLyNPYTbEjg:sLV6BtpmkaM2uL4YTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781920208, "uuid": "5e1745bf-a75d-44d8-95db-9ce7a713b7f7", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781920208, "uuid": "fd363973-6994-4997-8136-fffbe8a29866", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781920208, "uuid": "0b04c46b-0807-4a51-a506-c1dc81ad6486", "value": "cnyelc.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bbaee12-6caa-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1781961516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961516, "uuid": "d425357f-45f2-4c44-a2e6-ca8503bc5d05", "comment": "Malware payload (SalatStealer)", "value": "edc2b0119fa8b56272bc613dca7c6a92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961516, "uuid": "9ea22ff5-4581-495f-b3cb-129b7f99c792", "comment": "Malware payload (SalatStealer)", "value": "b9f2ba742e2e227a55912746acf22992d2dfc416d3877665b83abf0bc3e3f093", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961516, "uuid": "965e057e-c70f-48ef-b010-e3b9bf8579c6", "comment": "Malware payload (SalatStealer)", "value": "ded7a484d242d344a7c5f06638f87e9cfa19a870", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961516, "uuid": "71625f1a-8912-4399-bd33-941f5bfa9aaf", "comment": "Malware payload (SalatStealer)", "value": "e0da0922e050205f2469228f6b02e604781f7c08ffa9ba9a17d10c0a66e7bf39545c1f6d415bbf0f1fa3366c4e861c55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961516, "uuid": "f10c9546-9abe-4e03-811e-e692697449f0", "value": "T10616239D7129CF91C0D1583E09715E8923FCA3918B28877B244CC9286DFDED45AF8B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961516, "uuid": "e79ea0bd-7e3b-4e1e-af40-39024a5aa79e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961516, "uuid": "0bf8d89e-7e60-4cf1-9a10-45754b3b018f", "value": "98304:iD/Xb5APHV9Zv5OdXQITSysmH5pD/sq4Js9+H:o/LGrZv5gFSyFZtsZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781961516, "uuid": "79447263-3f36-4729-8b30-f31909c9cf3b", "value": 4386917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781961516, "uuid": "ed8a4684-0810-45d5-a50b-ca629dbbe765", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961516, "uuid": "adce3c14-90d1-4957-b0b6-66e33e483bc7", "value": "RKNBYPASS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93fa3d94-6c3f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781915574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915574, "uuid": "f7c2edac-c6c1-4b7c-a141-8ae053490b1d", "comment": "Malware payload (Mirai)", "value": "3e8baa78da4558ee69b8958c7f9734c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915574, "uuid": "5aff22cb-666f-41a3-979e-7271d8e83d39", "comment": "Malware payload (Mirai)", "value": "bb176204541634ab21caa428f8adc1cfb743d7a1350f550750a6745e5f4d5837", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915574, "uuid": "91235c04-c39d-41e0-9f87-b7c9164057ae", "comment": "Malware payload (Mirai)", "value": "3dafcd7bd72c6a97a3882f7074126cab936ebbd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915574, "uuid": "97300ef6-8085-423f-8ef6-b3806c1feb80", "comment": "Malware payload (Mirai)", "value": "4f1c1bb31fdfdb5b09a76755e38647943c3a8bd131e44ffb8947b32c8bd012e93d1ec3de464336259d1e8e41ecf7c531", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915574, "uuid": "576a4b52-3a69-4eec-a4a3-c20de260e5e5", "value": "T12113518CF929633FC3E276FFEB8917CE267A07C8679B7626C634425537C9304A825914", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915574, "uuid": "626c7f2c-2409-45cd-a179-4de279e4baef", "value": "768:gGev1dwekER0uWFMplNO8/WdEoLlbmnNm/nwrUjkcbl6/i:gGRetlWwXZoLUNksVil6/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781915574, "uuid": "6d690d6b-1348-4856-a0fb-c54ebf769a2c", "value": 44243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781915574, "uuid": "7918d06b-b3a7-4e29-b15f-625b33e38767", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915574, "uuid": "0c960b40-dcff-44ad-bd86-4df3cd0e79f9", "value": "godisdead.7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d28cf5b6-6cde-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1781983969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983969, "uuid": "cdd877a8-4fba-422b-ad38-e86c00c11196", "comment": "Malware payload (RustyStealer)", "value": "d0541c8b7fd74b0f5dfeae5efa574216", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983969, "uuid": "3a1a545d-0708-4cab-ab7e-7cf6f00f73cb", "comment": "Malware payload (RustyStealer)", "value": "c06c3002302f47202884762c57982d86718ba4500699e9ef37d5cd513c6e8bf8", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983969, "uuid": "d78dc53b-e89f-4133-9013-a3109e5a0b61", "comment": "Malware payload (RustyStealer)", "value": "006e2982a742a5085e87985e22dcff59fa5d9647", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983969, "uuid": "f614ad3e-e79e-4db8-ac53-3850a2622e8b", "comment": "Malware payload (RustyStealer)", "value": "a716a771216944a185bcada36c7913d29ec5e746cb3dcaaa5af6d09a2ead30384a82aabee3494bc6a7fe0053df2594bf", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781983969, "uuid": "0d8667e3-3228-4abc-9c4a-2483374fbea9", "value": "T17E264B03E2A541E8C09DC179C30BD637AB76B88A4631B29F1BE81F612F69F506F1D749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781983969, "uuid": "7ee534ee-60d3-4960-8a58-b2bf7309f047", "value": "a30c78a48c548a65b4846cfd9d8c7138", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781983969, "uuid": "b9ce1e37-4b85-4abf-a72e-d7686f242a58", "value": "49152:riHDazMZq/LXnxsCCGByl9Ah/uN0D8dfOBVgcjKoeW7Zi5u4KW7r+Da3dtUxnkdY:2HSGrQFpgIKscOi91Ehys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781983969, "uuid": "1f90dd75-296a-43b3-81c8-a1f3fa00388c", "value": 4855064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781983969, "uuid": "1ee3c4e0-b625-469c-b4cc-23d270cd82af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781983969, "uuid": "de4b5ac8-47c8-425f-a018-5069da48d360", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c231d459-6cec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781989955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781989955, "uuid": "a9f86634-b27b-4c14-8eb2-690474108ba3", "comment": "Malware payload", "value": "374dd1a0c17e07b501e7537b01869d9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781989955, "uuid": "902f9ace-034f-49dd-ad81-adc5da5941ba", "comment": "Malware payload", "value": "c1ddca8512611169717a8f9dec04cf8a5e5636d49fbbe33f6e80c7cfa8891023", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781989955, "uuid": "c1e077e2-e564-4d87-917e-a17548e1a698", "comment": "Malware payload", "value": "133732b9a349dff2a89c84572b8cae6f99757b5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781989955, "uuid": "5a252e02-702b-47dd-90aa-b18c7f654493", "comment": "Malware payload", "value": "bc8d0b1fd4564f34f0438ca2877a1b16f47b12a7605d6dcdfa45189b15c2336a0445d3d7c2eb58e77a17832d1f915c99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781989955, "uuid": "6dda588f-f477-49d2-a613-46f59e899c1c", "value": "T1F074194AB7618FA4E378C13006F74BA6A6FE256616E244C5D33CEE107E9035CA81FF95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781989955, "uuid": "1f94ebc4-22dc-4580-9596-cf28181e1034", "value": "6144:jbsS2t4BTidyJpY+CDrVy8zzdyIwqrgt2A6sI0T5siYM+KBe:fsS0upcxza5KSde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781989955, "uuid": "afabbf5d-e403-4124-8758-d4e48f6f8efa", "value": 350312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781989955, "uuid": "3882e304-b4bf-424d-bd77-158af23d2041", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781989955, "uuid": "5340bb81-8cd0-4e56-8b44-1abc23f8de9d", "value": "kworkerd-netns-rt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ea3b16-6ced-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781990140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781990140, "uuid": "50ccf16b-b495-4abd-80aa-6ec8715c29c4", "comment": "Malware payload", "value": "883ae61b18863aff8ca41f8cd678eba2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781990140, "uuid": "1ce36d5a-7693-4707-a667-fb6bb8081442", "comment": "Malware payload", "value": "c1e97858d11f97a0157f31aeb413c76ecd9cd96062929e2e659ae9e3c0dc78c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781990140, "uuid": "524a4cbf-7b1e-4f7d-8f3c-340be2226090", "comment": "Malware payload", "value": "8c553f41afa957680b155f7560a2f06621eac497", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781990140, "uuid": "fefd537b-c04c-4c3d-80bb-2e1c8070f310", "comment": "Malware payload", "value": "a28852f65033faf1dfd3ae7dd6ea702b2dd7cd418138273fb07d26c394723b789dc99de6a428906c53b08acf45925bc2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781990140, "uuid": "a6ddbf9d-e882-4e79-8d9e-03386cc9a52c", "value": "T158B30229E53C0981E53DD0F551BFE23066ADD4CBB2F81309F2C85CA02426CF1ADA7A5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781990140, "uuid": "e88fdbf3-39c9-42e8-b99d-4b2a90bb825b", "value": "3072:xd41MFk5CMmOeYtZ0m+yKCrCfofRtLIoa+laT:xd41Me6OxnKCrCw3LIslaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781990140, "uuid": "d2cf955b-1535-421c-ab63-813bd38a1e64", "value": 110344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781990140, "uuid": "50328419-3d0c-4563-a1af-109d6b8ac8e6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781990140, "uuid": "d4b0b79f-9a7d-4b54-b8f7-f76430018325", "value": "kworkerd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa4c866c-6c41-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1781916605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781916605, "uuid": "3a100e61-70b3-4ac4-a237-7053d953f7a7", "comment": "Malware payload (NanoCore)", "value": "10cf94eef24c8932d28698e02faf43e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781916605, "uuid": "b818fa99-8c9c-4a59-a4f5-81e8c353a47d", "comment": "Malware payload (NanoCore)", "value": "c2c8ed567f9c65686c4f6599e9259bd31d2ad984c24cf17ad9ebd9d594dcb0ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781916605, "uuid": "bb0a735b-01fc-4e9f-b4a4-bc74718525d7", "comment": "Malware payload (NanoCore)", "value": "4ccba704170269b7c7ca1ecafe2ed57fd11dcba8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781916605, "uuid": "6dda168c-16c2-4643-b958-ea67bf5f9e65", "comment": "Malware payload (NanoCore)", "value": "64f547b9bf6e6e74ebac12b2f38ae9654e0afdfd43b2ecc66287f4ccd6bd5bc47a98907ac3e0990eb7b0d2cc07fcfc62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781916605, "uuid": "a15d580b-8a0b-4589-b2c7-8eb86ea6ccee", "value": "T11314CF157BA98A2FE2DE8679601212129379C2E3D8C3F3DF28D854B69F177E10A470D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781916605, "uuid": "ee465b97-d8e7-4ea6-8999-6b78d3e9ba57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781916605, "uuid": "8e3f8d45-252e-4cf1-92f0-2ed888875462", "value": "6144:sLV6Bta6dtJmakIM5LZmvN1onPN5rjfmQZ:sLV6Btpmk1vN1MNR1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781916605, "uuid": "afcbcd65-055d-452f-90fd-3ea76cddc1f8", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781916605, "uuid": "f08503dc-3005-45f2-8b36-4b9611e137e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781916605, "uuid": "5430e5e7-87c0-4268-86d9-f56bcfe13a12", "value": "msgo.io.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e1947d3-6ce6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781987317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781987317, "uuid": "c6c613c9-3749-4f11-928a-a152f21292b4", "comment": "Malware payload", "value": "3d82d846802dd2b38d95e5438a84fe33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781987317, "uuid": "01e1f967-ed2b-413a-a37c-22db2ad4044b", "comment": "Malware payload", "value": "c32470f4960e3267292b81005f792a1755d7b708aec15d083f205cc978f3a6e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781987317, "uuid": "c1591bbe-e284-4cec-b897-108bd18aa0f2", "comment": "Malware payload", "value": "8047e7d3932e066927fcc21e3f16290fb3533c48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781987317, "uuid": "adc53482-401d-48f5-9bd2-44146bb58599", "comment": "Malware payload", "value": "bfe745d32494f8968eb49f0a123bdc30045e2328b9678292a4b58ae117e44543cecfe21b6cf2d2262efadf21df4aa5c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781987317, "uuid": "71a34167-6b46-4ea8-bfd7-1c331bf74468", "value": "T1E4645C02FF841E53C5411FB15D7B07B6A3AD48816CA9E03D9E0ABF2506738B9A5DF389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781987317, "uuid": "259c16cd-02c5-462e-b21c-3ace58815574", "value": "6144:Z0KiA/7+k33ZIZrqk3d6HtU0GdVGa4rTX1cCJGu72MWLQdufRYGJOJS:ZJywZa6vOJRjAJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781987317, "uuid": "e2d4c213-fee2-477b-8508-15ff14831afc", "value": 329176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781987317, "uuid": "f5369d85-7a06-4253-9bfb-4d22c748347a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781987317, "uuid": "cb39504f-b3b2-4bb7-8c5c-b429853b330a", "value": "kworkerd-writeback", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf7138e-6c83-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781944929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781944929, "uuid": "4bfb688f-85e9-4b14-8728-6c7f0d72eb4f", "comment": "Malware payload", "value": "2d54a387c2823b3ec41e4b4e1d259165", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781944929, "uuid": "6a2119b3-6bff-4f74-ad1a-d3f683396d95", "comment": "Malware payload", "value": "c5f985054eb72bd63eae3cdf00fdc073b23fd1ac2a94cd24011cf4f5517f4e2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781944929, "uuid": "ae5eceb3-9471-41f1-99ad-e9c1e4fe2353", "comment": "Malware payload", "value": "362d0f5083d7790bd1934c70da9ed6a31686ec55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781944929, "uuid": "d6667960-de01-4563-9600-9aaf248459dd", "comment": "Malware payload", "value": "ba97ce8f800d61f9141c29fd0d640cf0499ae9ce9be69ec3d0db2922954b88342a51e290326d3818637b58919dd23978", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781944929, "uuid": "e8c25c20-583a-4976-90af-10b4d3c7397b", "value": "T18C24E806AF510FFBD86FDE3702E90B0529CC595722A93B3A3674D928F54A50B19E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781944929, "uuid": "5fe3ae28-c79d-41e5-81e6-66a3d774231a", "value": "3072:6yFbJ2Zcm+yol8kwSgA43BhbSSGRLYlcIfg+ob:NFcOttlnwFBxAR6JPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781944929, "uuid": "06e3630b-273f-48d7-8da7-1c85db31e43e", "value": 222676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781944929, "uuid": "f64ecb59-7f3a-4b67-ab35-285d7c8a004b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781944929, "uuid": "339bdadf-d642-4604-9a5d-82deee09768b", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d43c4fb-6c4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781922301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922301, "uuid": "a471e204-6562-4279-920a-2806744d1c99", "comment": "Malware payload (Mirai)", "value": "2738efbeb074a61809c056334480c002", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922301, "uuid": "8500280e-5b5d-4b56-a1d9-4be38fccdb00", "comment": "Malware payload (Mirai)", "value": "c797ccf51bf58e3d76ef3d64f7836da09d89a1caebed7566398232f03aec8045", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922301, "uuid": "cfdfb428-ddb2-4953-8951-248be8346557", "comment": "Malware payload (Mirai)", "value": "fcb075049284f55675d8e2a92b8fccc06800b29c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922301, "uuid": "cb32fd73-fd8a-405f-b6fe-e28a9b3412d6", "comment": "Malware payload (Mirai)", "value": "e6b6ff6b4ea81e3255a6167de269959c978fc7e61ba4eebbbeb6db59f8e50ac9dc302cb5ea3db6872d36edc840d2f041", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922301, "uuid": "4f235815-308d-453a-a263-3aed988a4d60", "value": "T18C831212AA53DD718E30A4728D6C5780068692E9D5FD70F38C7A8DF4B34869235AEFC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922301, "uuid": "2c695741-1539-4b2c-af77-8375fae6ef17", "value": "1536:z0ax7OWvNmIdCgtLfF/MaZGCy1+7rXXAxDEmYQZcKH1iu198eZJs3XIqiENKLA:z9x7xnfF/Mag47rXXABEmBcW198eZJAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781922301, "uuid": "89684e8e-5fb3-44a4-a002-fb8c0c4c19e6", "value": 86048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781922301, "uuid": "268a110c-0b15-43e9-8092-78c230f49bee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922301, "uuid": "930256a8-07d9-4011-a888-1592e8972146", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a53bac6-6cab-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781961836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961836, "uuid": "d3988f8c-2dad-48c8-ac85-3f03fde0bb3d", "comment": "Malware payload (CoinMiner)", "value": "cbb52530c3719b037e97c552abffc626", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961836, "uuid": "6d76139e-1da8-4f8c-a095-4bfe83c81661", "comment": "Malware payload (CoinMiner)", "value": "c9a93549b2b5999337eb51e916a489456466b0fbaf6d3aa27bb45cb28ca614a6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961836, "uuid": "7231dd37-56f6-48c7-b173-6ac2e547c918", "comment": "Malware payload (CoinMiner)", "value": "341b470efe14cdd2601ecdd8ea7e723aeca8c9bd", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961836, "uuid": "32b74753-c626-4366-b0e4-4493d0b27cb3", "comment": "Malware payload (CoinMiner)", "value": "b0871cfd11a16081f1f2b242d5780b9bdbaa1d9afa3e8dc8b6da5743c6ca31c2f3b450a29ca149e4d8d787586d1beb2d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961836, "uuid": "256e2ec2-70eb-4c06-90c4-b92759174384", "value": "T17CF53382024131FDE4EF8A3C626EB71503A7B2925F2269EF0F6965553D23EC29935F1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961836, "uuid": "9251029c-73d7-4821-ad8b-aab9653b8b2c", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961836, "uuid": "e8d233ed-e901-4df8-b8c7-8e0004610ed8", "value": "98304:wS/61HgUVpNxHtEFDuLzrhYjdQNNT6j7nU3RGt:sgi1KFDuLvWpuynU3RG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781961836, "uuid": "ad835c61-37d8-48e4-ae78-2e7769c6c977", "value": 3445736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781961836, "uuid": "6ac7b126-77b8-4603-b915-a1d9cdbc4c9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961836, "uuid": "fcaf38b0-cb83-4c0b-8cbf-85853bdedc4b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a18e16e0-6cec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781989900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781989900, "uuid": "186984d9-239e-4446-b490-f174c02c2f98", "comment": "Malware payload", "value": "795adf4f8743adafec502c86f884e620", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781989900, "uuid": "aa21246c-3944-4409-87b6-09f555cbc5b8", "comment": "Malware payload", "value": "c9b09ab0ba66f76f8f4cfb00e34a941672dd84c4b535c3f328cf806d6a45cd9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781989900, "uuid": "f94465f5-2f5d-4525-906d-7725ef9ce6c3", "comment": "Malware payload", "value": "d8f753d37d9b5969f1b0539a92c8b608703343b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781989900, "uuid": "517f3f59-7e54-4029-8110-a387bf64d62c", "comment": "Malware payload", "value": "7b9a04978700fbdf0b016a444de8a957c9fe30ac1a3548f55947ce13f8770c9476e78db1165b5147a72849c8878daaad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781989900, "uuid": "fa64ee7e-233e-4eb4-89f3-e16eb644ca1e", "value": "T191D313CEF8169DABFB71D0FD858C0AA47B35863CCBC58B0A56C003E76912297746C5E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781989900, "uuid": "17448d05-3220-4d1c-80de-7f3b960408b1", "value": "3072:6zk6D7aABiA4C02UmmV2cOn8aizwImaV1PB28+F0uvxQT976GgXVr:6zkouABiA0R5OnNusD0uvy76llr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781989900, "uuid": "1825de0b-912e-425a-b7c5-773f9a85922c", "value": 138428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781989900, "uuid": "0944876a-8368-4276-afa1-b4caee8ff812", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781989900, "uuid": "241653d6-f6f0-4810-b84b-0377f75fea67", "value": "kworkerd-netns-rt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51da610c-6ce8-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1781988048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988048, "uuid": "f61efe7d-a0d5-428f-a24e-4273a4fbf369", "comment": "Malware payload (AsyncRAT)", "value": "1b37fb289ad1e3da62510caf740de1ce", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988048, "uuid": "229cc09d-63fc-46c8-9ba0-9a8a1daf1705", "comment": "Malware payload (AsyncRAT)", "value": "c9eadf5f3be0996c41ad4c42f7bf530b74d8682ac630cea018dd0edefa07d4ea", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988048, "uuid": "36ecef48-011a-4fb1-b182-15e20d6b1764", "comment": "Malware payload (AsyncRAT)", "value": "0468dca0ebefd05537dfa9a770b7c9e332aa4093", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988048, "uuid": "6c485f61-36c9-461a-80c4-a83d0d97493b", "comment": "Malware payload (AsyncRAT)", "value": "357143b44da3be89935247d6dc5a2256f8b6c0022b0fe37daa925f9b44c2c79927719b9ee9ff790dc0cd233f20c9b375", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988048, "uuid": "d10edd41-c806-4639-9b07-bac3f98936e5", "value": "T18B233D003BF9C12BF27E4F7858F22145867AF2673603D54E2CC4469B5A13BC29A525FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988048, "uuid": "bd053911-1114-4cd5-8b33-702dc8125d86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988048, "uuid": "64608b9c-6d56-4183-aefa-80e9b3c82da7", "value": "768:kuSEa5TAYOTSWUkC+zmo2qLnrSBHYPrUmIPImXQIJXOBjr0bEDx/wreq0YlAm+dS:kuSEa5TAxv2qrSGrUamXLp2gbEDx+eqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781988048, "uuid": "7a05dd02-7614-4f3c-b015-1e453ee98415", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781988048, "uuid": "34bb4d44-b98f-457b-9243-90872b33fb7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988048, "uuid": "55b411f6-c163-4740-a85a-6ba2b437e90a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1856f768-6ca3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781958316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781958316, "uuid": "aa30791c-8197-4d39-85c6-ef8afa030ab0", "comment": "Malware payload (Mirai)", "value": "13a64640278be934c0e51675ecdff086", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781958316, "uuid": "ae02a8e5-7a6a-43ac-b567-d8513c0f44a5", "comment": "Malware payload (Mirai)", "value": "c9eb5b9857ff46708da77c9a68c4358b21624dbf96af1ade201653db4eb2dcf9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781958316, "uuid": "b49e757e-fc13-4c84-a12d-972103161263", "comment": "Malware payload (Mirai)", "value": "f546c81aaba26b6032ee38b828966043ecab6a44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781958316, "uuid": "c4ba27f5-cf1f-4eeb-b57b-181696e82ae1", "comment": "Malware payload (Mirai)", "value": "cb2378c6f10a2c1efbe38d41b9c2cab1840b2872ebcf9c65c2d1acfe2fd4b73f3f82ec6f409c53b852baedc3b3b805c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781958316, "uuid": "073a5399-1c42-4402-8e76-32fd8ead57c2", "value": "T196F65B47F9A618E8C09EC470866B9653BA717C48072177F72B90B6342F77FE05A79B20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781958316, "uuid": "fb2bf76c-a05a-409c-8421-d685df5da7e5", "value": "196608:PFmEj0YPl4lcmDi1WIPFCBNcJ7oEkLsQXB:PXj0gOqUqFCIkLsQXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781958316, "uuid": "729833bc-2541-4db7-9bda-1990e23671ee", "value": 16740514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781958316, "uuid": "004cbb21-7b75-425c-869b-3aea4fc814a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781958316, "uuid": "c6465233-f081-48c8-99f6-68ede672eed9", "value": "SecuriteInfo.com.ELF.BitCoinMiner-HF.12873485", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a321a8d4-6cec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781989903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781989903, "uuid": "14241e91-7f4c-4ced-b503-78f882524493", "comment": "Malware payload", "value": "123ae9e2bc9d4cd191e04fdbf61d64e4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781989903, "uuid": "812d5f1f-dab4-40f2-bead-a6abd0ec66ae", "comment": "Malware payload", "value": "c9ede3834a7beceb195f105766eed01c3cfbf146d7982bf659d3ff75ef7bafa0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781989903, "uuid": "3f8ae76b-a365-4c60-8b98-a8218384e17a", "comment": "Malware payload", "value": "8b1a628ea29817678c8b1411bde385460382e9d8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781989903, "uuid": "fdc0677a-35a4-40bb-9d84-7b8d0d4c708a", "comment": "Malware payload", "value": "300b19f761b5defd5ed5c67b2610f847b5ec979dfc8b31ea6825ec83bd65f50e525733a502198ebae9622f5ca73150a0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781989903, "uuid": "b496f4fe-53bb-486e-ae5d-a6f098b5d092", "value": "T183137D6566813C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781989903, "uuid": "b96d54f0-b368-42fb-a561-f324117934d2", "value": "768:NXRWNGxV09GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:3lxnco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781989903, "uuid": "c3edc072-07c8-4179-a697-a8a49634cb9c", "value": 45525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781989903, "uuid": "295373db-2184-4667-a21d-3fb1b6f7e5a8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781989903, "uuid": "621c67c5-ab3a-4f3e-ad6b-e1339e1b21b5", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa4868e-6ca7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781960422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960422, "uuid": "699b9806-76c4-4823-9651-615306f5b33f", "comment": "Malware payload (Mirai)", "value": "2368ac3acb08766f54a6bf55852b6cc2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960422, "uuid": "d126a531-03eb-499a-bb81-d39dc18ed077", "comment": "Malware payload (Mirai)", "value": "cac16de59cd6c00305f0d9a8fa5a2adb5e4dac2dde02b78705f126a94546fe85", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960422, "uuid": "6181cd89-f716-46b7-ba37-7e5e91c57f00", "comment": "Malware payload (Mirai)", "value": "337fc7a94259d4a117fe2eb35ba9184feb83ec89", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960422, "uuid": "e9f317b4-8a8c-4269-90bb-245c81d79616", "comment": "Malware payload (Mirai)", "value": "bf826e3491d8953567382d4b99c1bef1ff24b6f01aeb3dfe5b7cc88444a8e14b1f73d82e0dc82332f73845f33f42a3fa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960422, "uuid": "c396b005-fc39-4bf3-8b2f-ec1a91c692c0", "value": "T1AA5188C6108177326DF6DD32BABA88157280D09B64CFAF999DD8BBA984CDD04BC51743", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960422, "uuid": "ef0f6a63-480c-4319-8edf-c285e7dacd37", "value": "48:iplrpcSEp//3pghpKlpitpsTOsTGFlpNbpKhLpvpJpA5rpatpnzTpp5VpGSF:i/eJywYOdazX+LVqkRjNF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781960422, "uuid": "0f3a35d4-a8c8-4725-ab25-cebf4d681dac", "value": 2759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781960422, "uuid": "25aca229-b04f-4c2a-98e6-9375c70723d3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960422, "uuid": "e2387094-aa1e-4093-80b2-d0e56e44359f", "value": "nz.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28864997-6c87-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781946318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781946318, "uuid": "3b775115-8aa7-460f-bf90-77aa6c0e4eac", "comment": "Malware payload", "value": "47bcbf2fe5a385bf3df9d8a726074a18", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781946318, "uuid": "3def5cbb-a6fa-4cc7-8a74-fe888865895d", "comment": "Malware payload", "value": "cbd321f8ac5eb6a67cf1506b9447c8bf02a91da29558b1197fc023d02110da6d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781946318, "uuid": "5a096abe-dae6-45c0-8d30-aa42ffe4a17e", "comment": "Malware payload", "value": "a1355a16df759f563c48c8dac060cbfe1f520d3f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781946318, "uuid": "918ee1bf-4181-4157-91e6-909681893a97", "comment": "Malware payload", "value": "1dd7b6f6a516dee4e4be6d0ea6e29d7949de7fd561a6cbef7ff98aaa9cfb61f58c2ed73d3658195cb7a7e93da514bfec", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781946318, "uuid": "701e3f16-7ecb-4b28-a64a-17c6120ef8e3", "value": "T1A801C6DA87509A104069DB1E629752A0B811D3CE0A8B0B747F9C5D3DFB88514B056F48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781946318, "uuid": "4988cbc7-dcb2-4d9b-b539-a2358de9fd27", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaT80FC2QhCwyVx6CEzigC1xxCzUauD:kXCKysE2hi0ziQvZohaT88YRyOyguCU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781946318, "uuid": "5f2e2a6d-6ba6-4adf-8ad7-0f4943fa51b5", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781946318, "uuid": "2fca4559-bb2d-480f-a411-c4b62420394f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781946318, "uuid": "b5e6e2fe-6f13-440f-adea-c1e8cd089560", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f28e9d33-6c8e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781949663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781949663, "uuid": "446577d8-0a1c-4c84-9708-2bc5d466ce80", "comment": "Malware payload", "value": "2cf0986f83d179581aa1d217376825a9", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Convagent", "colour": "#441F96", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781949663, "uuid": "596f77a5-c8d8-4014-a200-5babad42f7c3", "comment": "Malware payload", "value": "ccd6f66f1854d7e5a5721fd27f989250e30df4c688e5df9391a0fa341ed6f796", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Convagent", "colour": "#441F96", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781949663, "uuid": "4b05c090-a5d1-45f3-b508-d2e9a1d7c048", "comment": "Malware payload", "value": "4d386b40955ff1fb55c31ecb45e4a5f6b5923d37", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Convagent", "colour": "#441F96", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781949663, "uuid": "74085016-f479-4e71-bab9-8d6d979d4609", "comment": "Malware payload", "value": "7e949c96989d747cf201c9d8cdbfe39f6de77a9ba066ef63090121dedb561ef1f2f2981294fb9f0f10d1b7484fac2dc8", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Convagent", "colour": "#441F96", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781949663, "uuid": "1e643cd6-be43-4b35-95bc-900a6a6864ec", "value": "T115F5184329DB0DE9DED677BC62C35335A778FD328E2A1F2AA604C13129536C56D2EB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781949663, "uuid": "89778995-8ca5-4b77-9b07-60873706f2fe", "value": "9b0dc33bab417a1f674e6f4b6afd4b59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781949663, "uuid": "6569fe3e-aeb5-40f0-823f-05135ff8e5e8", "value": "49152:HRZlTVSz52SnIMIL0pqeeb+1Mjm7XpoUJEeilQU6:xXhSnIMTa+X7XpoUJEeilQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781949663, "uuid": "d5c319c1-01e4-4286-9be5-a23258d44d15", "value": 3414022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781949663, "uuid": "a2ed9ea3-4ba8-450f-8488-1970c6e28f63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781949663, "uuid": "2209e0c0-4f6c-4ea7-9807-ef40f3356e26", "value": "Latest_Version_App.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e9a37f-6cb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781966070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781966070, "uuid": "3e4f6aa1-940d-4284-b56c-aeec7c401fdc", "comment": "Malware payload (Mirai)", "value": "e6c3a524904ace48e41a7f6a1fc3a846", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781966070, "uuid": "f7249f5f-c290-4563-8f23-52d2bdcbcddc", "comment": "Malware payload (Mirai)", "value": "cde07a761bdc6f0fc790c730fcfa663bf3122d9371da57264accc1206faf025f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781966070, "uuid": "1b8c5e3a-41a1-4bbc-a685-156e31229147", "comment": "Malware payload (Mirai)", "value": "c16f26e6269f65c21fb3dcdbe106a68921fe00f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781966070, "uuid": "0b62f355-5d04-411c-8052-81d983620ff1", "comment": "Malware payload (Mirai)", "value": "a05b94eadd817a0004e8b709d268092a57d4082fc949d3ea0ac8be401f7366326184ca015119fc91819399f7f17cf253", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781966070, "uuid": "4a710964-905d-41d3-b157-27de0502e84b", "value": "T120443A42FD419F13C6D6267BFBBD828D331717B8D2EA310389259F24778E85A0E36685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781966070, "uuid": "be3fd863-defb-4ea2-b2b9-2d44acc131c9", "value": "6144:tD1lfSNAgSVh9TRTY8i+KK+9BigVAea80/JA0MdK:txkzSVBzjKK+fVA+67MdK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781966070, "uuid": "d1b8b86a-6253-4c48-9029-7f7997c9bb3b", "value": 264928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781966070, "uuid": "dcbef121-9f08-4378-a329-cca2674ea02c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781966070, "uuid": "71c4bb2c-440e-4e15-90d2-2d18e1e5ac9f", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd881612-6ccd-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1781976659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781976659, "uuid": "065d05a9-d122-49eb-ba25-8c5ec684f729", "comment": "Malware payload (Stealc)", "value": "2f13ce2e5e573efd9363188cef289860", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781976659, "uuid": "8cc48893-03e0-4125-a6ba-89e7e597d1f8", "comment": "Malware payload (Stealc)", "value": "ce00a84a546cf51d9428350aa1929c8999a4c48de5d7e53372f4faca22cbaf2e", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781976659, "uuid": "8782567a-0b53-4501-9e87-b89684d010a5", "comment": "Malware payload (Stealc)", "value": "11d163bb0e2468fbb5cc4b2cc3aee3cb214bca76", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781976659, "uuid": "73403e96-d232-4af8-9c92-93936a8f21af", "comment": "Malware payload (Stealc)", "value": "21d4ef611e15962b6c7dba1678db84bf4ea929bf96e1481d0ac7bf9bb4ba96a99b6261501fb5ff3760cc8ddf1fe80306", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781976659, "uuid": "35e051ce-ff7c-48e9-8425-d283079f539e", "value": "T163E533687BE82497F2B8577688F7D15A4731FC631F1A68EF21E0527E2E534C1A83071A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781976659, "uuid": "6544560a-0f07-4a32-807b-c59bbb822f3e", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781976659, "uuid": "83d27228-3acf-4c30-b140-e8186f7c1dea", "value": "49152:AH/YQ1TeW6+r5TCwSsbxlOSH2xZXu6adWq47uGuX8YVMijfWU1Lech8:zWKWZCwSsbxlOSERu6Pt6XM8eX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781976659, "uuid": "05057ffe-885e-42cf-90c9-bb67bc8c5fc0", "value": 3268608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781976659, "uuid": "d4baaf9b-cb96-4402-8464-d0fff1c90e47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781976659, "uuid": "78ed1a4b-a38e-4224-a7dc-09cfb0f55cb4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33b7be6-6ca6-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781959972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959972, "uuid": "8d32b8d7-8f48-4a8b-9783-1a90c6eb56e5", "comment": "Malware payload (Gafgyt)", "value": "ac466179520b44fb20c9dc9294a61169", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959972, "uuid": "1d875f90-59e1-4144-be58-775fca79ef27", "comment": "Malware payload (Gafgyt)", "value": "ce05fd27277fa214b1c98f5ab79f0d90379a1c1c3c03358ab3770a20688d0c28", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959972, "uuid": "224adf43-bc20-4527-b3a5-8e07132e74f5", "comment": "Malware payload (Gafgyt)", "value": "bc92b130119addda778b83fb4b5065f26610ee6c", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959972, "uuid": "fca40f17-f86d-4c8c-89df-7722329096ca", "comment": "Malware payload (Gafgyt)", "value": "444f6f9f57bde2c8b098663c295cd216b5a2ce18484b0f51b7cbc96bd94ee8e3ceca178ec60890fec0bc2e3559371b7e", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959972, "uuid": "4bd49eb6-b7ea-4e63-b99e-a1dc3bf1ed1d", "value": "T187B34A0758606F77C045AA7129FB5530076BBA220F5F1B8A757DAAB0174F8DEB00FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959972, "uuid": "c6341279-d9ca-4c4c-a64b-3134a66f78bc", "value": "3072:VtObv4jGk+yZXQxQ05hLwJOC1LkC0Px9gQNfR:VtOD+fRGQ05hLw8ALkC0Px9gQNfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781959972, "uuid": "de6bfe21-f1e3-400c-ad79-20d37fc05ebb", "value": 109059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781959972, "uuid": "d9c8c31d-52b1-498e-8789-2a799877ebcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959972, "uuid": "470a0434-ff4f-465f-8b1b-6c6126c121f1", "value": "assailant.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6edacc9-6c90-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781950449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950449, "uuid": "b9cebeb7-15b1-474a-91e3-8194690c7051", "comment": "Malware payload", "value": "1bb63e08cd7ea35710113c7c4c850780", "object_relation": "md5", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Garble", "colour": "#B9FEE3", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950449, "uuid": "59d5b67f-d8f2-4fae-94ac-b9af6f34d6c7", "comment": "Malware payload", "value": "ce1c89758c10c76581dd5c9d6ea0fb4f84b88ad927d021b81bbe050a2db402c0", "object_relation": "sha256", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Garble", "colour": "#B9FEE3", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950449, "uuid": "b13ca7f6-ed98-40d1-85c5-11f1d848b7eb", "comment": "Malware payload", "value": "c5bca081172cbe8ca0e273adcabc344f5abd8780", "object_relation": "sha1", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Garble", "colour": "#B9FEE3", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950449, "uuid": "dccc7278-7220-4267-b063-071259d212b9", "comment": "Malware payload", "value": "d4d2ec8f1a00ef89b42ad2296932f68938b692f343963591f74ba1311c93646314bbebcc974ca05fed95932026eddfa5", "object_relation": "sha3-384", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Garble", "colour": "#B9FEE3", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950449, "uuid": "c74439d7-0956-4753-870f-56aefa344d5f", "value": "T1ACB55B0BBCE1C8B4D0AB9235896651A27A31BE041F3163DF2A50B3792FB77D09A75770", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950449, "uuid": "22d88e17-d7bf-4821-965f-7dda1b191f76", "value": "ae7b0dcd0acb9c3fb756997398347299", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950449, "uuid": "3b42e188-8bf0-430d-afa3-05b547bc9ec8", "value": "49152:iQLVR8jNIMAW5Oo+TxjV3HMLvoZ5kQM8LdwWv:i5iWC3HMjS53RL1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781950449, "uuid": "aa4f83aa-3b79-4afc-887a-6d5b3b0aa75a", "value": 2461728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781950449, "uuid": "e8a281c2-c82f-4962-bb7a-f767a9a78845", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950449, "uuid": "e1ba0a85-661d-47d9-910b-4d037373960d", "value": "curl_ext.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b328e387-6c92-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781951275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781951275, "uuid": "58b07866-4cc2-46c4-a03c-e352aa1d3467", "comment": "Malware payload", "value": "c9d0ac34d169cec2b7b8aa79d5edfb8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781951275, "uuid": "1285056c-e809-4b64-a842-f3d9142316be", "comment": "Malware payload", "value": "ce92d8ce054e17a2f1201140dbbc59c89e67a54caaa3cf44088c13d54bd94269", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781951275, "uuid": "50b65c19-d7ac-479e-827d-8fd948258370", "comment": "Malware payload", "value": "4186f09750a732264ffea28102f41d089c040944", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781951275, "uuid": "1a7726a9-d436-46ab-889a-a19377edfe78", "comment": "Malware payload", "value": "c94cb05d8963899e0ad7034d54dbb37ea14993823b34fb4e481012ec0aba0fbdaaac93eb4c454b07c78fa8462bc84feb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781951275, "uuid": "5a818a44-b78e-4df8-af53-7e243fbbda4c", "value": "T147B54B477CE108A9C0AA933289B692927A71BC150F3267D72F90B3783FB7BD09975744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781951275, "uuid": "8981091f-c873-4411-9ec0-d713eb5fb7eb", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781951275, "uuid": "8e2e8208-7b96-4bea-a602-3c666dd8ccdf", "value": "24576:khT66GR0nToQTIe5j8xL2g/iC81j0wNsEH+GxJHILwyBxPW:kXGR0Toa5jBj03E9JE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781951275, "uuid": "9086f19b-1b87-4c48-a9e5-1c6aed1ba72c", "value": 2314776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781951275, "uuid": "6c5c4315-b08c-4dd7-a102-02cfb717603d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781951275, "uuid": "aedd658f-2d3f-4b64-b08c-f6eca32cd9fd", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe56c940-6c41-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1781916612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781916612, "uuid": "9055acd8-2803-4fef-be7f-c82ea355ec8a", "comment": "Malware payload (NanoCore)", "value": "1702f6476993eb605fe93eebbbc5fc42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781916612, "uuid": "e93d2b92-6e8a-481f-b569-c238351a4833", "comment": "Malware payload (NanoCore)", "value": "ce990051cbbec61b7e5fda012e29bc9776d0f298cc586c20ed13f949f34db37b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781916612, "uuid": "20980970-6d50-4ee6-83f3-4f7678ec1d2d", "comment": "Malware payload (NanoCore)", "value": "409af51ffa0d10f41374a2b1f3517b98b950ed00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781916612, "uuid": "425016bf-8ffc-4bb5-a1e1-a33d91d04d2c", "comment": "Malware payload (NanoCore)", "value": "e47e06986eac2a22b30b39f087d26e1520e45712f59713e655ffb5c9d7b393f7555882c5d6a9619dca420b6fd8e252e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781916612, "uuid": "c285adee-4231-4fce-b0e4-100a658bd02c", "value": "T14414CF563BA84A2FE2DE8579712212139379C2E3E9C3F3DE28E411B64F567E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781916612, "uuid": "c15c49cb-643a-44f0-b69a-650d68688338", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781916612, "uuid": "34f5a692-a004-4c68-a1b2-784b94ab2b28", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIWtsC6wwBLsjAIZnB/nFgMbszw:MLV6Bta6dtJmakIM5D+LsjAcW/zhIRVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781916612, "uuid": "647f175f-abfb-435e-b051-ccbe1a0967b1", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781916612, "uuid": "90fa926d-8b80-49c3-a021-62d9c71d3940", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781916612, "uuid": "5e01b5d8-3be4-4fcd-adc1-41a2cd64a321", "value": "avokad.io.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae445c17-6c6d-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781935375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935375, "uuid": "1fda31db-53e3-41fd-af77-a47ef02e5790", "comment": "Malware payload (CoinMiner)", "value": "82072dd757235841429d4c0c99e13234", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935375, "uuid": "46df273e-6853-445d-95fd-6d109aa38853", "comment": "Malware payload (CoinMiner)", "value": "d021a17520039ec08a3d0a4805cec5c807567180da7eab3c81082b9d84ad6e5f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935375, "uuid": "d234b806-0d9a-4d97-b766-004247861fc5", "comment": "Malware payload (CoinMiner)", "value": "3d1e5ffab44698c3813c3a4647204e9395037806", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935375, "uuid": "225a73b1-877c-4c31-8f02-6362d530362e", "comment": "Malware payload (CoinMiner)", "value": "fb07143ba47daf7fae332930564fd0326ba08fe65f40fafc7d4da59bf6a4a136200d6354c7b6fbe1a4d51829cb8d2769", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935375, "uuid": "07aec2ef-2886-42cf-8d34-99c9c8c76567", "value": "T1CE3429A9BC40DB52C6D427BABB5D829933134FB4C3DE7506CC241F2936EB55F0A3A582", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935375, "uuid": "a025e485-82f3-405e-9039-6cbd93693ee1", "value": "6144:rtL4Vkm8JCTPE99UK6FssMsjKtK37nFDWSh43MOew:xL4VkHUK6FDKtyFDa3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781935375, "uuid": "6b88ee58-592a-468f-a33e-0735f670027c", "value": 243552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781935375, "uuid": "a2150499-4f44-4560-9641-d69c076156e9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935375, "uuid": "9276c103-e452-4477-9fe6-63cdc8144133", "value": "kworkerd-blkcg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce505df-6c91-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781950754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950754, "uuid": "e290dd03-f1c3-4808-8522-bd5ede6c1170", "comment": "Malware payload", "value": "3e576718bec39f006a27db2b8e5d9284", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950754, "uuid": "c5041fb1-72cc-4591-891c-e4fcadd34a4e", "comment": "Malware payload", "value": "d0cd19d269c4907aef95f4d7a9dc0c59589159bff4b3d0dc3cafc40e5b64cd6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950754, "uuid": "a80fc102-465b-4df3-bdc8-d58ae117212f", "comment": "Malware payload", "value": "89af2cee4c8c5791673055b979fe71491b9b8547", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950754, "uuid": "c5b4833e-9f2f-45c8-9a43-ad1c5b69cc9f", "comment": "Malware payload", "value": "405064ea986918a308d63b1f808dcdff527558f12b4ccfbdfc5e744701a3993d010e7f406a59cd3536bf0e936d6937d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950754, "uuid": "b97eaaab-967a-4bd0-b542-24e366610114", "value": "T10F66E047BCE109F6C4AAA2718976A1927B61BC451F3223D32F60B3782F72BE09D75714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950754, "uuid": "0847aa12-81c7-42c5-97c6-c5cdeea30eb2", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950754, "uuid": "54792bdc-9fd1-4ba1-938c-cf7cf424c220", "value": "196608:Xpyax8fmTf2TXdg4N8JqDMcpWlSgw+vNi:Xpya2f8qNgzqDHp6F8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781950754, "uuid": "7f582e20-5801-4465-b2b1-a202679716bd", "value": 6854216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781950754, "uuid": "88572480-e75e-4d9c-8aa4-67b659ea83d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950754, "uuid": "e7bcf3f4-e7ba-4e28-9872-c8858e091830", "value": "Aqua.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf4e106b-6c91-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781950892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950892, "uuid": "bf16c897-1102-4410-ba4f-81380b5cf3d2", "comment": "Malware payload (Vidar)", "value": "64e9b14f81a21120b831e19ef94f902e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950892, "uuid": "7a910490-c978-4a24-8038-15814f87ea35", "comment": "Malware payload (Vidar)", "value": "d0da8e7c8c47561a8b9f78b38e31e02964dcf4ae1d10cc01a99e409d20ad73ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950892, "uuid": "f3bca2ba-cfdc-4388-8009-b8d9b967c129", "comment": "Malware payload (Vidar)", "value": "1f8e8faddb98e2e6cd723c4c1854000281ef3913", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950892, "uuid": "bc974fb1-f03a-472a-ae0d-614254b21287", "comment": "Malware payload (Vidar)", "value": "4ae0bd8f4c0d464d9b701d8e78e64fd211c5e51c2a2e5069d61a7c29c668242526660c693cc95719d895ca27d2f349f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950892, "uuid": "389737a9-0931-4bb6-a3c1-c4cadc09719c", "value": "T147F56B07ADE048EAD4AA6231CDF29586BB26BC180F7123D76A50B7783F72BE05D75710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950892, "uuid": "fab180e2-3fe0-405b-a52b-1add5c578e38", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950892, "uuid": "6b8c6f67-57f7-4fc5-b647-3794a12f2684", "value": "49152:HllhSuoDaY+VFnChTA2APH/DJEEYI58VqH:HMTcnChTA2APH/DJEEYI5kC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781950892, "uuid": "5a88dc4f-fcbc-492a-a2b4-0aece2223e09", "value": 3334488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781950892, "uuid": "9fc3b791-6084-4bdb-83d1-31cc8cb01d27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950892, "uuid": "d83e9c76-013d-4fb0-ba96-bf7ce86b0243", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e96735-6ce4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781986585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986585, "uuid": "69cae68b-350f-42ce-a701-4000e39dc133", "comment": "Malware payload", "value": "9f782ccd05744d323c7bbedee70ba478", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986585, "uuid": "adba4783-4c84-4419-a82d-d1703f7c30a6", "comment": "Malware payload", "value": "d2676ac0a5290da1be5f312e7aaf992849c1a2c9e5bccb80b59a655de68f655b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986585, "uuid": "7252a340-3ff9-491c-a970-fdd64b8159d7", "comment": "Malware payload", "value": "42a2cf2d1b2ca43d887290849bb8d95ef7b72dfc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986585, "uuid": "02e1e343-215e-4cdd-a46f-a40fbb7c7a9c", "comment": "Malware payload", "value": "a08fc24d167dd8a08e4d632f3e0448e0c98fa2423fc82262eafe5d40fec476625581bc86938227ea2efc3f3885669344", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986585, "uuid": "6bb79ee4-2867-4a83-bb56-d4cca135842c", "value": "T1FD9533BD426856C5F34FD492E4490B8ED0F8271520AF0C7B3A74541963FEDA5CAA8AFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986585, "uuid": "97495ede-7a1d-4243-82bd-8803af09c1fc", "value": "24576:mZqkdFbKSeVSuJtJZufCEoawL6d/5OGDGWSQha+Yf8DO1ERiBfp0y/Tj1lERRl0W:IqWsaaQwL6dBlaWSQ36hh1lERReA6rOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781986585, "uuid": "e83f1bec-e889-4012-80f2-eda29adddabc", "value": 1995160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781986585, "uuid": "6acbf03c-bb22-4660-b9b5-73c10303f982", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986585, "uuid": "f3cac4a3-1b7a-481f-be4f-d34c1839b365", "value": "kworker_u8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a99c26-6cab-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1781961830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961830, "uuid": "1c9a40c4-5567-4eb8-a87c-5cf2c48b246a", "comment": "Malware payload (SalatStealer)", "value": "8edc3fc30ff421f6383006a6820b6137", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961830, "uuid": "a96d3111-a149-484a-9d67-222ea09b415a", "comment": "Malware payload (SalatStealer)", "value": "d3189d197237dcaafd3e04413bda0ad055dfe236679f4a004732af2954416f93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961830, "uuid": "d221664b-0803-4baa-9f20-dafdeef1f8c4", "comment": "Malware payload (SalatStealer)", "value": "5e9058e3d99c0c99a36d3bed8284042ca5390c0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961830, "uuid": "e0e5b675-cfd2-4293-a0e0-c9bd3eaa0c17", "comment": "Malware payload (SalatStealer)", "value": "d3c77dafabb3f31508fd7a24a7fba060f962c87e23d8c00bff88073f42d26dcda6b5ee7b7711427b8b0b41a315889aae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961830, "uuid": "d156d8f7-d2e8-4275-9c1a-b9a1ff883d7d", "value": "T139C66B11FADB95F6E903583100ABB37F63315D048B28DB9BEB547B2AF8776A10C66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961830, "uuid": "0e31ce8e-f2bf-4259-9608-0a9e07429790", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961830, "uuid": "75db4338-4755-474d-a524-f2a449115748", "value": "98304:YB8AS4+25GYClCRcmKbFsaemQ04j3HxmcEKEO/:OS4EDCmyaZX8MLO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781961830, "uuid": "d45e3154-8cea-472b-8528-6edbc6bd374e", "value": 12572160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781961830, "uuid": "9a483974-aa2e-40f7-bb75-9c24f43046b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961830, "uuid": "a22dd6cd-0e6e-40c1-9569-3d4bc6903bbf", "value": "DiscordFix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b3735a-6c3d-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1781914612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781914612, "uuid": "6bdcc98b-c7f7-4700-8f0a-75a9090f797b", "comment": "Malware payload (RemusStealer)", "value": "63ffc60f431eb604910d605d8d72754b", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781914612, "uuid": "a9fd681b-ea43-44e4-b399-4c2b2910227a", "comment": "Malware payload (RemusStealer)", "value": "d34be339fd8c47756de5b4e6c402612a333c50b9e1fa4bffdd32cb3f9d5c1d74", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781914612, "uuid": "c89a386c-b8d0-4a37-8e38-bde8db406a05", "comment": "Malware payload (RemusStealer)", "value": "e2b60f4ee39925843ad191a57064d35055d0cf02", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781914612, "uuid": "cb863748-152a-4c41-bb73-b958dcda321a", "comment": "Malware payload (RemusStealer)", "value": "b4234e1f5fd390faa5d234321be53c91607553768a7295231b85e651a5080df64ee243760993e48ba6e6211e7595e973", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781914612, "uuid": "02711b8e-a38e-4c9c-a0b5-5cbf8247e43d", "value": "T1D0D462CE406850DDDF7926B3901FAB1EDA25AE9514DAB2CF26123394EB38449FC0E537", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781914612, "uuid": "0ada5b96-c1e2-42c3-8d2c-1c626954ce10", "value": "12288:O5bJpyiPEm6XmjWbCPN81iBf9nQ/L15yCQHApHq2RP3PQlarELPy/d1ILRwvuzgI:O5bJpyiPEm6XmjWbCPN81iBf9nQ/L15K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781914612, "uuid": "0f4b0279-c774-464d-a56e-95947e377635", "value": 656672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781914612, "uuid": "3976b422-2c18-4f0d-acd3-dc1118990a2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781914612, "uuid": "55a66286-709e-4666-87c6-a7267b7f9874", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e2f49c-6cdd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781983243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983243, "uuid": "ef9b5e37-d250-4201-bb83-b136380455fa", "comment": "Malware payload", "value": "f9517c01a112bca917727a7ca42c1018", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983243, "uuid": "ee9e0970-c8b8-472f-948a-a35b286edf52", "comment": "Malware payload", "value": "d3d74f36518d6bb59929f9f1601b90520e6228877ab30787e97acd857e38cf2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983243, "uuid": "38411942-9235-4de3-9a13-05928c824082", "comment": "Malware payload", "value": "cc4fc4ec4f11a0da6bf70bc2a3cdb46378c34315", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983243, "uuid": "d36278d8-4a49-42a3-87cf-5d336f113444", "comment": "Malware payload", "value": "a79ff8940d95df7503df95898c2f3662291729ee2b9c5256d531bdb8522ca4f01c28e31418d0b9a25d7fa13d39a089bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781983243, "uuid": "27894864-8688-4c9a-94a6-246d0257c4d3", "value": "T194A3121378D9FEBCDE189B31FDB553A0E7AD4EB916A83705250A75A223C7002461F2BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781983243, "uuid": "d603beb8-5434-4387-a6e1-d103266a7a45", "value": "1536:x2hmmFimREATtbqWoU4awpw6UjuQlLH3M3OJXxQEW0lbKcUWgmQLiTGUhaisaJz6:0EgjRosoKlj3tJ2wluuQL4hXLRw8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781983243, "uuid": "75d25bf6-d82c-44c2-844b-a21ddd045196", "value": 106872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781983243, "uuid": "f247f6be-4fec-4d3a-b02c-fed56d63045a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781983243, "uuid": "d35a8aa2-036b-44c1-acbe-bbff951ff9cb", "value": "SecuriteInfo.com.Linux.BackDoor.Armada.1.30872.16543", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11b0bc6-6ce9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781988664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988664, "uuid": "033a416e-1792-4873-b965-6c1e8823159f", "comment": "Malware payload", "value": "45a5f8b3e999bc4953e29c84f1c6fd05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988664, "uuid": "566faeb0-1563-481b-9923-c71daf0b2e91", "comment": "Malware payload", "value": "d41fd9018d83a1275535f8cbe0ee0b8cbfe440eeb0d9a29bc24a75643cf0a102", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988664, "uuid": "7793ce12-b195-4b5d-8ea0-5bfa930dafe4", "comment": "Malware payload", "value": "450aa19cba5e4012c34539017607522965c0573d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988664, "uuid": "c93cafc2-a1df-4f32-a51a-4b3a3e3b68a6", "comment": "Malware payload", "value": "264ed0630938c571ae5296d19c613fea38935e6df0dc0e4fc8737eb34d658392c167f8ccecd55b44bad296e4e680525e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988664, "uuid": "0c88a965-af66-41ff-9af1-d546df6dbc6d", "value": "T1DF3419A9BC40DB62C6E427BAFB4C429933134F74C3DD3506CD245F2976EB55B0A3A682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988664, "uuid": "7ee498ca-b5e4-4b1b-8ba6-054bc3d75fe6", "value": "6144:f1h8ueLcXsnrYFQkrdk9zJfahXW9WIWeswUfCVzIOa:AueLo2rYFQkrdk8XQLb5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781988664, "uuid": "b00379d5-84ff-4170-a2ad-da5c2f6acb37", "value": 247644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781988664, "uuid": "604c83dc-ba6b-4ec0-92d2-d59334d39c19", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988664, "uuid": "c608b11b-7623-4efa-ab3b-4adf6be64aca", "value": "kworkerd-irq-bal", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1299e59f-6c90-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781950146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950146, "uuid": "f5d16f98-55e5-4c61-9559-0f32a0165120", "comment": "Malware payload", "value": "5bfea6750dfecd936c19654dd2222ca1", "object_relation": "md5", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FalseSign", "colour": "#18497A", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950146, "uuid": "8db3b4a3-e846-4543-9837-a2acb55f9824", "comment": "Malware payload", "value": "d42e788d758a7f200094a762a58e32297a60d5cc6e3ef293d80ba6f0337c48ab", "object_relation": "sha256", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FalseSign", "colour": "#18497A", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950146, "uuid": "cd404890-9f1a-4bad-97e9-c1dee5d5ec16", "comment": "Malware payload", "value": "0f944b2094c7773976d38a7a1c012ef0d21911f4", "object_relation": "sha1", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FalseSign", "colour": "#18497A", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950146, "uuid": "defe9a80-ee6b-4ad3-8cb1-a77f8050f7b5", "comment": "Malware payload", "value": "e87ee83436f6f28de91efc779a499ab1b827e3258574c895f6419ea77908dd908f24e9193ea77e3230f59006556204eb", "object_relation": "sha3-384", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FalseSign", "colour": "#18497A", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950146, "uuid": "121ca609-7a5f-4b9b-9d00-e75687f9eb64", "value": "T158A57B0BBCE108B9C0AE9335896651527AF1BC541F3127D72A90F7BC2FB2BE06A75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950146, "uuid": "299042ce-a538-49ef-8d8a-a9ab550930df", "value": "3fcd909376d1581ce4f544baf3eebc57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950146, "uuid": "82c1186d-2da3-4f37-a482-f7e605d75c0f", "value": "24576:YfXhvk0WKS9QB8aZUKGjFsBqgz/unufDz5mkKjwavDSHzGe2tB3L:2hvk0PZ4jKkI/RDz93Hye2tB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781950146, "uuid": "ddb48192-d7a4-4d4e-be9b-ee679395226b", "value": 2253456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781950146, "uuid": "1225934b-95e7-4c92-8130-718935c2548c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950146, "uuid": "49aa4803-1578-42fb-bb05-6935cbc6bd37", "value": "runner.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebf90824-6ce4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781986589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986589, "uuid": "c800061b-4f63-454d-a8f9-b6fee0ed5ea5", "comment": "Malware payload", "value": "bdb48c6fc6312c8f270f0aaddae2f0b2", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986589, "uuid": "f18f2d0e-1503-42e6-a93e-72d98b3c4b43", "comment": "Malware payload", "value": "d431302d1890dbe576dd8a30fdd3a8aa4de1ec53f692b64553644c4a18470d99", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986589, "uuid": "09ba4f49-0deb-4c7d-ad05-fd9f9eca73f3", "comment": "Malware payload", "value": "278d7d0a37e3c0e8596cee86ed1ce43c7fc8156c", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986589, "uuid": "21c2f92d-f5c6-44c0-af33-1a4503e4c3dc", "comment": "Malware payload", "value": "cd207ea57b031a812451c68c826ee4500c39cf52077193df0068aa94ffd1cecee9544cdccbf050d139577d80d98733c9", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986589, "uuid": "c0a9f446-3368-4874-a7ff-77511928edd9", "value": "T1DF8533D3A2E034A5FD620D31D3F314360A2B9AB94C1F5A0C6EA5C91A55560FAFE37CC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986589, "uuid": "eeabe89c-9adf-4aa1-96d7-7d93393dc7e0", "value": "49152:v4RmuD6VxtJRzGF7MVEpYkjknttMs+8FuGCL+kGolS/m+qcgAa:PP2JYkytMF80GCLVl+qz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781986589, "uuid": "4e956411-cb0c-4575-a549-8bb7a682695e", "value": 1777108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781986589, "uuid": "bf06b003-e710-46fd-bdf1-03e35bb4c38c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986589, "uuid": "e14c24de-094f-4786-8ba2-b839f13b2a33", "value": "zswap_shrinkd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e038f01-6c91-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781950595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950595, "uuid": "25851205-a727-4648-a028-49c013bfa036", "comment": "Malware payload", "value": "7bcae74d2ba6f86e65b38699160fafee", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950595, "uuid": "c8a21182-9684-4f19-b46d-ffc0cec14b22", "comment": "Malware payload", "value": "d59a0308d2a3ba15b1f5f71269a3c0d4f673e9143414de954590504578b31910", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950595, "uuid": "b305dcc0-29e8-4182-9e06-a2d9a36bbfb8", "comment": "Malware payload", "value": "c14c77be798d021176e368551888aa6790654979", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950595, "uuid": "3130e2b4-85ab-4195-a548-530c4b65e148", "comment": "Malware payload", "value": "0e804081e162b697e188f6219be1203a6f2dd545634e47c467c43d3e06f8aab20df257d84c70869b3356b7fd564cca55", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950595, "uuid": "652c6d77-47e2-48d7-b0fd-5c3769b5a769", "value": "T12186F147BCE108FAC4AAA2318976A5427B61BC451F3223D72F60B7782F72BE09D75714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950595, "uuid": "0f7ca04e-8b63-497f-b1ca-544016a13193", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950595, "uuid": "f09cc9a9-6691-4d11-a717-30e0c8dd63d6", "value": "98304:W+tLgBPUd+ADqF/2Yb28I6TE2viavI0zhedfYk14HBKI4i6s/jAkIr+QRtbkEfPL:W+aiqFX1TTEAn0dwkChT46fQXY0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781950595, "uuid": "d0fe11f4-335f-42df-b088-568a1fbb6857", "value": 8171216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781950595, "uuid": "1d448c6c-282d-401e-b2d7-bbe0f2934faa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950595, "uuid": "0276ea6f-2126-4b8f-9d23-7c36cd0aaae8", "value": "NexusMods.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25ba641-6c6d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781935463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935463, "uuid": "affb4859-908a-4536-85c7-1d68e38fa82c", "comment": "Malware payload (Mirai)", "value": "fee67ca520db511ef82a5077b70f8d3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935463, "uuid": "9ddea332-018f-47ac-b47a-3f24c08493ac", "comment": "Malware payload (Mirai)", "value": "d6f33e59ae08ff1453e4e7f4fb3b682b0aeffaad122091cef1b0d0ccdb7ee805", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935463, "uuid": "e99e1984-acd9-4f50-957e-4dd427d1820f", "comment": "Malware payload (Mirai)", "value": "90f4d17001c2e425f08587efb029fe9a7b2d2411", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935463, "uuid": "f827197e-44d3-4400-9b9e-836b391cb02c", "comment": "Malware payload (Mirai)", "value": "49385ceabf561d9966ebccec0e2488012c88f59e4f1f546dd48462c673886c7a006880647223216d0c2ece80bf77ad23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935463, "uuid": "f7ea1144-b780-4cb3-bdc7-afe19f930afb", "value": "T18A258D2EB2B2F5BCD00BC03447DBCAA25535B47522312DBB36C4DA353D66DE12369B62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935463, "uuid": "5866ab25-ed2a-4982-aaf2-74c3db74a882", "value": "24576:sLyfMMNgXVWZT+wu5VIfOUjkzx2EgVDI:sm0MNgIZ6j5gO0I2EgVDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781935463, "uuid": "6fd2266a-d1c6-4e52-8c9d-340c27b7af90", "value": 969256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781935463, "uuid": "bc83e3ae-f6fc-4d2a-91e3-b1765a21f9d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935463, "uuid": "5c965cac-0f1a-4972-a094-622153b61ae8", "value": "bot_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42981e63-6ce0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781984587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781984587, "uuid": "4d7d7503-58df-4a4d-bf88-d7b720f72fa1", "comment": "Malware payload", "value": "659458bde3b89e413d5ba954dcbf3775", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781984587, "uuid": "3fe5d1cc-b9f9-4982-8747-d4a3a12f38a6", "comment": "Malware payload", "value": "d9115ff47fa9506711bc9c734e8b96125f18f48a5217ccbc1f057b2ce51a465e", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781984587, "uuid": "d15ce273-4889-4005-82ef-ca49d993595a", "comment": "Malware payload", "value": "b30d8b3425f6c03659d9d7a7c13154595298b812", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781984587, "uuid": "a068b3b0-5cb4-44d3-b2d5-d76b47c6b18c", "comment": "Malware payload", "value": "64698b0a98e48becfa3865b268ebad53d04521097515d17a1d9e9a1de528f9238ebb654da1384ca30a08004ce0486b18", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781984587, "uuid": "c2b592aa-8446-4b09-b2cb-5fe721cf62cf", "value": "T1818163A559D98F30E77B45B304BE8A19893FF1848B1EDA8942C4DD8C305AAE0F434AE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781984587, "uuid": "09cd4be4-f99d-45a8-bfb6-bbd6e17b34b0", "value": "48:8w/mDJn3U0Fbc6PeY8XuHrAmo4L+5Mzkt8ta8NM:8wuVn3NbXeuLAXp6A8tacM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781984587, "uuid": "a539596b-c889-46c7-98c9-c4bcf6ba7313", "value": 4012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781984587, "uuid": "7fcae215-3a84-4e4e-a87a-ca9041fa43c6", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781984587, "uuid": "1d2b5cc7-3da2-4742-81a2-8f6e99017320", "value": "Radiology_MRI_Brain_Final_Report_Signed.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "352d37ae-6cb8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781967384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781967384, "uuid": "ae33374f-2bd6-4963-ae15-0627fbf9628a", "comment": "Malware payload (Mirai)", "value": "474b9dfb60b7d04a2bd46d44b25ed977", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781967384, "uuid": "42ee5215-499c-42ad-9122-462755b3d4a5", "comment": "Malware payload (Mirai)", "value": "d930eeab73b0a4af246497f67d35322574c0c8d73d00b5319db9368c8a124dd9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781967384, "uuid": "7a02230f-86d5-4a12-9186-08a505982bbe", "comment": "Malware payload (Mirai)", "value": "4f04d81ab82069b82a445968dcc70afaf11bb199", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781967384, "uuid": "0c88c210-47ad-45a7-9837-710933c1f0b5", "comment": "Malware payload (Mirai)", "value": "21fbab59756ddcbbbce5f40b6ef0d7929b0a2681329a0c36232fbd4348d4f6ab40b25e40bcacf2f7624d236893c195d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781967384, "uuid": "586cbc53-314e-458f-a4de-ea16873fb211", "value": "T181446C03F5C190FFC5DAC1744BDAF236A972B41D5234B65F2B94AF222E5AE205B2DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781967384, "uuid": "9b9403e6-e70f-4c6c-a814-d8bfe7372713", "value": "3072:EinnUIYIj6treuKKqMZo7nojIt5WL1e90PPXyOXZrNbhlQJMeZ5HDAGLMCNCVYj8:1nIqKTZORr9oPi0/ejHfy1dp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781967384, "uuid": "7e8fe5e4-8a38-4fe4-b117-66528a7b8378", "value": 254120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781967384, "uuid": "73ff3c82-a823-483e-985d-8a73775d0352", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781967384, "uuid": "2d65f275-f31a-450b-9a8b-f96e95db78a6", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06c93e95-6cda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781981909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981909, "uuid": "53a75367-107c-4ba3-84a4-84f77fed4747", "comment": "Malware payload (Mirai)", "value": "bf396d8fbf224556392884bea75e05f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981909, "uuid": "3d0c6dea-88e1-4ca4-b122-920e48521138", "comment": "Malware payload (Mirai)", "value": "d93ef9ce27f500fd7dfe886c9eff16ee6b5f9105409595c9c89a7c51404c0877", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981909, "uuid": "fe847187-41e2-47af-a6f3-b5c3ff105f22", "comment": "Malware payload (Mirai)", "value": "5b3ced0541dcff4d0614e84cfa5721f54fe887dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781981909, "uuid": "1519c3f5-63ad-4b72-896f-5f5e9f7d4123", "comment": "Malware payload (Mirai)", "value": "98e8a0cafb883a83c5f511da14d43242df27e15e25f601b1aa5e6a55b0523eb39b3dc83fa083afdd18ac8ba7a272987b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981909, "uuid": "c26e73c4-b659-40de-a80a-b5ac425e25d9", "value": "T12A242B037A81C9FEC496D1F04BEBA5319979F82D0635714B3794FFB12B09EA02B6D618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981909, "uuid": "0ed1f7d2-93b8-4cdf-ad84-e3f0159f1dbc", "value": "6144:KBbbTJgbFZpLT6BdrPG2er/+PlNLg/4X9:KgFT6Bd62er/d/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781981909, "uuid": "e7dfa2ee-44e6-41bf-9d72-84e240e98dfa", "value": 213456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781981909, "uuid": "4db55846-b9d4-473a-96d5-937a6bf73fc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781981909, "uuid": "fbca1cad-f1e9-406b-9934-1960846fe381", "value": "bin.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b561d566-6ce9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781988645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988645, "uuid": "d48387a9-0cb2-4968-8c4f-dd17d3e22a0e", "comment": "Malware payload (Mirai)", "value": "034c0e232e16c97c0164d427330dd75b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988645, "uuid": "80ba51c8-e696-4a0a-8051-b5014b6257a8", "comment": "Malware payload (Mirai)", "value": "d991f08e6d422bca943238a276b01aceff5d3f674c33531d6038a59a08c1a9e8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988645, "uuid": "918b5c16-d30f-42f7-a81f-fa5e397d809b", "comment": "Malware payload (Mirai)", "value": "bc40d879032cdac89e1706ca0aa1491029ed1136", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988645, "uuid": "d006d81c-8156-4edc-95e9-2b2e3337663b", "comment": "Malware payload (Mirai)", "value": "72e1d4a4cc561a4556438eb69d6fbf37fe450e86ee3cac6ab71f29cddd91a41c7ba51d8495682a701de6b9f60a169f34", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988645, "uuid": "9e28980b-9fa2-487a-b811-7c82c4386eb3", "value": "T1AF83C506BF650FB7DC6FDD370AA9170535CC650B12A93B367934D828F64B24B4AE38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988645, "uuid": "812f8972-6ae6-4dce-84ed-7a8b406deb2a", "value": "1536:YEj3j8qHdM8xIiphtoedEs2PJINjLWTAZz3OVx4L1+Jt:YEbj8WdXoJkHMAq+1Et", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781988645, "uuid": "b55d17b6-d95c-4beb-a3c3-c39625042e15", "value": 84836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781988645, "uuid": "25bc7426-e438-4593-8198-0f686daa04fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988645, "uuid": "675a09c6-0bb3-4341-9933-3991b072d32e", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc1d279-6c97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781953551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953551, "uuid": "64d3303e-d6ef-4078-a6c6-424daf612ecd", "comment": "Malware payload (Mirai)", "value": "24d4d6a491538ffaa631faccf9fb3986", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953551, "uuid": "8b366c88-f8ee-4efb-a80f-995dcac98967", "comment": "Malware payload (Mirai)", "value": "da0e576115caa2498ae6fc631996843b6d9fb8532e79501cde43648a13b81aae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953551, "uuid": "ba102ea9-20d0-4435-928d-7578abdad267", "comment": "Malware payload (Mirai)", "value": "6b7c1d51ecf30e59080ec7ba0cd1df117f4d0bf4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953551, "uuid": "dcf74aab-4e8d-4c07-91f4-bb6462b286ea", "comment": "Malware payload (Mirai)", "value": "ad2e1a4865a64eff90ffb1632f01987a0619a26b8721ff11d385ab1770eef9a7c731943b484df36af31a869ccbb16f5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953551, "uuid": "e8371194-3a34-4baf-a248-0aa63a974c29", "value": "T11251F009E34B0C06D3A578B0B33663D2BBDC99B76AB867C0544AFD81596B4A4B1DF0DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953551, "uuid": "7fbb442f-2502-43ce-bcfc-64818404d08e", "value": "48:79nHnnan3a//aCjga//+bJbhBbebXb17H0b7cxNU4b0bjBT+Zs9STK16nyydUUUM:9HcK//aCjK1Dyr17HggU4bgjBT2USTY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781953551, "uuid": "b8588194-819f-4b40-b1dc-fb3747cdc22d", "value": 2484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781953551, "uuid": "6f9e646d-6ada-4dd9-a46f-e86bb38b77c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953551, "uuid": "4c42842e-d546-4f08-9534-26ff61436967", "value": "dlr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1195b183-6c98-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781953581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953581, "uuid": "220861cc-72fe-4261-a27f-12f88ab649e9", "comment": "Malware payload (ConnectWise)", "value": "4f19d659d8a775b1a1f77d5263113f23", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953581, "uuid": "9aec5bfd-a836-4038-affb-a29b92da3378", "comment": "Malware payload (ConnectWise)", "value": "da6dec4baeadb44b654d21d14c27530851ed1c57e71d50c39c16ff3fb730af86", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953581, "uuid": "4ed6958e-ac5e-4fe5-9135-252d92868a81", "comment": "Malware payload (ConnectWise)", "value": "05b88c149fbce94d91166c7eb92c861f0d269915", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953581, "uuid": "0b43d39f-2d09-4892-a4e0-4c3845e6d102", "comment": "Malware payload (ConnectWise)", "value": "d0d5d86d04a0c1c676cf908f68491398692e4e346782b891dbd41cc1b111ed58bf69a70aca6a87b401d0b6ecfa03ae1b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953581, "uuid": "5d8dd021-e70a-46d3-8021-579c4b8e4c3e", "value": "T11F836C43B5D18476E9720E3118B1D9B4593FBE110E648EAF7398822E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953581, "uuid": "38f0c475-b8f1-4e7b-b985-0631aee4423a", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953581, "uuid": "b6697b87-290c-4671-b11c-7c7c8336af82", "value": "1536:ixoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYj7TJ9:AenkyfPAwiMq0RqRfbaWZJYYj59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781953581, "uuid": "ce940310-817b-4ffa-9e4a-73ef0b87e922", "value": 83192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781953581, "uuid": "fb07cd90-7fdc-4089-8d51-6012f4ba4bb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953581, "uuid": "ad37f4f1-35e2-4f94-939f-5caa3fc3ed4a", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b01626-6cde-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781983832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983832, "uuid": "fc1e0938-597f-43a4-9df4-c2661c468c0e", "comment": "Malware payload", "value": "e0c1afa44161437d62201bed17ebb2de", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983832, "uuid": "ac0f7e77-219e-4081-8882-70338fe5f28c", "comment": "Malware payload", "value": "dacf7be18ad926cb2008f1a139439add5917bbded18e1b303bc7dd5c63cf4402", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983832, "uuid": "8496a1f5-9c25-4b01-885d-299c99c8a09c", "comment": "Malware payload", "value": "146a9827cc8da8ae7879ffe987bd5878d4c3bc17", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983832, "uuid": "984e1579-7414-4295-bdd6-bd6724f99987", "comment": "Malware payload", "value": "28f3f8843b22ecf9b2af823bc2279534a03a8c5b9f313bd9a4464a07cd60626e79e1f5348b675cbe5ae4cc20c5fbc3da", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781983832, "uuid": "a0d1309b-cf2f-45dc-b200-772e3cd11436", "value": "T1E2F0D463D3C44921D19875788548EDC76582D28D1E389EBF57582F241C5B7560EDEC05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781983832, "uuid": "106a1bfb-f511-4c24-ab63-5fa6a39e5e5f", "value": "12:5jiriL/v2eYNTZTgCHn/YPfFk7ftuhcN8aFJAfbXrwJaO:9iriLHFeTZ9n/YPf+L0u8wOLrw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781983832, "uuid": "a2a537b9-d487-48b8-80a6-70e3385d0b77", "value": 491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781983832, "uuid": "6ef458f9-77da-4a75-a4ba-ba2017931b29", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781983832, "uuid": "c31a24f0-cef8-4da4-a632-9ae3e847af6f", "value": "dxon-atualizador-acesso.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f5dc1c-6c6d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781935151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935151, "uuid": "97aaa12d-1443-46fc-a815-5adcbfdb99b2", "comment": "Malware payload", "value": "a9cf1e329fd441fa0931a1193d73c3fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935151, "uuid": "5c3ff27e-22ba-405e-a86b-5c80e6f09a48", "comment": "Malware payload", "value": "db6f047dd0364c671988535bb0df0a8669ab339a6ea69438f038120fc64735e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935151, "uuid": "e7d3e451-7abd-4749-8228-76cbb7dd467c", "comment": "Malware payload", "value": "5ea54973f8607a6cfa8923c493d4967329483216", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935151, "uuid": "eb1665ad-ce75-4817-9dce-c951ff27623b", "comment": "Malware payload", "value": "37e8d34f0c75c247fc959ca4c76011cfe876ac414f27c7361db8defe648ce2ef049b908906bcfef633fa0f8e242f3925", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935151, "uuid": "efd8d06c-a102-4d6f-bda0-e2658a757953", "value": "T10A057E6377318F54E360E67009F38751DA9521A30AF298C2A37DC6207E5166D6CAFFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935151, "uuid": "2f415470-d6b3-4117-9b6c-a5014d5897bf", "value": "12288:OCDURqIwFxvQL73bw2IDkd4ExGuoQG/9wJGX6FDvx3ezwgpqOEcnYmB:OCgRJwgL7/4ExGVQU7X6FDvx30Znh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781935151, "uuid": "b6ecaf60-ee19-46f8-aa32-1fe4a4627cda", "value": 795296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781935151, "uuid": "9cbe6119-63b5-4acb-9141-fff95bf02a6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935151, "uuid": "cd3ee965-80f9-4bd7-a5e9-7667d40cd84f", "value": "bot_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3243f53d-6cb8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781967379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781967379, "uuid": "7eafcb26-1ab4-4997-8ed1-7b61a1358701", "comment": "Malware payload (Mirai)", "value": "66983f2cdc42e8a08cc9af5287714e25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781967379, "uuid": "8bbd0308-ccb4-4d90-99b0-4f973b5473ea", "comment": "Malware payload (Mirai)", "value": "dc64647cc38f250ae2874ef02c7531c1f2637c0bba707d5cca75f01b88e21573", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781967379, "uuid": "85a1e35f-b727-484c-8e37-49c29421847c", "comment": "Malware payload (Mirai)", "value": "fdd3d5e85b94ae94856c17797dd0a09f154395f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781967379, "uuid": "787a9c3c-06db-4c79-b05e-bfeeb292428a", "comment": "Malware payload (Mirai)", "value": "db7076206cf950c7eb180f4bb6cc094edddcc67c10e61965f82d61197e4983eacba98c632088d49b29ada14aa0cdd9f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781967379, "uuid": "77bad3e3-e920-4370-bada-17cf3816957b", "value": "T1E3444942FD409B16C6D426BAFA5D528D33171B78D2EF72029E245B34778E8AF0E3B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781967379, "uuid": "31a34038-79a5-470d-bf6e-4b0e9684da30", "value": "6144:SoTGF1oBQvpgmCHU2D8wDFfiTaH54TFYzm+Nzd1:SR2uimCHU2D82FfUaSTmzm6d1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781967379, "uuid": "c1ceeaad-bdaf-4393-82da-5326e2abacde", "value": 273628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781967379, "uuid": "c021d563-f4af-4816-8b7e-64e386d55b7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781967379, "uuid": "5b652ca6-fbfd-430e-bc99-63cb86e0364b", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6fa2a5b-6c5e-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1781928947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781928947, "uuid": "efa6af30-78ac-452b-87a0-801e1f826357", "comment": "Malware payload (WannaCry)", "value": "64a4dad715aada905a25c1871f1f89c4", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781928947, "uuid": "2f762619-5f97-41e7-ba8e-f75f5df7ae5b", "comment": "Malware payload (WannaCry)", "value": "dc9182e84c5891de81ce27cfba97710a0b07a84c1218317ffc1d7612f9ec8d04", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781928947, "uuid": "f650fa4c-4719-44f4-a1b4-05fc706d3373", "comment": "Malware payload (WannaCry)", "value": "ccf95e429c36c366ab58c5a003315a6b7f97e374", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781928947, "uuid": "63ade5f1-a893-47b6-8dfb-c06ced7cbce3", "comment": "Malware payload (WannaCry)", "value": "dddc7a4d10a4f70fdc7e3a488470b5294128023953f16ec6d17bd827826ec204cdcdf76b91187785d614404f5e68988b", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781928947, "uuid": "62e6a929-eefd-4aea-aef2-041a7a836e86", "value": "T1B13623A670E880B4D106157488B74E21F2B6BC7A26BE5A4F9F904E352F23B52F718753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781928947, "uuid": "95d159c5-a06a-4105-b318-aa2130e067fe", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781928947, "uuid": "0433da2e-aedf-4b82-8f1b-a1cae4efc0b2", "value": "49152:jnsnpAMSPbcBVQej/L+TSqTdX1HkQo6SAARdhnv:DMpAPoBhzLcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781928947, "uuid": "e0cc4b9c-2ad6-4a8d-aa2d-0c5b396a2535", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781928947, "uuid": "3196bbc1-a8f2-467d-9362-7c8d624b4bb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781928947, "uuid": "3f1e037c-1639-4940-ba2e-f8ff8b898628", "value": "dc9182e84c5891de81ce27cfba97710a0b07a84c1218317ffc1d7612f9ec8d04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cea154c-6c85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781945466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945466, "uuid": "9fbb1903-415b-429f-9afd-b191ced52d12", "comment": "Malware payload", "value": "94ec905c348821e2bf1604b2a66bfbdf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945466, "uuid": "3e8d5f8c-543c-492e-be6e-76ae07406c1f", "comment": "Malware payload", "value": "ddb5ff03dc232e15045540e739348b41d53701b23a712137cefbc042c9840714", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945466, "uuid": "aaa1bd5b-7a39-4e72-9270-5feec34597ab", "comment": "Malware payload", "value": "2a9e862eb0350e24a0886c3c492f19794ea8ac27", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945466, "uuid": "81c8ca7b-148f-46ee-9e4c-facb259cd938", "comment": "Malware payload", "value": "7d1f1e1af25efa7659cec73786667dfc0cec32455bb5d049c6faa0970d7e2dbae4a43adaf09c9e56c51c5f662d33e010", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781945466, "uuid": "d5c971f5-87f1-43dd-966c-caf1b6f2b828", "value": "T12B3160EA11102D355342C9CEB7B3318D744CC5EB6C9BD3A4D8490EE9829C9CC72A5FA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781945466, "uuid": "8f2310c8-5031-4a5f-a73b-9ddcd2603c01", "value": "12:UGW6GDa896lyI6lyIQqv6djp6r6H5wP1x6P1V1tP46P69Rk6sdEy6EIwAxP6xUSa:Ga89YcujQo5om3PWGlegr4FICb0OF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781945466, "uuid": "d2b738be-361e-45de-8fbe-e43a31fb666d", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781945466, "uuid": "401e5ab1-73c2-4ce2-9c1f-811c21bf6807", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781945466, "uuid": "43e583a3-3f95-4ac5-ab45-2015a4fa764f", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "772353d1-6c6d-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781935283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935283, "uuid": "2dcb039f-771e-48f3-92e7-667afb4d4f6c", "comment": "Malware payload (CoinMiner)", "value": "76eca3d88ed1710fcd4def8f4d5728f3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935283, "uuid": "b2d92d5e-766c-4a58-897c-7d0f1f0c931f", "comment": "Malware payload (CoinMiner)", "value": "dde26803587a91d5cf6ff51f6aa3643b52be73d96d20cdef28307d85409d5ae2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935283, "uuid": "99c4c242-9502-4f5c-98b1-60dc07f88422", "comment": "Malware payload (CoinMiner)", "value": "a821604f7b6600767aacc8991e68935155151acf", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935283, "uuid": "7b6f2138-d60d-40a9-a23f-40ba83d7f0df", "comment": "Malware payload (CoinMiner)", "value": "cd15c21c80b22116a235234fa94c99f14ed9c7bc3cc297e278612e68261358092db65fb451f88bf81185c33bb25cef8e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935283, "uuid": "f7886908-3300-4d9b-9826-e9da00291063", "value": "T112B312832ABEC254EE1595B3613C11846A6F2227856FE5D3E1DC232F2F813A81F04B77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935283, "uuid": "f38c47b2-fd59-446c-8d6e-04018fbe9f46", "value": "3072:44y1i7WZnR1bHkoTLafk90rZ7LndsS07O2hl6TNydHU83TC:44UfZnR1bEoTLH9edLL07FaoUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781935283, "uuid": "ca4d3740-418a-4ec9-ba24-ef804d67e42e", "value": 115316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781935283, "uuid": "2d1744b8-3a09-4c0e-a138-2e773a9fa990", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935283, "uuid": "65cd724b-93f2-4f80-a54a-c566d8c5c6c1", "value": "kworkerd-events", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "826cc190-6c51-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781923276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781923276, "uuid": "faa637d0-eda8-4100-9250-c5b02b17e852", "comment": "Malware payload (Mirai)", "value": "6aadb5c62a2e839a8e89c194149fb62d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781923276, "uuid": "0720eb5c-065e-48ec-984f-92bf902afc0a", "comment": "Malware payload (Mirai)", "value": "dde65e9db0231051abe658d6edda8e5e4fc08e7d67d22abf40ed8476bc8af42f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781923276, "uuid": "fb685f75-6457-4d33-93af-b9c4e210c423", "comment": "Malware payload (Mirai)", "value": "0a1123932f143aa884aeddb37feeb7219a0459f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781923276, "uuid": "647df856-b10d-4321-a894-70bc9446bdc7", "comment": "Malware payload (Mirai)", "value": "d1a6ec88527654f55f599fd9e2036779ab739043b4abb2fde6dc8a55694a2fd9bd991e6f151ddec912620b37ae98aa7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781923276, "uuid": "966cde8e-ebe9-4144-9915-ab3b4ceeb386", "value": "T1CA149E23D874ADD9C26499B4B0F0DFB82B13A51041472EBE76D6C67540C7E88FA097F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781923276, "uuid": "1697179e-2ec2-4453-a644-c726aab58729", "value": "3072:ybRT7VUN/6l9W/mgKPGl5+inO/82N+xHW9znjd0DIo:et5lA/mFU5+iOEL29nd0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781923276, "uuid": "83d02d50-3126-4796-9be9-e40cc8a2e636", "value": 195876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781923276, "uuid": "58103548-436a-4e82-bd0d-7db46a07bf17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781923276, "uuid": "aa03d192-7f1d-4da7-84e0-5698babe716c", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "997b02ce-6c6e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781935770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935770, "uuid": "80438bb3-788b-478a-b225-9bc30cadf0ef", "comment": "Malware payload", "value": "2f27bda2911f3815ab628f56a8baadfd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935770, "uuid": "88cb907d-6211-4dd7-a0d9-dd84e96e5f1d", "comment": "Malware payload", "value": "e0482d15012863b3bae8d372bcb5d0754518419233b7cfcd7a0d10e8a0d3732a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935770, "uuid": "fbc39817-3a3d-4244-86d9-f81e5ca4ce69", "comment": "Malware payload", "value": "b5d61f4412cd2335adab652743824a5bbbf58a3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935770, "uuid": "7b09c93d-69e9-4210-9b79-9060e214429b", "comment": "Malware payload", "value": "99be22e2cb43ce0d06b5804b1cb987ba83685796b514d5a61cfa71bcca97a9e0e375400382398c819040e6d710164f8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935770, "uuid": "35ae10c0-c9fb-4c88-acdd-f4fa5521eb46", "value": "T1A5F47D5DFE4E3C41E3DBE3789F4E43E1A22BB1A0D32391A33941534D94C69E98BB0656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935770, "uuid": "4eafb7ad-175c-44f1-a427-93ce3986d336", "value": "12288:Bja/NN6F+vZ8+5frI3RP8Cvp7kQHPfK/9cz5xf1qgtw5W74juF:Il0Fw5cBPRvpHXgOvRT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781935770, "uuid": "7d522e78-6080-4fb2-beb1-67625f834192", "value": 729024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781935770, "uuid": "b7cccef0-d4af-496b-a1bc-cfd6149a404f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935770, "uuid": "eee37359-dce3-4988-9101-f5560e4af3be", "value": "bot_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd250942-6c3f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781915697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915697, "uuid": "ad33ae4a-68d0-454b-80f7-d8a132cf41f9", "comment": "Malware payload (Mirai)", "value": "5fe73e2edf8f18f09911fe9d2b188f5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915697, "uuid": "a7294277-0ef7-4530-ab54-2b62cafcc6d6", "comment": "Malware payload (Mirai)", "value": "e09667e7d5dc50d4ccdd7263a1612a37a33ec80665471a0fcc2380e184cfd298", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915697, "uuid": "3bfa34df-d1c8-4491-9282-c82210c66061", "comment": "Malware payload (Mirai)", "value": "2c9673574be5499970279508cc5eca869ec2ab2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915697, "uuid": "1bc02ddb-a65b-4069-94b3-0844be71d712", "comment": "Malware payload (Mirai)", "value": "e2c4fda225d3dde23cbe3f66dd6cec0058df01e50b351c01aed5203f24b99d0e1216c1dc5bb48296026e1b02f6ec9fd9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915697, "uuid": "d2d0db49-7ffe-4470-ba4a-a90633be396d", "value": "T1B1433B31BA710C2BC8C4A57972F74365F2F5878A20BC8A1B3DB20D8DBF6494076576B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915697, "uuid": "18630350-b9ef-4465-913b-cb6b1c8a5d6a", "value": "768:VC38KXva6OJfx2AYOo0ISo05FzZfIYxiO+YAG5VLjujLAHnF1tlPYyI4:VCMKC6OCAAAo05FzZQNYB5hjKAtVYyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781915697, "uuid": "4efad1de-a207-40c7-979e-86e32aaf9c24", "value": 56696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781915697, "uuid": "e9be2969-0bc0-4ac2-a346-1922f8e818b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915697, "uuid": "211ddc7b-d74c-4c61-b1fc-71647e60725d", "value": "godisdead.9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "601c2057-6ca7-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781960155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960155, "uuid": "202cdb6f-56ec-4249-a21e-6cf9252d8893", "comment": "Malware payload (ConnectWise)", "value": "b274c8c20aa752171b716382707b85f3", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960155, "uuid": "5ef848e8-0ac6-4d7b-b87d-bff59f7b2579", "comment": "Malware payload (ConnectWise)", "value": "e176972714a4fd0fe9b299ae8598487c92d9da508de42d042d1ddccb8548a3b5", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960155, "uuid": "1bcc0155-71b4-4ff5-a0db-660ad79ebf0c", "comment": "Malware payload (ConnectWise)", "value": "d8c611e7d43a0d746530580f3d87d71aebbc446a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960155, "uuid": "d5d0d59d-c68d-4103-9602-53e6144053c4", "comment": "Malware payload (ConnectWise)", "value": "99b5dd3e6450ec600bc45b44590fb51584778a83b6f62a283e7cd696670cd7ca1653b04d3483530a89545a82d8089fdf", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960155, "uuid": "c1ace890-7a3b-48d0-8809-4b6fcaccc0a2", "value": "T18246F111B3D995B9C46F053CC87A52AAA674BC048312CBFB57D4BD693D32BC05E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960155, "uuid": "4e9e14e6-1850-4399-8463-375d4ce18efb", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960155, "uuid": "dd45fa1f-ad34-442b-a677-f089121a5aec", "value": "98304:fps6efPi1Evc4/I7Od0jxRGsYh3eqQumU73tca:BfefPdk4/lGjxlYpeqQzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781960155, "uuid": "1dbb1148-ae9c-447f-89ef-906bb05535f6", "value": 5510568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781960155, "uuid": "6aa41a52-8dc0-47c0-9e5c-291f6bb05c5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960155, "uuid": "3275368e-87a6-433e-b977-5ca5e5783233", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c033cc5d-6c5a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781927245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927245, "uuid": "0192f15a-8ac6-4147-9541-dc18c05ba43a", "comment": "Malware payload (Mirai)", "value": "4aee98c8d59fd2339d1747b04dcf14a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927245, "uuid": "19f666b5-5bc7-4209-9f4d-de44a5967ad5", "comment": "Malware payload (Mirai)", "value": "e1f9d07a1288535d8a729f92e5be8bc0669c5214c2bc7e966bd0c2c0d78bb0a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927245, "uuid": "48b00d43-8a8b-425a-a8fe-8b65f33e360f", "comment": "Malware payload (Mirai)", "value": "f64108640bbbc1db0fa946f6671da6e9790c9344", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781927245, "uuid": "deca4511-0d78-40ab-9d8b-956d00e83d5c", "comment": "Malware payload (Mirai)", "value": "b068a87caf07ecdf0d3260f730f8776e43dcf1680935977a228f5952e772cfa63f39aa034d36738130837131be3b1716", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781927245, "uuid": "b7838576-5d15-4607-b760-4168e8407e3e", "value": "T1CB243B45BC919E13C6D522BBFA5E428D372A13B8D2EE7103CD225F24378A96F0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781927245, "uuid": "96bce49d-5dfa-48bc-927c-41be8e82a3c4", "value": "6144:2PunWqVhU7p2n1m0SObhx4cLHkJnONRN1:YuWahU7p2n1eCx4c+W1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781927245, "uuid": "a415e970-c6bc-4066-9733-f865cfbd4b17", "value": 214336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781927245, "uuid": "2844127c-d8f6-4ead-b07f-e7c8920bbe97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781927245, "uuid": "18e5b804-258c-4935-be22-8acdec97dc91", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d653f6-6cb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781966068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781966068, "uuid": "3ea9b73d-20f7-478a-b39a-c9970a8f2be7", "comment": "Malware payload (Mirai)", "value": "55965ff4cc9994932fd4f296119cc258", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781966068, "uuid": "f427f4b7-974d-4d44-ad27-6d6e2cb7c718", "comment": "Malware payload (Mirai)", "value": "e217c20ed2c02f4e05dd16c876b8505bb90bc98da0001360496bd1966e7a734a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781966068, "uuid": "164d2144-e10e-4d6b-9176-fb7ae87ff003", "comment": "Malware payload (Mirai)", "value": "ddd216c957f8c7a4fc74bc46a81c764cd9176723", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781966068, "uuid": "910544fe-52db-4fa1-af46-185f14bd7317", "comment": "Malware payload (Mirai)", "value": "2bc9d73d01c8f21502b287917474da9dfb91cf137c15c705e20bf26386bd3b45c9e8cb5ab290d937161b79bcd359fded", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781966068, "uuid": "787ab333-51f2-4ecb-badc-ab47c7aebf80", "value": "T181742A0AAF550FBBC86FDE3702A90B0635CCA55752A53B3A3578D518F94A50F0AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781966068, "uuid": "20eb8a3c-3baf-4a44-b79a-8f8afbe444cd", "value": "6144:euSu171RCyWDYLDqfxUrTEHqSiP2tp3/F9I56VBdOi:zSykyW4LrY7tpZBdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781966068, "uuid": "1c5fe442-f9e1-4805-a905-f6eb9c3caaa4", "value": 353740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781966068, "uuid": "070b248b-8775-4d79-80cf-c82476f90a0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781966068, "uuid": "86e57fda-0c39-4553-b964-d651cb664382", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595fd986-6c5f-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1781929220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781929220, "uuid": "51d44f30-0131-4555-a9ca-20b46b2f266b", "comment": "Malware payload (ValleyRAT)", "value": "31bc8a50719d453321bf1b2eb65c42af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781929220, "uuid": "50b5ca33-d5b5-40de-965f-1db8d6950047", "comment": "Malware payload (ValleyRAT)", "value": "e2faaa60c6b7dbfa1f677b72458378b30fa071c38cf375ba2fd55b89d4f85fd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781929220, "uuid": "abed75dc-5871-4eb7-b52d-ea6bd30c3c88", "comment": "Malware payload (ValleyRAT)", "value": "dd7670bf8ecfe43b58f16c707079019f873a3511", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781929220, "uuid": "39a03121-e1a6-42bb-b2de-23067a75d1b1", "comment": "Malware payload (ValleyRAT)", "value": "a6d40d72b98f261db97baab369779640278fab47a5a2bfefbf36a1347bce9643a709a577b51860f46aeb6ae3f9a5d560", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781929220, "uuid": "db22e654-e032-4583-9b29-d5185eb20987", "value": "T1CB25238F520269F4F64A0E70A33468D6294862F2F9943A640D07C6DDB9FD5CFEE4A5C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781929220, "uuid": "a9b2cd6c-08c1-454d-80a2-d2a9f11055a8", "value": "81f44ab6fc03aaa8a2974a99b48390b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781929220, "uuid": "f6a9d9c9-6406-40ce-afd9-f0032671e883", "value": "24576:P2cYovQ5tpq1VLIsxFDVuHdF4eEyBwZ6AHCdYv41yGpjaqwcwPP1jR60:P2povQ5tpQ1XFD0Hv4eKZ6ESQgyGp+95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781929220, "uuid": "d38b716f-a0ec-4cf3-9fe3-f9feced3e464", "value": 1000448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781929220, "uuid": "3222fc94-5134-4b8e-9b99-73a02685552e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781929220, "uuid": "33768770-f7d7-49db-a95f-1470c46423fb", "value": "31bc8a50719d453321bf1b2eb65c42af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1252dee7-6c98-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781953582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953582, "uuid": "e3f7994f-070f-4ef2-b173-8310a26ba438", "comment": "Malware payload (ConnectWise)", "value": "8f45724779f470a3697b39fa6a6be4db", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953582, "uuid": "7572d0f7-f076-4ce0-b25a-a7046b8f7586", "comment": "Malware payload (ConnectWise)", "value": "e35d943f539f6d61e0d9e5d39f5cc78180accb01a7a42fe7287b2000dadfaf4a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953582, "uuid": "475f7805-6e3f-4162-85a9-a4ff4a687c45", "comment": "Malware payload (ConnectWise)", "value": "a0bc24435ea17b686873950175f23cdc31c81df5", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953582, "uuid": "1603e9f4-7b47-4a36-8d6c-04bd92f68527", "comment": "Malware payload (ConnectWise)", "value": "2f60dd95467d921533503f341003177d51486c383ebf5c385f85f86a21337eab5de85fd005205576961bd631b7102976", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953582, "uuid": "fe27d991-3982-4647-9367-97269722cec0", "value": "T18F46E111B3D995B9D4BF063CD87A82A99A74BC044712C7EF53D4BD2D2D32BC05A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953582, "uuid": "53b24146-693d-4841-8659-018e90571501", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953582, "uuid": "d6b2d06f-44e1-4568-a749-e2e0788e7193", "value": "49152:GEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqMz:DEs6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781953582, "uuid": "87e982f9-06af-47dc-8f0b-11c88eb46061", "value": 5640984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781953582, "uuid": "0de236c5-11f3-4d5c-b255-44b4724de3bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953582, "uuid": "951ff658-bb60-457c-8b9b-4c803bf04638", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956bf651-6c3f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781915577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915577, "uuid": "22ecfb8e-4fd5-47f1-b9eb-33d04fef2082", "comment": "Malware payload (Mirai)", "value": "8fa805cc0de42c38ad34c961c037d66a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915577, "uuid": "36354b5a-759e-4836-934b-f6369749f61b", "comment": "Malware payload (Mirai)", "value": "e3f701ea1b5f8770d46bfa14c3a622fecea562f2586b652e7d7a1042e666b1ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915577, "uuid": "819c2000-49d7-4ba5-a95e-1cba5dbbd86d", "comment": "Malware payload (Mirai)", "value": "74128799d533f12874833a0308e298f4fb54ced2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915577, "uuid": "5dd608a0-98ee-4923-a413-c15c719ee38e", "comment": "Malware payload (Mirai)", "value": "fef9e0fbef46949cad6185180d9f4b9c873b60ba23efcc426e617f1fa57f84f074a9c7a9333982a2941e63fb907a37cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915577, "uuid": "83d76b9c-5de9-4771-a9f0-4502911447f5", "value": "T1B8331B41B71C0443C5732EF03A3B27D0E3ABAA9122A4E685751FE68DD1B5E339586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915577, "uuid": "8fda461f-0898-48e3-a333-fc66742b0d77", "value": "768:QSq5pp7MmvQW9UG47oRl9Zs5fFXaMLCN7Jev5HFMuta25oeIH:c5phD+P7o1Zs9FK2CNleROuANew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781915577, "uuid": "6b5854a6-df94-4d6a-939f-ea6fae33e8f4", "value": 50624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781915577, "uuid": "fa3a9dbc-110a-4fd0-87e0-9f3533930351", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915577, "uuid": "cf3f3f71-bdbb-4ff8-be91-86720c06cb24", "value": "godisdead.8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4867b81b-6cdd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781983308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983308, "uuid": "9ad790f0-4c45-4acf-a355-1786dffa87fb", "comment": "Malware payload", "value": "89ccc31bbe39fa4f782c4331cf91be3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983308, "uuid": "3e9571fb-b9b8-4147-9dcf-12a1ff86f5fb", "comment": "Malware payload", "value": "e462eb417f3ebe66041226a9d05174353889f1d189d71be1fa0559b0b40f8c79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983308, "uuid": "8994e8bd-63ff-40be-8720-f2b9de46694e", "comment": "Malware payload", "value": "0d11712f2ff681fa7c120688e8f5839a77e91e38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983308, "uuid": "53b632ec-1c80-462c-a3f7-87004b487c8f", "comment": "Malware payload", "value": "ce998d606a9e3a7ac268bf14924943af0b1597fe959f886b6ad00bb36309a461f7841e12eaac8b0850180ebe9644cbdc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781983308, "uuid": "0807b8b0-1877-4359-9959-669fbc431b16", "value": "T132342999BC40DB62C6D427BAFB5D829933130F74C3DE7506CC241F2966EB55F0A3A682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781983308, "uuid": "9a11e6a5-1ac7-48db-8a48-5a565b2ed01d", "value": "6144:scLotBc52LE+U4rEssM8jaMK3771WChKHgOZ:HLo7cMU4rETaMyB4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781983308, "uuid": "c23797c3-6517-4fca-a5d7-b3b4f3eb7ab6", "value": 243552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781983308, "uuid": "7d522b40-7330-4465-b53f-93350c3a0a9b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781983308, "uuid": "e5b3854f-d680-41c5-a2fc-1d0c1244b7d6", "value": "SecuriteInfo.com.Linux.BackDoor.Armada.1.30483.9391", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb6ccd9-6c4b-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1781920850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781920850, "uuid": "d0591929-3e01-4a07-afb8-34e26e27d0ef", "comment": "Malware payload (DonutLoader)", "value": "5bcaf2b4bf85bb4baef075a678f2fb76", "object_relation": "md5", "Tag": [ { "name": "15-235-159-82", "colour": "#367F16", "exportable": true, "hide_tag": false }, { "name": "blkcosmetics-zite-so", "colour": "#933261", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781920850, "uuid": "517859a6-48f6-45ca-940b-46250d92ea67", "comment": "Malware payload (DonutLoader)", "value": "e58ed7df39ec67a18fd90454d3fde120e57aeb06f7ab8f0b8c17d73e4c3a3ad6", "object_relation": "sha256", "Tag": [ { "name": "15-235-159-82", "colour": "#367F16", "exportable": true, "hide_tag": false }, { "name": "blkcosmetics-zite-so", "colour": "#933261", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781920850, "uuid": "6f711ec8-8498-4a8a-8551-df7574a4a778", "comment": "Malware payload (DonutLoader)", "value": "47f125ef46b8527fead5fd0590df951024cbee04", "object_relation": "sha1", "Tag": [ { "name": "15-235-159-82", "colour": "#367F16", "exportable": true, "hide_tag": false }, { "name": "blkcosmetics-zite-so", "colour": "#933261", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781920850, "uuid": "8d89b386-0eab-4b2c-bc13-d3704bd669f8", "comment": "Malware payload (DonutLoader)", "value": "0f00e13a7396b3a54b4ae140dddc01244023cae6013b5ad0f2035a5a49d2d6d6fc65ac0e399f1fc3fddd459ba1f7e401", "object_relation": "sha3-384", "Tag": [ { "name": "15-235-159-82", "colour": "#367F16", "exportable": true, "hide_tag": false }, { "name": "blkcosmetics-zite-so", "colour": "#933261", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781920850, "uuid": "176b8ae1-a033-4e15-b657-033eb3f37d6d", "value": "T191F42357A72D61F5F630F5BAA2C34F72EAD875191A64035FB0A1E00A3B47A9C847620F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781920850, "uuid": "13ceb924-5626-4da9-b838-b6eaf9288076", "value": "12288:Wg+QGeIx3CC0kaCbWr17EFeUyPdjY6hxZNXdu/I3jPCkEogpRY0pQIXv:v+LN3CTkNbWrJEFeUyPdjfxZVY2leO0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781920850, "uuid": "7075ed74-dcea-4b22-8881-e7753e0d64a0", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781920850, "uuid": "b4ac132d-157b-4ba4-81b3-b22785072af4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781920850, "uuid": "f31ad5a0-f770-473a-bbc3-bd65912a1954", "value": "mscorsvc.dll.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32657264-6ca7-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781960078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960078, "uuid": "d40def2c-ca02-4e3e-b7af-908e215fe9ea", "comment": "Malware payload (ConnectWise)", "value": "016b642c77e8ee87b4faf0b0e507e15d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960078, "uuid": "6ea154b4-d9ba-432e-b559-e876dced075d", "comment": "Malware payload (ConnectWise)", "value": "e681fb538d6b064f2bb81ffc552784b264d3888eb18df2ae50fd133b35feb95a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960078, "uuid": "efec6cd5-128d-4041-8a94-937cb32a1e47", "comment": "Malware payload (ConnectWise)", "value": "dbf792049783f13098d6fc6cf14eeb80a1be0caf", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960078, "uuid": "e1c4a56a-de10-4de5-8a76-36a617fc036b", "comment": "Malware payload (ConnectWise)", "value": "829bc164185622712e33147e43b84ff4600b0caf4e3e961c22a73c8826d5425ef1cfebe4e8c1bb5160796b87df62cb3d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960078, "uuid": "7c31a647-a171-4026-a1af-5652340231e8", "value": "T1B5646C11B9C48432C673383107B8E2B28DBDB8301D655B8F57A81D7A9F745D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960078, "uuid": "79d4e55e-6af3-4541-8f33-b5d4fe67cfcd", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960078, "uuid": "59a26249-f00c-4c8c-8d82-83766c4b0dd7", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:51iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781960078, "uuid": "f1f5f3cf-635c-4bec-87fe-b1acd52ff62e", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781960078, "uuid": "ddb35d79-49da-40a1-b6d6-2b350f8844c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960078, "uuid": "92a58a37-443d-4284-8a6c-57ad6cc87c62", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea6ca90-6cee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781990620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781990620, "uuid": "1ff274eb-1193-4daa-a3d6-47f2e4f387a0", "comment": "Malware payload", "value": "e9e5d59a5c4581af3bce8f73cac1ce2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781990620, "uuid": "f571aab5-7bb3-4f10-a1bf-f3239d659b03", "comment": "Malware payload", "value": "e6e09041ef99c529827b12f93d988dc29320fffdb604fbebbfc7403cffae6baf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781990620, "uuid": "bcdf62f3-c355-4378-8b9c-47101f56b772", "comment": "Malware payload", "value": "eb3735257c0e387fdf77627b7dbd9d41c7c2c031", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781990620, "uuid": "258a34d3-cef5-4cca-a263-ca9c25152b4b", "comment": "Malware payload", "value": "231ea3e854c487b6fc70d9f1801aa2f1280adb5a558b54b008938ea19919b7461c367a3f2feb3cbb9bd050b4c51d055a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781990620, "uuid": "88d2f415-859a-4c86-a2f8-7aaeaf002058", "value": "T1E1B3126DD4C279F6D31E62FE963688BA25CB1181A32A8D10C7C0E29474F252B7F412F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781990620, "uuid": "8893705e-1673-417c-9bb0-10074c27f401", "value": "1536:Dh+Fy88PsZr9RO0VrDB6ETv7oXPYy55VuS9driXjMvp2/mBTU6ZdgWDhNI:DhpPsZZRbDBx7+54SajB/9wnD3I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781990620, "uuid": "6447c1fe-847d-401b-9409-ad88058afac0", "value": 115308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781990620, "uuid": "f1748e0c-b1aa-4644-ab9c-2f92232699b4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781990620, "uuid": "197b08be-6f8b-4edb-a509-628ca9eae302", "value": "kworkerd-cgroup", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3742b07b-6cae-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1781963093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781963093, "uuid": "89f2e812-f4fa-41bc-a307-417f79260c78", "comment": "Malware payload (SalatStealer)", "value": "d36c0c4fe0ddc64e42a4674da64d7838", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781963093, "uuid": "8acfdd41-2a10-44f9-b7c0-9cef32b97cfe", "comment": "Malware payload (SalatStealer)", "value": "e7a53970dbc5a570d4d98e963902f37641fc6e526ef9af1e7117806436b7a394", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781963093, "uuid": "2d1866ba-f313-4bdb-898a-42e4dc12763f", "comment": "Malware payload (SalatStealer)", "value": "3df8d4836f520c7acf17b3e82f21d04f4dc0e676", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781963093, "uuid": "ff8c9eef-aa96-4648-9e81-e7e0929e828c", "comment": "Malware payload (SalatStealer)", "value": "0469953e0e3885621dee445e8f22679b9c6d3334ec089959b5d5b218cf527f8defbb5afdc3ada1e58a09af1a27deec4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781963093, "uuid": "a1417987-495d-4b0e-929b-d4c727c238b1", "value": "T1C1F533450D4585A0E2423E7BB638F9D2C7CF44B31DDE733528DA5ABC2AF9239A81CB54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781963093, "uuid": "e14f80ee-de4c-4bdf-8762-0c26492d1283", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781963093, "uuid": "d1137bd4-5d2b-4bcd-baaa-d081ffccd119", "value": "98304:9wcW9N2UK8VcExofhU57T7XUkm3SWYFAMaF3qX:9wcI2UK47xofq57TTUFbYFA1x6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781963093, "uuid": "57bfef11-0690-4998-9f69-eeb260657d3e", "value": 3596288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781963093, "uuid": "1073176e-8e69-4fe5-85da-164dc0db8c7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781963093, "uuid": "bf1c57a9-2244-44d7-813d-c01c19ec76aa", "value": "ZapretInstaller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fae9e7e6-6ce4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781986614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986614, "uuid": "7e7887c8-4960-4a22-807e-3e1fecf578a4", "comment": "Malware payload", "value": "32d32d166fe24c9fc193c34a4dc498ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986614, "uuid": "2ec49b64-7450-44aa-a983-2ad19fb08540", "comment": "Malware payload", "value": "e7d800b02d760d904093d0490348d225c45fce9e74192278f7ed6ba240f1daf1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986614, "uuid": "58b9126d-5a86-418b-83e9-4b43af85a55e", "comment": "Malware payload", "value": "857ca1663e605404a6c821cf4841869262d0b263", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986614, "uuid": "4c2224f6-182b-4eae-bbd2-f51a95bd4ec2", "comment": "Malware payload", "value": "c006e33ecea8157fcbb81b49d70dad14dc8d7cad1bd1d9335e541fda4d7ef19976621aa75fa49efbda536b7b2c772504", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986614, "uuid": "aba21aea-6993-4419-a474-02a55ad27df3", "value": "T1FF564981FB48A12AD94A0A324CB30B70B3916D85C1F48D6F5709F72F45B26F6A94FED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986614, "uuid": "1da98078-f9c1-4d27-b9ea-1213c0ce8a6a", "value": "98304:k29ZrWykQ/HSuiKQgS0VmXn88LjdW0InEjEo:tWN+BSHXdgnfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781986614, "uuid": "3937df88-c8ed-44c6-8dd5-b1cf85ae5d84", "value": 6094996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781986614, "uuid": "7fd15211-ddba-40ad-a63e-04cfd152941e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986614, "uuid": "1cde8e23-d274-4415-8290-60b5bbd484ac", "value": "devfreq_wq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb1a3a1-6c91-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1781950677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950677, "uuid": "de92e6b7-f412-452b-a2d3-1b79843ee5c4", "comment": "Malware payload (OffLoader)", "value": "f43f3c8b39e4d994731004cd1b4dfe85", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "InnoLoader", "colour": "#11B482", "exportable": true, "hide_tag": false }, { "name": "INNOmod", "colour": "#E48587", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950677, "uuid": "597c9bb7-4289-4eb7-a716-61879490e789", "comment": "Malware payload (OffLoader)", "value": "e7deec3049b8f9a8c8faa363bdfcec0717b390bd04af6607a68dc08008445179", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "InnoLoader", "colour": "#11B482", "exportable": true, "hide_tag": false }, { "name": "INNOmod", "colour": "#E48587", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950677, "uuid": "a9f57777-31cf-4add-a350-c8abad6b49fb", "comment": "Malware payload (OffLoader)", "value": "2c017e284c65dbb7871b0cf46c1dea0416adbc1e", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "InnoLoader", "colour": "#11B482", "exportable": true, "hide_tag": false }, { "name": "INNOmod", "colour": "#E48587", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950677, "uuid": "173d5721-109f-4ebb-92a4-94698f32af69", "comment": "Malware payload (OffLoader)", "value": "809e91f7c7d78a36ff1d30bb20fee59bfe37259a8b0d2c3c6c74d8d354fbdb07cc4c42e035c2c5ec619b4185b56b42bf", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "InnoLoader", "colour": "#11B482", "exportable": true, "hide_tag": false }, { "name": "INNOmod", "colour": "#E48587", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950677, "uuid": "c93a01be-15a9-4b4b-b651-513988ee4119", "value": "T142A5C03FF28B653EE06A16367A72A110983B7A6165124C1696FCF88CCF355701E3E787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950677, "uuid": "7c9b4528-65a7-48b6-b03c-30b11079e1cd", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950677, "uuid": "4ce9461b-a533-4a29-b9a8-9a3bfa2d1669", "value": "24576:TXVrSLScusMmOvjjhzvLSIPHjxp9u8x/37Mfs/cwHbz4pj8C1j2mk3Ua5fiJ9UW0:4uI2h3P1Hu8x/3ok9bz4pICVmkZ866u+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781950677, "uuid": "e180674f-1f68-48f1-81db-7bfb947131d7", "value": 2099461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781950677, "uuid": "1a93b777-3d61-4fb2-b41b-b7e076fa4514", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950677, "uuid": "2e063f24-3b37-42ae-acc9-cc95aeccd208", "value": "Delta Executor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ec85ea-6c6d-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781935284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935284, "uuid": "760fdb7b-9caa-40b4-b9f7-075309a232e0", "comment": "Malware payload (CoinMiner)", "value": "31960122a2b532ff1480019a9999d479", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935284, "uuid": "83e4bff2-ffa3-452c-8d51-ab5603efcdff", "comment": "Malware payload (CoinMiner)", "value": "e80bdd61c33b35d0697f5a183b78f255b0ccb86d39784af9b9f7916d93129998", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935284, "uuid": "e2fe5e34-ff04-4889-a315-768560917944", "comment": "Malware payload (CoinMiner)", "value": "d9db4555358d9c3984c88ca60ebcef3a02bee149", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935284, "uuid": "f4cc1bb7-18bb-440d-952b-4ec3f76db2de", "comment": "Malware payload (CoinMiner)", "value": "67c21c6eb4d5c67ba98d7e33e4a2f45ae2c63a4070688e2a6c42e56e7eaee42252dbde95297e894cfcb5363d7b3bb965", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935284, "uuid": "871eb90c-4e4d-41a1-8475-de98216becc6", "value": "T15AA3123826DD584BD4B849B03129A12517BF5A20EBDA1FA769E88EE1CD070C77BF1317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935284, "uuid": "08d302ee-4652-4344-a5f2-7cad59beba35", "value": "3072:Cng01ewb5Wh5Oe52bnGGvaZ1KWeM/njak:Cng2e7qesiWanKKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781935284, "uuid": "36a814d4-6329-476d-b8df-96f5b7f1ad3b", "value": 105136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781935284, "uuid": "0afa68ab-ca89-4726-ac40-0600e4c06ca2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935284, "uuid": "315706d0-6430-4f65-85a1-da668c2199bf", "value": "kworkerd-blkcg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d67bf2-6cad-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1781962683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962683, "uuid": "5bed3a80-fe4f-4b13-8175-f286d176b54e", "comment": "Malware payload (njrat)", "value": "67540f6e31a6430c90c370a4572e7cf1", "object_relation": "md5", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "raton", "colour": "#68B54F", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962683, "uuid": "1a1f868c-b30f-498e-8525-24fd3edd9e7b", "comment": "Malware payload (njrat)", "value": "e8c84a21131672927104f8a91d1062a71351e97e3052dd1d3ca04b7b73b6e37e", "object_relation": "sha256", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "raton", "colour": "#68B54F", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962683, "uuid": "721e9901-a79c-4e93-b220-0edf8fa9d27b", "comment": "Malware payload (njrat)", "value": "43b5bdb67072735ae2791a0bdce47548aa0b56e2", "object_relation": "sha1", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "raton", "colour": "#68B54F", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781962683, "uuid": "e52cb92c-d360-4394-ab6c-e7bea968c363", "comment": "Malware payload (njrat)", "value": "9d24c71723eecd06ad7524e05c2688cf361f0e6b3a1d2bdcba3c795392d4883e69692010b6562b8ea45559644de1e8c5", "object_relation": "sha3-384", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "raton", "colour": "#68B54F", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781962683, "uuid": "02f48b46-96d9-4fab-b906-f420093bf4ae", "value": "T15DD5121C33FACB18F2AF4BB4A87189664771FD178D62D76C589139EE04B6F48AA10713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781962683, "uuid": "558cbb78-bcd7-46de-909f-a425651dd41e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781962683, "uuid": "6e0b18fa-53b6-4777-99b5-9076b29fb90c", "value": "49152:1gVUlsHjkmiGWU5FLGpMZ7iKPJ5W1tsclR0BxMzaRw486Wz:1gVUuHjkDGjzqpgmwQ1GuRxzew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781962683, "uuid": "31c1e02e-b701-42de-b015-c1204d4f5be2", "value": 2945024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781962683, "uuid": "e6021556-3f76-4040-91d5-f7ec6a5c5ffe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781962683, "uuid": "aee441a0-3ee0-4b60-9729-48ae02c6304d", "value": "Cheat_Engine_Pro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84609862-6cbe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781970094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781970094, "uuid": "72054607-5dfa-49f8-81b7-c854f1b9754a", "comment": "Malware payload (Mirai)", "value": "214e9f1c0e1e4f5367394d86e3769917", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781970094, "uuid": "43841281-10ea-45f5-8d83-2fbe0e7d54f4", "comment": "Malware payload (Mirai)", "value": "e90f27942d1409d6407dde64586c20377a356706f939b7a8070cd986f8ffe21b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781970094, "uuid": "090ea940-7101-4e2c-b56a-da19311389c1", "comment": "Malware payload (Mirai)", "value": "3d1afe1b1c98f64efe0173a1e033f75ae868eac1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781970094, "uuid": "896968d5-65b1-4d60-beaf-cf0e8797d14e", "comment": "Malware payload (Mirai)", "value": "3230a7aa2f01c0acdffb6bfee4f7d6ba2ecb2ffedc411f38173832beea5531d4fcb30071eb14a6dfa1317904ee516ca4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781970094, "uuid": "eda179e3-9f74-49ba-829c-9ef2fcdd3d02", "value": "T1E6D44955F8809F61C6C539B6F74D42A873074BB9D3EB72069A245B3437EB86B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781970094, "uuid": "156f5cdb-8758-44ee-8d0e-fc97b81d7527", "value": "12288:HrLZ9fWobKaYVtoWuSFm3eF4KyBeT+UKHyw9Vw+I78pgnSc2p:LLZ9fPYVWGmOF4Ky8T+UYyXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781970094, "uuid": "3471bf79-57fa-4487-9617-66b6c6dd9058", "value": 620860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781970094, "uuid": "0c17d1e7-468d-41c6-a902-025eb19ef208", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781970094, "uuid": "aa683dfa-e3b5-4484-829d-4b074a3857a4", "value": "barm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad435ea-6c3f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781915693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915693, "uuid": "5e1ab18e-0f45-498a-ba7b-bde15bbdbfb8", "comment": "Malware payload (Mirai)", "value": "23a53edcaeb0290c648a805d21ee8b44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915693, "uuid": "2b5f4e6c-3f54-4e9d-aff3-6733c8463da3", "comment": "Malware payload (Mirai)", "value": "ea63c9e7f92a5f90ceb1e78a2f9e4d06910cf8234905ad3858e711767a109702", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915693, "uuid": "26941496-9d23-4993-b846-1fb54f98dd83", "comment": "Malware payload (Mirai)", "value": "aedd479fbc87e649416ed9b4a03f1bf2aa52b609", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915693, "uuid": "b7829009-6993-4963-99dd-cb2452bf5a52", "comment": "Malware payload (Mirai)", "value": "40faeb746b3340eddc88cf9089591ee91bc419ca7d03c6d3481b72c4b302db845152ad7cf7addb88e02f33eb87c628b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915693, "uuid": "02e4f9ed-d884-4d20-a52c-74a4bde98ddb", "value": "T12E63A55A2E218FEDF76C873447B74E31A7A923D622E1D784E25CD5001F6034E646FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915693, "uuid": "088a38ad-0c48-49f3-b8a6-e3c9a086c386", "value": "1536:Zh4w79bstTabs8ZRgcZuq6B5Pla0mefyp0tC:Zzhbbs8ZzcB5Pla0Up08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781915693, "uuid": "2f801fa8-433c-42b3-966a-cea94b07e713", "value": 69156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781915693, "uuid": "9f7a058d-2c40-4b4f-8753-96f91fb86a66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915693, "uuid": "d2dfd0ae-3c67-4bb6-9e5b-0bc31d567876", "value": "godisdead.2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25022969-6cdd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781983248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983248, "uuid": "d23b3694-4667-47e4-a13d-fc49c015fbb7", "comment": "Malware payload", "value": "406176149f73ce4f39534ade2b529670", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983248, "uuid": "de99f891-850a-4592-b8a0-c80c916f373b", "comment": "Malware payload", "value": "ea6bdcebcb553f5089383938412f2e4010ea74ae1e6543b923cad89563c7a6cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983248, "uuid": "4871a088-15d2-4d4c-94fd-d118113411ff", "comment": "Malware payload", "value": "900503637a462e57abe3cddd5a2b72cdfdb3f106", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983248, "uuid": "14622aa0-8066-45a0-a603-a0ef9720076e", "comment": "Malware payload", "value": "3dcd5f1768bcc4502fd7ec1a6a884d904964de9007d314239ab3014bb6612073ebda1b8d86e0dd2fe9725acb392e1d82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781983248, "uuid": "027058de-87f7-4e64-b1ff-5e38ee75996c", "value": "T1E4A3121378D9FEBCDE189B31FDB553A0E7AD4EB916A83B05250A75A213C7002461F2BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781983248, "uuid": "4b09fbb9-3ba1-4539-b827-afb85395862e", "value": "1536:x2hmmFimREATtbqWoU4awpw6UjuQlLH3M3OJXxQEW0lbKcUWgmQLiTGUhaisaJzX:0EgjRosoKlj3tJ2wluuQL4hXLRwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781983248, "uuid": "72047fe1-67fd-4bba-949a-709e3611ae52", "value": 106872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781983248, "uuid": "d93f0c92-8b86-490a-ac73-5fd248514e98", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781983248, "uuid": "fcf308b2-08a2-41ad-b39c-d13418c1f2fa", "value": "SecuriteInfo.com.Linux.BackDoor.Armada.1.13139.19924", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2b8b008-6cf2-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781992532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781992532, "uuid": "35b2cf7c-222f-4e04-86e9-5b260ff70768", "comment": "Malware payload (CoinMiner)", "value": "b9970201d525bfc80d9c3b1f011e4178", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781992532, "uuid": "074e30f7-bfe9-4616-9bf3-6e6f5d224888", "comment": "Malware payload (CoinMiner)", "value": "eb2cca230b99d059355c3d4d2c35e9585aedd030c7477535b86bbc950d7ea2a9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781992532, "uuid": "078e9cd5-1a2e-40a6-ab30-52fa08e68658", "comment": "Malware payload (CoinMiner)", "value": "2d8cd9d19e931872f9a9999db7e61c59f39808b1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781992532, "uuid": "36b3a44c-791f-4c80-bff6-171bbdb66fbc", "comment": "Malware payload (CoinMiner)", "value": "85dc8777689f25a14d6595bd2956d859e63d42b27eb284c488b01b4bc78c2d162988a89fe7d6ad820756dd62c0f0340c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781992532, "uuid": "e448d1ce-4075-403b-a1be-8c4a6af95d57", "value": "T18BE533D09BC3D9D7C641037E89A6461E2334E6850BD3CB1728B5A3760E366D07F87E6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781992532, "uuid": "86dd30aa-9aa6-4a13-bf1d-10dab497be20", "value": "cd40545a33dc365b00dc388241fa5c66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781992532, "uuid": "c28ec17c-2176-4074-b672-4a74e63cebb9", "value": "49152:3hbmYcsGXSpUkCTIipshMVpFb4g8p6L54DNmg1ss1M7i+/htP+rX9kw5OP9htWMR:3hb3zUHr366LGNEv7i+5tP+JkwYLSlF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781992532, "uuid": "e5fedaf8-4874-46e0-a651-d9fe1c8d678c", "value": 3051444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781992532, "uuid": "9e848ea6-0521-4a11-88b9-e851ec28cb31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781992532, "uuid": "085d3304-0e47-4bfe-ac1d-3b3004cfca47", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00699781-6c56-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781925205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781925205, "uuid": "03952660-6e29-4a42-8aab-b6216cca3e95", "comment": "Malware payload (Mirai)", "value": "05220e01eaa6c949b337c28fd6ed340e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781925205, "uuid": "f4b41a89-7dc0-4100-a3fa-71c0d59cb877", "comment": "Malware payload (Mirai)", "value": "eb4bf151a3f97f05ca889671cd63b38391fcbae0cbb552c42ad0eef97a6d584c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781925205, "uuid": "c4ba24d8-01a5-4a8f-a4e4-f9da923809c5", "comment": "Malware payload (Mirai)", "value": "a4cd52ae3e6d69ccc32a522c9ccb5a683468f1a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781925205, "uuid": "fac82086-d301-48d6-a136-6f3faeb7b76b", "comment": "Malware payload (Mirai)", "value": "ff1f279c0662131c814a5723d3a18ba55405f73e6d9ddafe14267d5b5588c6ddf67b61fbb6644684bc5c1bc8138a57dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781925205, "uuid": "0f2b1618-c9fe-403c-a298-c7020e6b4e03", "value": "T156B32A49F8D0DB66D6E5267AFB9D029C33130778D3D93202DE14AF3532EB55E0A3A906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781925205, "uuid": "7f041f6a-d245-4ee3-8288-f20acb762e00", "value": "1536:CBwaHiTxLwTsZj8NTzbKxtdzbNVHZJEJ54hSnO+22FKnkbORw3IkU6Mpn9k/0L2U:CZiTB7cgtfSeSnX5+Rw3IkU1B9diet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781925205, "uuid": "f252a040-f737-408a-b402-a681db83545c", "value": 116032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781925205, "uuid": "f4db516c-4ca0-4f0a-9171-cec1af9da85a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781925205, "uuid": "1b974a04-74f4-4169-8278-9c928002059f", "value": "monero.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f219a7e-6ce0-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1781984742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781984742, "uuid": "454e4325-3719-4fc2-9ef8-6fdb95ef070b", "comment": "Malware payload (Prometei)", "value": "2496f7592fec3c0abba8b6cbec2765ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781984742, "uuid": "359208ca-8527-441c-9197-10114aff96c8", "comment": "Malware payload (Prometei)", "value": "ec2c3ddffdc0ff40a4d9c59c03221733b80fe36bb706bcbb9aa4650e05e96a5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781984742, "uuid": "df5a1e06-9186-4f03-bd05-ae440c9008d9", "comment": "Malware payload (Prometei)", "value": "f32c9b396b378f5d524d732c42bdd3b0df08e332", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781984742, "uuid": "2172ec49-3dc1-4d99-9dc0-16b65bcff34b", "comment": "Malware payload (Prometei)", "value": "7e93065cc1ccc729d69ce865e5a07b48dc703b3b42a1056fd4f860f3d73505c014d1274db576517efaa19ddbd128dd61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781984742, "uuid": "103115a2-98bc-4df1-8ba8-e5cdcda1aece", "value": "T1B1A423B4F9219E9F6DD76DB91B24831DE181C172689D4C2313AE94A34F3D632BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781984742, "uuid": "8ae5304f-7451-4d52-83a4-79403d2b49be", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsd8:Fs6pyCC/Ya2hpi6T6N4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781984742, "uuid": "132aa29f-2a65-4e84-9aac-50ae5167116e", "value": 449090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781984742, "uuid": "11894db9-5d38-4207-a110-7fd50d3dbf9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781984742, "uuid": "aca82ab4-8196-43bd-8524-9243b973481e", "value": "ec2c3ddffdc0ff40a4d9c59c03221733b80fe36bb706bcbb9aa4650e05e96a5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aab72db-6cf1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781991955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781991955, "uuid": "fd84d9d8-853e-4859-9bea-eabb86eb50c5", "comment": "Malware payload", "value": "5b73137186d169060ebaa1faa292ec49", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781991955, "uuid": "3f79fe70-67a3-4b51-b720-ec514764f5a9", "comment": "Malware payload", "value": "ec77a80a984c029be6242314bce682b5234783801f4dbe449b250e0198bcbf26", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781991955, "uuid": "8d8b4f46-6f84-4717-a4bd-7f6e24f2b518", "comment": "Malware payload", "value": "530a6d4e50f2f7a2dfdc2aa09e49c825bb185f2f", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781991955, "uuid": "ba09d86b-f46b-47a8-bef5-7a7df4f1ef09", "comment": "Malware payload", "value": "b51f14cb541b920cec82ab04d180a3b174bef1218965180d1abfd7c227a2f7ff39f1d206ba9aac8be3549130706c537f", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781991955, "uuid": "27bad16d-47e1-484e-b24a-79b8da7911a5", "value": "T1E863A6C875A78831D0BF9EB6E6D7624B5DB060737C01D2491CD216E2AA11EC6F90ECF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781991955, "uuid": "663766b0-da17-4eb4-a5f2-d8e0c116a8b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781991955, "uuid": "1bbecf96-578b-4184-9339-78a43cd28b5d", "value": "1536:TokUMg4r4apZm9LXfbSHYdR9bS8LP/AX:Tok048aTm9LvmeR9bSBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781991955, "uuid": "9b8dcdea-035c-4d32-b1ed-8a20b6693da5", "value": 70144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781991955, "uuid": "be2ac8e6-b583-4d2c-8438-b9501d02e0d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781991955, "uuid": "86d38c33-3dd9-4c07-9fec-ad8ce13ad4b0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c58633-6c98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781953940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953940, "uuid": "985fb423-7c53-40b3-93dc-31a6e233181b", "comment": "Malware payload", "value": "da8477a03bf4c8f4926c2cfe25e52afb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953940, "uuid": "59a7d50c-c643-4bd8-85fb-852d92ebebea", "comment": "Malware payload", "value": "ecf36149156698c531615c8d553d6588dc48b2befe47ca1a7339f194daebfe08", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953940, "uuid": "8d8cfb14-24b4-4dc3-80c4-1478813cc323", "comment": "Malware payload", "value": "8d693cd4723944b4a8b02da6d466c194fb3461cb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953940, "uuid": "4dfbc7e9-4113-4e61-b770-e5c0c0c72c04", "comment": "Malware payload", "value": "ef15042cd777adf200e1ebf6b8fd87d1993ee55754a4e71a43252ab942e60e00f4fdd71adbe175f5ccc45092f022fc2a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953940, "uuid": "0547e540-4d8e-4d3d-8ab8-bd2f2099aee3", "value": "T126E1F3B792374DF7F33827BD8683A6D551FDB7344AE30B4A1E1818095492D1878A4F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953940, "uuid": "773771ce-f549-4b7a-ae97-6ddc469a81bd", "value": "c2d02fc98f1d75d7b9457468ec75da0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953940, "uuid": "22084ce8-078f-40a3-8bc8-6abdff2880d9", "value": "24:ev1GSkiiljEowSQkUIDMyt8XZh9h9ClfAdN7je1qgqu+up+:qkfj2qxYy6XZh9hMlw21B9+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781953940, "uuid": "7d7972a6-db3d-4fb5-af34-fbd0abfcb9c0", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781953940, "uuid": "7cb860f6-4ded-4186-8ec3-bcfe2f3ca836", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953940, "uuid": "b16342f0-b293-4bdc-a729-1c02d6deee2e", "value": "8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4846da43-6caa-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1781961403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961403, "uuid": "0fcd81c6-a961-4f4e-8684-8d38568928ec", "comment": "Malware payload (SalatStealer)", "value": "93f74ef611a21edab4602bacc1925b7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961403, "uuid": "aee1deb4-c9af-4863-b2b7-84bc142b1653", "comment": "Malware payload (SalatStealer)", "value": "ed32368823c139fa2e2f0771e6716f93c7db856aa24bbc81c0eea653ac3618f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961403, "uuid": "92a53a22-2af7-43c5-bae9-9ffc64e268f4", "comment": "Malware payload (SalatStealer)", "value": "d864ee78933a3c2758eb4446cbf601ed0826b8e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781961403, "uuid": "48dba791-57a9-45ad-8000-406acf0fe495", "comment": "Malware payload (SalatStealer)", "value": "06f41e197be626afed2891deab93d5b9f7ac201bdc6cadf84f94d979dbbedfbbaa805d5c970de4780125015fe7ce6d32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961403, "uuid": "4a2e5ef1-210e-4593-a270-0b5bc99f78f6", "value": "T17CF533AAC4E1D657C6D70576C8AA0C4CED240EBC782E335B028993FD5D58C5CE23FA5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961403, "uuid": "ed2d9b61-dbce-43bd-aebe-8b35c83645d6", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961403, "uuid": "a41b070c-5a9b-444c-b189-05c3929cc76b", "value": "98304:l8kfjM7ecMg4Zfwh/LkyfeedPFMx7lODoACngo1ty:2OMi/fngTM9lXACgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781961403, "uuid": "144e8e34-a355-4a0d-994c-fc7a8c8443c9", "value": 3594240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781961403, "uuid": "5bea1ec4-9c0d-41da-9bf8-517644f17f52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781961403, "uuid": "50330c97-85ff-47ac-9ebf-af1a37256a97", "value": "zapret.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e91a797f-6ce4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781986584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986584, "uuid": "f116513b-206d-4e9a-afa9-41e6a24de07b", "comment": "Malware payload", "value": "dea7147a32a1c00225289db907a0c3c9", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986584, "uuid": "0125ced6-8d5c-49a2-a360-390f24161d2f", "comment": "Malware payload", "value": "ed655d6bbc9315067360982455b4d14d5ef0c5fdf7ead51550bac30e25414afa", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986584, "uuid": "1d8c2552-d483-432b-9fd2-aecdbaadb9b6", "comment": "Malware payload", "value": "468501f0e7faadc812dfecc7aad2d76552daf2a1", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986584, "uuid": "c9db04d8-e259-4f15-82f4-d9031f63ff4b", "comment": "Malware payload", "value": "aa5dc47a397bee39069193d8d4123a42009633389ce994fcba56ec21be1d5ea49eb9490ffcff42346b438a979084bf5d", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986584, "uuid": "16452b31-a611-44bd-94c6-ba9f0e8032bc", "value": "T1308533D0AA9E0C5F6B1B13353EE64F4F1BE8B57812313DACB6A6742A24F971D2C51708", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986584, "uuid": "dae362c4-730a-4a1e-9152-75d5d23568ac", "value": "24576:sDkzFkb2pjkvsYxvtP3Xj3XRTffGBCyEs7IYeBWRP60P8HxCznUJR:PzFG4MDtr9fGB3ILBMEUznq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781986584, "uuid": "4611c7b4-8d59-4440-aa92-c37c980c5ec0", "value": 1737652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781986584, "uuid": "c5669d5f-79d5-419b-ab70-b229e4026b09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986584, "uuid": "3bcd2905-95b3-456f-a280-9d0be7c5f1d2", "value": "kblockd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4690ea2c-6cdd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781983305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983305, "uuid": "cecd1a81-a239-40b8-b92a-48dcaadb6999", "comment": "Malware payload", "value": "bda8d378206d1d427113ebd1d0f93056", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983305, "uuid": "45b43855-96b5-4b28-8292-6103bc3ec4d1", "comment": "Malware payload", "value": "ed6b9a8c2e638fc92a10cc88a0228e0c1dc088d5a28bb790f322137680b123f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983305, "uuid": "7facd738-d049-46d3-90bb-3096e737288d", "comment": "Malware payload", "value": "ff325456a382cc6746bb575868debd77d6ce66eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781983305, "uuid": "2a637749-565e-4c90-8c9e-6132dcedc4a0", "comment": "Malware payload", "value": "4cc8ab4767195235028c24565f2bcfbb7528014991b91a1211a37cdc613f64a43d9676c1acb50da73555ab270a627e23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781983305, "uuid": "655565e4-abd6-40de-b1bf-714d95bea14b", "value": "T168342A99BC40DB66C6E427BAFB4C429933134F78C3DD3506CD245F2976EB54B0A3A682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781983305, "uuid": "5d2b6b34-8620-4592-9903-b692141a1db0", "value": "6144:f1u8u9eP0oKkYF8krBt9zJfahXW9WIWeswUfCVzQOZ:nu9ecXkYF8krBt8XQLbRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781983305, "uuid": "1d50d709-25f7-4c79-96ef-617700a9c421", "value": 247644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781983305, "uuid": "7d0f2396-4507-473f-bd90-c2eaae73a9f8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781983305, "uuid": "80082d72-a641-44c6-bd38-ce4466876918", "value": "SecuriteInfo.com.Linux.BackDoor.Armada.1.30872.16543", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4b52c49-6c91-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781950821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950821, "uuid": "e2eebaad-40d0-447b-9f6d-1d6b168f76c4", "comment": "Malware payload", "value": "179f63b112f02c9c5342ce96c337b979", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FalseSign", "colour": "#18497A", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950821, "uuid": "1d6d86e1-f5f6-42e5-ae7d-9cb3bbc4e0a4", "comment": "Malware payload", "value": "edb95a1e278ee30fcd26fa313d6ea9c05f6af30a1de00e63ad988e85e0b0cbe5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FalseSign", "colour": "#18497A", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950821, "uuid": "8c5285a5-c1c7-43fb-830e-804b07fb94e3", "comment": "Malware payload", "value": "6208ad030b0d018853a0f293ae900be5faca997c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FalseSign", "colour": "#18497A", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781950821, "uuid": "85ae68b6-c39c-4854-87f8-5cfbd48fa3e6", "comment": "Malware payload", "value": "0d8458134d364680766e124d947d5050f78db6f91ed18fd6c4d2effe66c1bf33e81055dae89e9771f7aea9a945696535", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FalseSign", "colour": "#18497A", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950821, "uuid": "74d2b89c-80f9-481a-8fef-8354636ea764", "value": "T1EA66F107FCA508F6C0AE9272896255867B72BC452F3163D72E50B7782FB2BD0AD79704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950821, "uuid": "ea256cc9-e46d-4076-98e4-9b27a103cace", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950821, "uuid": "acdc88e8-f437-42ca-8be5-66d7dea180e7", "value": "98304:DMqknsDBm8FPStaYVTh4g1Z/Jf74XQ1qV8pK7W0IY2JPFbG:DYwvPe/hJxaQbphlPFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781950821, "uuid": "5784146a-29e9-4e26-aa6d-74a4dfd397aa", "value": 6862848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781950821, "uuid": "09127d9f-d299-4c00-a603-4071d0e4c0d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781950821, "uuid": "54eb46b8-f939-4f28-8e9d-f65e8ccd862c", "value": "UEmodHub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b6b9eb-6c3f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781915575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915575, "uuid": "99f5ee69-aff6-478b-913a-93f65beb359f", "comment": "Malware payload (Mirai)", "value": "3cc31f410d04c6545803ee8bdaa3765b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915575, "uuid": "6fa59955-b2ef-4e45-8b21-838812cec901", "comment": "Malware payload (Mirai)", "value": "ee05871ab753d707762944128130217f2311d0a78ebabf8a40e14bcdde78e54b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915575, "uuid": "5903f0b0-1925-4c4a-925d-400447817112", "comment": "Malware payload (Mirai)", "value": "b53d55424a20af166c7493635ec514c84912785e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915575, "uuid": "95efdc01-91c7-425b-8be2-b5f0dbd17338", "comment": "Malware payload (Mirai)", "value": "817351b28030e608f42d160b8a768a81f3177e7497b1ce45e096e486d2e8072434e4cac644e7e1af1e395c55cdb9f63d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915575, "uuid": "58a8a505-cd4b-42f9-8e04-481eaf140357", "value": "T1804309DAF800EC7DFC0ED73B84670806B131E69905921B362367B967EC762A44977F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915575, "uuid": "04ca6529-db59-431b-886a-1a60f81ef535", "value": "1536:riUOc7mihuN3sv8ebSnWN/70BFwfimFCDTHLdl+xmALgK:OUOli8N3sFbSWN/7Ff7FEixmmgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781915575, "uuid": "87b8bea9-5af1-40de-8dc2-e24f7d014c2a", "value": 58044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781915575, "uuid": "4f3b6da9-4471-49bb-a8a2-0c8612fad1a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915575, "uuid": "198cfd1a-f563-4273-b36a-9e2b4b68a81c", "value": "godisdead.10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79987bd-6c9f-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackShades)", "timestamp": 1781956892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781956892, "uuid": "fc97b6c0-dd8c-4aad-a7d0-cf04cb8337da", "comment": "Malware payload (BlackShades)", "value": "49cb19282d2e43eadf128dd03ff98394", "object_relation": "md5", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781956892, "uuid": "065639f5-a61d-4346-849e-d81854976091", "comment": "Malware payload (BlackShades)", "value": "ee50115e22710719e3fc70e61fa09ce101e409d0acb6d9b9a1b4f32c96917c06", "object_relation": "sha256", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781956892, "uuid": "20e4023f-1db8-400e-a20c-33e1f4e0e638", "comment": "Malware payload (BlackShades)", "value": "6cf6221711c69d1b908e24ed08ab5c5766d0a882", "object_relation": "sha1", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781956892, "uuid": "3aa69de2-7581-4470-8a72-e0da893a8040", "comment": "Malware payload (BlackShades)", "value": "da43245d67f896380ca3db6e2bc6bd9c5749fc8df099321dc20b6202317a101607a53b2221887790b1d1cea223a1a577", "object_relation": "sha3-384", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781956892, "uuid": "dbd23cff-918b-4544-80d9-80102e0b0d7a", "value": "T100F4BF2375D2C036D4B301B25639AB625EBEFE314A319997A7C8198D0E385C0EF2E717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781956892, "uuid": "79c717c5-2155-4d21-81f7-61bdfea288c6", "value": "d94607e52ea4c2cdfc94e0d96c087fe7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781956892, "uuid": "cd166d6f-8775-486d-a3d0-42fe90a9b766", "value": "12288:mqzcpVgUXzL0TTUKZHTNloEkOpnKgofuIwV6eAj0wZxxXMcEeB3paPcgGX:mqzcpKIL0TvZzNlNky0wVW0wZxTVgGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781956892, "uuid": "c64ae2f9-0bbe-4e9c-97d9-ff0237117b2c", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781956892, "uuid": "4dca9829-b7e0-45e0-97ac-980e3e6ac672", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781956892, "uuid": "09745e21-8ad7-40b6-864a-02a258578699", "value": "Moka.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf40dfe-6c3e-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1781915104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915104, "uuid": "05779b04-a508-4799-a86d-65196a94f61e", "comment": "Malware payload (NanoCore)", "value": "93e61d5a877bbb937e885d3ca385ac8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915104, "uuid": "7084fab8-3f75-4223-b65e-aff9faac2407", "comment": "Malware payload (NanoCore)", "value": "ef0e9301403d58a4729aaa9cd81abf942b1c8a301a651b1512bc2b5d9e599303", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915104, "uuid": "57a8f4c2-b3e1-4cc5-bc0f-d84555d38269", "comment": "Malware payload (NanoCore)", "value": "0b8b5c278750f6e4a14fde3495cd403eddb9f2bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781915104, "uuid": "71ac2ad3-5b1b-493a-8411-f3e7cbd18b9d", "comment": "Malware payload (NanoCore)", "value": "5f206df4ed2401f0bfad82735c7fd2eb29fa2d2f48290b1997d80731a8fa965c01ca8837c91fd96768ee958166b2f862", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915104, "uuid": "435f3cef-a32f-4f31-af0a-32000f7d2945", "value": "T15214BF2677B94A2FE2DE8679701206539378C2E398C3F3DE28D855B68F167E5060B1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915104, "uuid": "1880829f-bbc4-47c1-a02c-56b0120947a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915104, "uuid": "a7d03c9b-7073-4713-9e94-d3271749e522", "value": "6144:MLV6Bta6dtJmakIM5QBGmPDZ1ZgJB6QUWc:MLV6Btpmk9BGmPDZ1gB65Wc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781915104, "uuid": "74101318-30bf-4ae2-aa6a-fbeca314f97e", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781915104, "uuid": "f51dadc8-934a-4858-ba18-9bd11c166175", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781915104, "uuid": "f94fb79b-9b56-4fab-8b3e-5928041f54ad", "value": "gen2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db9a55b0-6cb9-11f1-a769-42010a9c0008", "comment": "Malware payload (RemoteX)", "timestamp": 1781968093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781968093, "uuid": "ddc8ecac-ca73-47bf-a07f-84fb21958b83", "comment": "Malware payload (RemoteX)", "value": "be10a9ac2bfe28e74a4ed2029a077d28", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781968093, "uuid": "9717afe3-6185-48ae-998a-68fd0747d7a1", "comment": "Malware payload (RemoteX)", "value": "ef3b3ab549f0abd21112eaa6b2d92cc43268960cc784241dc0512b38db090923", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781968093, "uuid": "bd30f9c3-b683-47a8-bb30-4678d4803de1", "comment": "Malware payload (RemoteX)", "value": "cf1a1e8a99cb6db904e6c1712d045f4437b3ae82", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781968093, "uuid": "5cacdc25-fe92-47b5-8f61-5763810002d9", "comment": "Malware payload (RemoteX)", "value": "34526e32d0ea001ca27137fa327afbaddd21c82e77be5b981ec60ddccf0e3b5209839ad966f3c44640dd19f38b562eb4", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781968093, "uuid": "781f2880-3918-449d-b179-da50fcb28527", "value": "T135277C1AF7A400FDE167D138C8664906FA767C4A43A09BCF23D45AA71F276D09E3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781968093, "uuid": "625ad9e0-15db-4845-b0d9-6cd283edc82f", "value": "661f8ef0408f411bc9378595cfd5da40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781968093, "uuid": "bc131e60-8dd3-4f2b-b2c2-feb309977c3b", "value": "6144:GCb8TFbucyV8tY27hwYf/VuzLyqnINuFTjRSxbuUDLcuvALv:dbM/LtVhwYFuzLQNgRSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781968093, "uuid": "e1e9e27f-9c88-43e9-b50c-045b2a6bb240", "value": 20971520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781968093, "uuid": "600fb7f5-0933-4775-83a7-e4d8c49e22c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781968093, "uuid": "a30d341f-614d-4b77-a631-4d380f15ba2d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105a0e77-6ce5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781986650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986650, "uuid": "ea3d92e0-3b93-4108-b100-7866fea546a4", "comment": "Malware payload", "value": "17b8aa8e40b438b44cb9818e965583d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986650, "uuid": "320880e3-0f3c-40de-9380-320624d11c04", "comment": "Malware payload", "value": "efc0aee14544530c3d1b1abcd349d5f5d13069c923ea2c45c3f5a002927f41ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986650, "uuid": "3db6ca79-7c5e-45ce-a867-e163995484c7", "comment": "Malware payload", "value": "6db2746cb5303b0fbc240560235e423d45aa4b57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781986650, "uuid": "96073f22-1123-4c31-8b99-615f044655fc", "comment": "Malware payload", "value": "a9d18a8ba60b5bcb444928941a88dc1f2ae62412f23642b17e965cfc06bfb4afc8eb09b31a5ddd2cb283d93c3aa2eafc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986650, "uuid": "db33d1d0-c9e7-4975-9b43-4797eaa4a9d0", "value": "T178560857B8924943C4E83677B8BE81C432631EBA9B8752566D05FE3C3EBE5D90E38314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986650, "uuid": "d631c23c-faaa-448a-acb6-9731567471c7", "value": "49152:sJdK4CeyQgV9c+JsNb+huYzSRsAhi/TQNCqDlPdSzg5E7w:CdKncGADGulPdJEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781986650, "uuid": "f148006c-4a24-4b09-920c-4684735e6cb1", "value": 6160532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781986650, "uuid": "edf6db39-1ad4-4fd5-9f3d-945e57e2c1f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781986650, "uuid": "13175be3-3edb-496c-8494-e43fb24bb7ad", "value": "kblockd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de6803a-6c8f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781949816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781949816, "uuid": "8dc02d1b-b663-45d5-9920-71d14da62776", "comment": "Malware payload", "value": "24ea5052481397f7de943917ecc3463a", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FalseSign", "colour": "#18497A", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781949816, "uuid": "46fcb8e7-c12e-4ba7-bcfe-87a101dbf961", "comment": "Malware payload", "value": "f0098031a2ed4201b074d71d569f7eb754881804c686f5a054c9f4dfc8f27342", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FalseSign", "colour": "#18497A", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781949816, "uuid": "1545625a-14a3-4a19-937c-1d53d2371f56", "comment": "Malware payload", "value": "b55b51cc426e08005950ac44f70d8cb57aa5850a", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FalseSign", "colour": "#18497A", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781949816, "uuid": "a8f25a27-8f03-4bab-9aca-987aacd2ea7a", "comment": "Malware payload", "value": "b65619035d4055438c10f9407a09e5c185443f0ab4d3e5f8753a59a97444b5db93cf0876c66ec69eefd703a54cffe4a3", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FalseSign", "colour": "#18497A", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781949816, "uuid": "35282e14-5ebd-4e8b-ac8d-e581355aa443", "value": "T1AAA56A5BBCE018B5C0AA97368972A1527A71BC490F3263C72F90B37C2F72BD09A75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781949816, "uuid": "5641667c-ad49-4da9-afd9-2a85a576daaf", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781949816, "uuid": "5f997247-9da2-44a9-9855-a53d58f1b870", "value": "24576:GqiQ0RIhAmOmtkn2ZStjzXcjxJTc21oIW3GdtC2eGx21+1WJDo2tGos:L0R6AmOm2n20j2VYQC2P2+1onGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781949816, "uuid": "be1adbb6-4cf2-4e24-9a36-ce5df0ac14e1", "value": 2222472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781949816, "uuid": "fb0fd046-f2c3-4713-aceb-2e98d650c498", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781949816, "uuid": "6e4a0d69-7c04-42b8-8ab6-82710e99c9ed", "value": "Setup-er.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f2a0fd-6c82-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781944441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781944441, "uuid": "2e88e3d2-16e2-4444-88d8-9fe6d4336ae0", "comment": "Malware payload", "value": "8978f9f9ec152ce70f8b4a3718053cc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781944441, "uuid": "e6fb6497-af95-4c26-9118-fb4a9a567e6f", "comment": "Malware payload", "value": "f1704dd2f371036a26753d78dcaba3c27ac6047f3ff5c958e9687ae14ca78125", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781944441, "uuid": "935946c0-77f0-4657-96a9-fff75badbf77", "comment": "Malware payload", "value": "47fbfdcc2023699b7682613526fa7a65298b8d65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781944441, "uuid": "ecba887d-b4fc-4ffc-9a4b-962533e62b64", "comment": "Malware payload", "value": "586e69b20a0dc74fb31820dc8dbb1481eb125457e523e2b45a86915f7a3de103cc9d14ddfb78fc649d987780427f77c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781944441, "uuid": "bc0c0d31-47fc-4130-839c-e38fb2a0f579", "value": "T1CFD423E119205987ACE3443666AE2150A2E3BEB1EF5CF6150122BC397F746C7C60F8E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781944441, "uuid": "2e418fdf-13ba-4162-9a44-3587259137a5", "value": "12288:aejIro9698mOhbGFWoJWdB4QN/42HTp8mFCmGYNDHOTD1lWT1zM:5IrSo8lbGgoJWdBfZlTp8hz5bWTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781944441, "uuid": "e7b74124-1dc7-41d5-9935-8405fdd54201", "value": 609828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781944441, "uuid": "004d1e7a-e90c-4e7b-916e-87ef90b4bd76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781944441, "uuid": "87f37679-31d1-43f3-aff3-38e117212add", "value": "poop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b544a68-6c67-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1781932550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781932550, "uuid": "1eabf866-db1d-4669-8ffb-ffab45c59165", "comment": "Malware payload (WannaCry)", "value": "c27c6c599a6771aa13ac23f0d3aa1bc4", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781932550, "uuid": "5079ed78-2ba8-455d-80b0-155c32b04a64", "comment": "Malware payload (WannaCry)", "value": "f560adff5b26c9c70c17d24440b03be5a944fded759dd04f006dad0a9ff6e160", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781932550, "uuid": "2f691af8-51e0-4d5b-a8b8-2f011199fa64", "comment": "Malware payload (WannaCry)", "value": "4d8fb2c045de0286065cf4b4199a5c967da0e4d6", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781932550, "uuid": "2349797d-2800-4ad1-b5a2-489cf4c3e635", "comment": "Malware payload (WannaCry)", "value": "cc65677d3be48b0bc7dfb24d814a75b877cde5208dcab8562a4835cfcb564a24a04315e09740b049538495d5ff536fbf", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781932550, "uuid": "ad9026c3-9b26-40f0-a724-6df339eeac79", "value": "T19A36235531A8C0B4D103157484F7CF22F6B6BC2A17BA6A4FAF904A7E2F23792E715742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781932550, "uuid": "2ef3a6c9-02a3-437c-8615-c76b0567ad32", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781932550, "uuid": "b054cd86-0080-4952-bd3e-6b5f256167a3", "value": "49152:jnsnpaSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:DMpJoBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781932550, "uuid": "daf3bbb2-1691-4f33-b29c-c4fe5313a4f1", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781932550, "uuid": "80680e00-9019-46f1-aba3-60665d432a23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781932550, "uuid": "69a9935c-d0e8-4d88-a816-ce1a98ee949b", "value": "f560adff5b26c9c70c17d24440b03be5a944fded759dd04f006dad0a9ff6e160", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "303c2359-6cb8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781967376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781967376, "uuid": "f6317834-5b98-4e01-b11b-d9f678ba2a55", "comment": "Malware payload", "value": "7f027ea24c83bda4e38caba933b5702d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781967376, "uuid": "32488eb9-88cb-40f8-89b0-ec79af9f5571", "comment": "Malware payload", "value": "f5b1a649fe5f16256640c9c2af65634d52b69d8d1d3c99d655726677f9149947", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781967376, "uuid": "24630d47-c2e1-459c-83bd-7f42390d9114", "comment": "Malware payload", "value": "b9f47c8a977949cea238bce8331de97044fde341", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781967376, "uuid": "4840e3c3-ca81-4713-9194-867a03bc2057", "comment": "Malware payload", "value": "84f094509cf9aa77017b842f31f7796c8e0bca29cfd55aa9f9f7b4b09e5f96dc0464c9d1703c0983e6258f11d11ea8b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781967376, "uuid": "bf5bf364-004b-4cca-98fa-6a4f45e67e8d", "value": "T1EF056D6377218F58E361E67009F3C751DA9521A30AF298C2A37CC6207E5166D6C6FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781967376, "uuid": "e16d4ec5-8f3f-47e5-b9b2-fc6de8489d0f", "value": "12288:ROQ0t6LYTfnnLowQMy+4kVG46Fp9TuGtIjExe3FigpqOEGRnH0x7:ROTt6LCnv4kVGFFpAGtQExeVp7Rnk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781967376, "uuid": "d3c68cf7-c36a-431d-b30f-cde08f16a031", "value": 795296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781967376, "uuid": "77e148ab-aa08-407a-ab78-1f73f531ceb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781967376, "uuid": "006c4a32-ba3b-4aeb-8dec-05ffbb4dc5f9", "value": "bot_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00922b4b-6c98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781953552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953552, "uuid": "f94fcd8d-a708-45e3-a4b3-02cdb8f85fb0", "comment": "Malware payload", "value": "8da9ffcce9dd2d3e816c8f19043c1b41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953552, "uuid": "21842dee-8c86-413a-b2d7-7b14247ab282", "comment": "Malware payload", "value": "f5efeae627f014d47a5758693339931127754fd5180eeee700386564a9034e14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953552, "uuid": "f8307eea-a0b1-4802-8472-0c0e4575b188", "comment": "Malware payload", "value": "b92864d76f4d5e07f9f05fea8b488b585cabae4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781953552, "uuid": "06c54d04-8d60-43f5-ac02-e72821a8b550", "comment": "Malware payload", "value": "58c0538342b586f9ee1aa08761f17892b9a7bd4c7f01f0701919e686085c1e93334c9cbf0e7450f6f4cf80f10ede0910", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953552, "uuid": "a76be4fc-5128-48ba-95db-98c4717daafd", "value": "T1CC41E1716B538ACFC49647BBB77ADF107293A769F3296156B390A3110D0D16B2B231C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953552, "uuid": "72d078d1-c1d4-4dec-a0c3-842232a5cab7", "value": "24:lFu6oxt7mCstEuDfu6AV4j/KNYTiOcAiHUMcxPTYCJClsQIF6nvnay/84FmFmFmR:lFoVJ4hiOJMQ8aClsQIF6nyydUUUiN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781953552, "uuid": "d80faf84-72f7-4726-b57f-301e7370b367", "value": 2328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781953552, "uuid": "69d4da1a-ec4d-4100-b9d8-f2180a95c5af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781953552, "uuid": "b12d70e3-9b73-470d-8451-fee506926f37", "value": "dlr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e7f3bef-6c88-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781946865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781946865, "uuid": "d56564a4-6fe6-467a-bfe4-9c707e8205ef", "comment": "Malware payload (ConnectWise)", "value": "6e082df971426e54933c7d0715cbd2f1", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781946865, "uuid": "1d128594-ecb9-4a68-bd42-79dbdef5b7d7", "comment": "Malware payload (ConnectWise)", "value": "f62e1fe4e314d0e7e5c82cad9b92573fccb231db6dabd7b4c2c70d0de839b07a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781946865, "uuid": "f54f3103-be60-4480-b8e9-1be4e792c532", "comment": "Malware payload (ConnectWise)", "value": "33cf42532d2ef7990f0bd0e9a5f123e49a27e056", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781946865, "uuid": "3ba8f2b7-9265-42f7-9f00-139e25b6fe27", "comment": "Malware payload (ConnectWise)", "value": "bff629a7c36d8cba468cec14554770c8a86058a3bf02e7a0ccddd99800622e7cb581f96c18a7bee2748982c036074b2e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781946865, "uuid": "bcfcc213-32f8-4300-94a4-2cfd5202f7b6", "value": "T1DBA6233123E5C46AE4F21A36E9B961B0113ABCA4D953C25F5364BD4E6E71D80E9B3333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781946865, "uuid": "4d26141c-3f81-4457-bdb9-ab74aaf95826", "value": "196608:loHQjDSOgtfPrDoHQjDSOgtSDoHQjDSOgtmDoHQjDSOgt:lowXS53owXSUowXSUowXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781946865, "uuid": "9ba35673-baf7-4e19-87cc-b694e693dc8c", "value": 10223616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781946865, "uuid": "1ff20c46-627f-4afa-8ca9-f0edb5a3226d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781946865, "uuid": "eea1e337-4e03-449a-b235-8037ed7945ff", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5547179-6ca6-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781959975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959975, "uuid": "151c65d6-3601-4201-86f0-d3667c77ae08", "comment": "Malware payload (Gafgyt)", "value": "b6cfeefc4786c5d54d011156685dc8ff", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959975, "uuid": "e0467e89-a5d8-4720-9519-99a077311e51", "comment": "Malware payload (Gafgyt)", "value": "f72745502b04fa6c2de5c49534846085cc3be574f364b7884af1e910198d63c5", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959975, "uuid": "e748368e-400d-45bc-bf10-deddf2511a77", "comment": "Malware payload (Gafgyt)", "value": "18b84cad96d050495c33a9aca4e68534e7dd7c0b", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959975, "uuid": "288a80fa-217b-4dc3-a788-050cf7862a19", "comment": "Malware payload (Gafgyt)", "value": "5c5cdd10cca7c29294b625591338342257245a6e550f3ba424cdecc7ef7c0940d9923f655d88e0dd35e646f7e72602f8", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959975, "uuid": "c63240b7-f2f5-49d4-9500-712c3c08237c", "value": "T1DDC33A2B3B231E23C0C9507102D31332BAB5D76538BD57E7B9D06DAC2F1AA983456BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959975, "uuid": "63f8e483-93cb-4b68-813e-1daa425df1bb", "value": "3072:9SRC0+2noxQHh0NPGH3phakTrnorm/nCEP/UnSQf/R:Hlg3phakTrorm/nCEP/UnSQf/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781959975, "uuid": "d082517d-4adb-4736-bdd8-007f098291cb", "value": 127477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781959975, "uuid": "2c3998c2-2dde-4c18-b0b6-773822b43903", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959975, "uuid": "4ed4a97b-dba2-4e1f-9590-7e6f3ad76249", "value": "assailant.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f6a642-6c84-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781945048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945048, "uuid": "0732e1be-df21-4939-b049-573252bc9388", "comment": "Malware payload", "value": "27633ffcdc3bf30ca27d16b64d02d4a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945048, "uuid": "345d8213-5ba0-4a87-9552-cd666767a56f", "comment": "Malware payload", "value": "f7e15fb576b5de441519a724d6a4acd8ea9a5a745db5827575d5fde443365c12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945048, "uuid": "a5d4dcef-7685-4973-a9ce-076b6a4f9066", "comment": "Malware payload", "value": "b449a75ec3c60c64ec9b926af04042161a4bff51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781945048, "uuid": "a4f5e4c2-41a1-4a81-82c0-521ca0c2e3a6", "comment": "Malware payload", "value": "f9bc083a9b2b739815545b79aef55988d5b6be08e006beb2a666e6e0fd50f73a68df73888476bf3119c558dff64e7997", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781945048, "uuid": "3a259467-7727-477f-9c11-705b45e70148", "value": "T12BD2D6E6F805DDBDF81EEB3F8417050AB131B74641831B3723B7B9A7AD761984822E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781945048, "uuid": "df797281-39e0-40ac-a236-46f6c6a35309", "value": "384:5hqeuYuCvR4Zbw0wKlT3Z8ce+nOGA8HAzqvbTezmBDD+no0vURYnTB:nqeuS6Te7+nOX8uqvbTlD+o0vUqnTB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781945048, "uuid": "eb2ed7b1-aad5-4bde-aa3f-262a2d75dfbf", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781945048, "uuid": "57e190ec-82fe-4039-af21-07185f6327a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781945048, "uuid": "4ef166e1-5a8d-4d30-b986-4c18f0563b17", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfac6ff8-6c55-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781925150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781925150, "uuid": "c3adaf22-98c8-4f32-9094-1c20d006d0b9", "comment": "Malware payload (Mirai)", "value": "580c43f9b2abff4ad5844897cdebc964", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781925150, "uuid": "fbeae1ad-151b-446a-802a-0f3f49add560", "comment": "Malware payload (Mirai)", "value": "f8a25095fbd2531cd653e77dd00d4ec5b1978dc75b85619c1c877fca97c91adb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781925150, "uuid": "8b0e1d29-3692-4140-a0ef-a1806bfca077", "comment": "Malware payload (Mirai)", "value": "95c19a2f9976128cf4aa8056af69e849569b25ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781925150, "uuid": "600d66e0-5a2d-46c9-a827-d9bc23d95a36", "comment": "Malware payload (Mirai)", "value": "82cbbefd90eef25ca0d395613a0807cf70b79fa17f00b96a4224359c699f327baf104c50ba08893afbe7ff6d1562110f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781925150, "uuid": "7a9312e5-4499-4238-a5b4-e7baa9560e07", "value": "T11323F26015417799DEA20A7FF7B4485273DA827481FEAB3AB144EF3095D604E33B05CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781925150, "uuid": "bd18a7c8-7e4b-4542-a2b4-559d38e5c6d6", "value": "768:0IxSNkbvv0a+8WcsP7puZW8VGO+QwubpfMfu2FS366RoIbH4CnsZZqOVhgD4C4c/:0IQNkjz+8IP7puZ4Puyfu2ply7nmXfgb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781925150, "uuid": "d895077e-aa99-45d8-9e3a-baf76c7951d2", "value": 46948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781925150, "uuid": "133df5c3-d74c-439f-8ed3-2de9ba52b526", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781925150, "uuid": "c74c99e4-e0b0-4c33-b2da-a7984723226b", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b89a752-6c4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781922432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922432, "uuid": "7c042166-4541-4388-8402-692cd1405c7d", "comment": "Malware payload (Mirai)", "value": "8de1cb8dac2f72d905df2311d5d0e44b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922432, "uuid": "30292598-b0f8-4e2a-97da-3e7fa82a8292", "comment": "Malware payload (Mirai)", "value": "f940bb807d9320fb673210c1405612f4f8839074e28211792cf21cdc3ee2f609", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922432, "uuid": "88fc8e7c-a7ec-40e2-a4e3-c6d790080f29", "comment": "Malware payload (Mirai)", "value": "9e36861faeb254eb255f5dc88e5c4e720242256f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781922432, "uuid": "85ef88cc-3629-4ca0-8783-7a725373b907", "comment": "Malware payload (Mirai)", "value": "201740e93aa27346a2d0513b73bcbf71bf231945ba07d20fcede49b7019fca53c3c211223f7227f1cdceb16ff2430ec1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922432, "uuid": "34d25429-1cdd-4733-876c-b7820b8281f0", "value": "T1E8A312ED0234F5C086B16438DC1F4E957ADFCE951B2EFDD24A38C43831865195B6938A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922432, "uuid": "97bd5750-8c29-4dca-a32b-fd08491785cd", "value": "3072:4jpUFN8WoXYzk6+vvt0/bBXoeKEi2+P2/jOBtLGpT3zesYp7oX:4jw1zk66OfNbOXLiTDeL7oX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781922432, "uuid": "a77d1310-eed5-4292-b90b-55dcbb018798", "value": 105956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781922432, "uuid": "b927beb7-5479-4333-9472-cad9bd6a9a29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781922432, "uuid": "a4a7acd6-f798-4e7c-ba34-9c5bc0cce3b2", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab57e702-6c6d-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781935370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935370, "uuid": "93d3e66c-abe8-471e-a152-5b4ca3cc22ad", "comment": "Malware payload (CoinMiner)", "value": "5e47853a5fd884184bc012eb6fd99c32", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935370, "uuid": "f5b71d28-00c0-47e5-946c-43c2f0baf788", "comment": "Malware payload (CoinMiner)", "value": "f9cc0b697020637be30aedb8e343813aede87b2cc4d5ee923d105b877a04dced", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935370, "uuid": "fb46e405-853d-431f-be0d-2b98682c381d", "comment": "Malware payload (CoinMiner)", "value": "d14a6ea997b5097202a747b0953df57866ddbda8", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781935370, "uuid": "9c077e05-876a-4f08-8600-e59664a61a9f", "comment": "Malware payload (CoinMiner)", "value": "d6af2cd0a32e343ed1372851ed60d845bad19560c0d16cbfc75276e6a3ff3d40a8757fbca81bc027a304bca9c93c9079", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935370, "uuid": "44b32296-cbc4-468a-95df-fc648668ab0b", "value": "T1D9342AA9BC40DB66C6E427BAFB4C429933134F74C3DD3506CD245F2976EB55B0A3A282", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935370, "uuid": "6571d302-c812-401c-9f15-4087a1334a15", "value": "6144:vXJ/d+On8d6ueXxtrrY1r21rmRU6GfIr8R49Vvke2wTt78Oew:pd+OnJuoxtvY1S1rmRUxR+t/13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781935370, "uuid": "62fc8946-fc05-42d2-914a-3553709a1d5d", "value": 247644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781935370, "uuid": "d8025cab-f995-488f-a7d8-6ec68230e46c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781935370, "uuid": "98e9d94f-5176-411a-a107-4edb51c8b03f", "value": "kworkerd-irq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb01ee89-6ce1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781985299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781985299, "uuid": "1e10d253-a640-4ca7-ad27-c2ad9d32cb7e", "comment": "Malware payload", "value": "83849dc3972faa9fad3ec8451e06eba8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781985299, "uuid": "49460cdf-3085-49bf-b36f-e8ad6aa52748", "comment": "Malware payload", "value": "f9e57e757b896deab77b71e725055453328fffb613b59c130ce90eb14e0befc7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781985299, "uuid": "f473bcf7-cd78-4df3-aeb7-1fb3517423e2", "comment": "Malware payload", "value": "fec747af46181cce7f221ef000bfa6b7b7156b1d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781985299, "uuid": "44091a44-3e11-4351-b48e-e02f743c98da", "comment": "Malware payload", "value": "13f63264224f5624c7917e1eccafd20c5a0507192dce79484011f0498f7f8ee38f38178c186a0fb2e9eacf5e3c4d9e3f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781985299, "uuid": "151bc324-3b9d-4f7e-8e3c-8f1c3b6c581c", "value": "T1B92146C432A077F25FDEF45A2A1B58EF21AD58D72F039CD8181C44E1AF50BC6EC246A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781985299, "uuid": "a4ae5c4a-ae81-4af9-aefa-8a697f4a2f52", "value": "24:fsB58d8BqVdEFBUdNqBC11dmB0dvCBdTWd9qBydJ+BSdsOEBKdHEBCdkB4b/diBS:fgSdQydE7UdIC11d20dvCdCd96ydJ+Sj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781985299, "uuid": "5c912594-7849-4345-a6b4-b02b702e0662", "value": 1278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781985299, "uuid": "43451eb5-ec32-4502-9c1b-8d6fd363107d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781985299, "uuid": "fed5323f-d840-48df-9c91-e92555617248", "value": "ftpget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b6f8f21-6ce9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781988574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988574, "uuid": "a8bbaf8f-f0ca-464a-9236-e35d0b9a2439", "comment": "Malware payload", "value": "218e81a644c5b44c5206499baf86ff55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988574, "uuid": "b1ba5cba-0a28-421e-8fa0-1f76355dc256", "comment": "Malware payload", "value": "f9f8567aaa807983097deb4b7fb130cc2374ace1fb08a6a825324d892f11c140", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988574, "uuid": "cccd8431-72a4-4f2d-a9f3-b96e00c2b0d2", "comment": "Malware payload", "value": "88771e27c46608545bd3fb6b091bc74d0f6c5789", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781988574, "uuid": "f8805818-d269-4456-bb7a-f684f22dd35a", "comment": "Malware payload", "value": "c63a44625ab7334fd993a94bc5e81e914188abe6b4c8fff7c5fad8d450bcad2d1bb1bb1266429f07b641b7fb87926178", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988574, "uuid": "333a42be-ffdf-4248-a22d-0a0c4f0d3806", "value": "T1F6A3123253222C21C124247E4D8916E5872C7B6A7CEB3A830796491AC7E71CF29FFE5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988574, "uuid": "a44ae3bc-d687-4a70-8c39-390adc9d6604", "value": "3072:8cujVe+UpCQQ9toPuFvZGdIzFLXYTAkan+TnTW:8Ve+UpCQQWumMFLXmAkanYa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781988574, "uuid": "a3ac3344-1d60-48e8-8f66-a232e00f3239", "value": 106952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781988574, "uuid": "1c6a19dd-b31d-4d77-b436-d73bfabee65e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781988574, "uuid": "7f376622-dfda-43bf-8349-2b546968eac0", "value": "kworkerd-irq-bal", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeffe14e-6ce1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781985305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781985305, "uuid": "e1a6ce8b-4865-4e73-86e9-2d60ebeceaa5", "comment": "Malware payload", "value": "eae25426745a4910cf11a0de00caabf7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781985305, "uuid": "d189fdbb-3f0a-45f8-9f67-e6013fd94765", "comment": "Malware payload", "value": "fa84bfb56f24194e953a3b800aafe918e99ce2d00d102049ab1f4b973a9f508d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781985305, "uuid": "d3531b60-884e-489b-a885-1293786266f5", "comment": "Malware payload", "value": "c093fbf3e9d43143b2e8a68a2ef4078d6b410227", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781985305, "uuid": "80f02438-aca7-467e-8899-319055bc7634", "comment": "Malware payload", "value": "a2731ae1fc52ea8f5a1f389ad57b5580a950ab7de4973887f34ece4833212879aaf33292820f54cf3e853b591e4098d7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781985305, "uuid": "27c878cf-4ec6-46b3-b1bb-d476ed87b86c", "value": "T13F214BC912A067F38ED8C94039539CADB06D49D77A078AEC284C0AF36E52B96FC1CF55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781985305, "uuid": "9f31a892-a880-4e84-9b8c-f933b75186c7", "value": "24:sB5gHBqV5vFBRqBC1RBgBKBdTTqBkBnIB+RBEf3BykIBUBM93BGSN:gGhqd7kC1nEadv6I8WEyfYOxRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781985305, "uuid": "a995512d-141f-4832-b70f-cd0f31172560", "value": 1419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781985305, "uuid": "98b83afb-e997-4dd5-b8a5-532cd819f4bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781985305, "uuid": "7c60cf41-c03f-4e07-a329-2eecf1b7ad60", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4eea385-6ca6-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781959975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959975, "uuid": "fbb2b131-f688-4909-b076-4153ee843bd3", "comment": "Malware payload (Gafgyt)", "value": "f6468e8833d8831300e931bcced4b5ee", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959975, "uuid": "0ef8f5dc-37af-49ba-95fd-03d66433972c", "comment": "Malware payload (Gafgyt)", "value": "fd8f404aeb0b25dccb13a9b97b35c95ca8cb45a126db0014c81fc1992f02a408", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959975, "uuid": "cb800170-159f-428c-a5cb-2e8373478dcd", "comment": "Malware payload (Gafgyt)", "value": "8a09b0310e671728c51fc3ee94c8132aad811179", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781959975, "uuid": "5e1d1b96-d7ce-4e09-8e71-c476019de4b5", "comment": "Malware payload (Gafgyt)", "value": "23d6fa016cc3df937464b73bee9e4aad2fda3de17f2b17a5bbec113fcfc6002f4bdad272500cc654a63158c00396fa22", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959975, "uuid": "f3bbb4aa-1021-46af-975d-453cfe16a421", "value": "T1C8B33B57671C0B43C58B5AF12D7737F187ADEA7102E221C5E90EBF801B72A705A21FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959975, "uuid": "668f0b28-2504-446f-a2a9-fe47be5992e8", "value": "3072:w7ZdycbEWrZii5JCmA5hefuWKtQna0PDG4gQNcR:yZdGWrZii5wmA5hefotQna0PDG4gQNcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781959975, "uuid": "8ef5b4f4-5a43-4b35-9a79-dd2b46bb2ed6", "value": 116437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781959975, "uuid": "27df2129-5c6b-4932-ae55-898c03bf474c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781959975, "uuid": "565a672f-fd4c-463f-997b-f4d30b7a6451", "value": "assailant.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32aa2931-6ca7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781960079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960079, "uuid": "7aa1ca24-5ca9-43f1-acdb-d6fa59db7143", "comment": "Malware payload", "value": "6a31b6cc74d3377af554b9176ee6ad15", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960079, "uuid": "1106b10b-08f2-4e88-8e71-6ecc198b76bf", "comment": "Malware payload", "value": "ff7ef7b89256ee681d76c7369f4619003e0e77f5e32fa0e18a09ae45a8e98843", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960079, "uuid": "a3ed9812-9445-4612-b322-bda2feeff8b0", "comment": "Malware payload", "value": "a56295554ddb80b424b2a48c7ea33dc7f78110c2", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781960079, "uuid": "57c15a9e-d650-47f7-807f-a4076a5a0350", "comment": "Malware payload", "value": "a19f1836da9526f2ae07a4f9fa32f1191a2a78ff81c30d00ab343856317be207896cb1ab3948bfe6c51077424d8b7d43", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960079, "uuid": "4829f81e-d217-4ce7-b72c-5340b6cf36c8", "value": "T15246E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960079, "uuid": "625d4e1d-f94b-4a11-b0c4-28b423c2b23c", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960079, "uuid": "0da75587-dbae-4929-9cb5-8e01a0c5d519", "value": "98304:CzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:ChfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781960079, "uuid": "173efa1b-089a-4bee-bcd5-7607103886dc", "value": 5641504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781960079, "uuid": "595d7836-b93b-4a9b-9718-7b3fdc295029", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781960079, "uuid": "4b7c38c6-12ea-4e65-b68b-83b942f2acfd", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }